GM Accounts

What a GM Account Is

There is no separate staff login. A GM account is an ordinary account, the same email and password any player uses, with a grant recorded against it. The grant carries a level and the game it applies to.

Because it names a game, one login can be staff on one server and a plain player on the next. An account with the top level on your 2.2.3.2 server has no powers at all on your 2.1.5 server until you grant it there too. The accounts database is shared between the games on a machine; the grants are not.

An account with no grant is a player. That is the default and there is nothing to set.

The Five Levels

Levels are cumulative. Level 3 can do everything levels 1 and 2 can.

Two thresholds matter more than the rest.

• The control panel opens at Administrator. Below level 3 the Admin link does not appear, and the pages behind it refuse the request rather than rendering empty.
• Editing server settings and granting levels needs Super Administrator. An Administrator sees every setting and the whole staff list; only a Super Administrator can change either.

The panel refuses two things without exception. It will not let you change your own grant, which is what stops you promoting yourself and what stops you locking yourself out by accident. And it will not take the last Super Administrator down a level or revoke them, because a server with nobody at the top can no longer edit settings or hand out levels. It says so and tells you to promote somebody else first.

Making Your First Administrator

A fresh install has no accounts and no staff at all. Nothing is seeded, on any game, which means the first grant has to come from outside the normal rules. There are two ways to make it, and they suit different people rather than ranking against each other.

• The bootstrap password, printed in the console by your server's website: the GameCP on the RF versions, the webserver on the two Gate to Heavens servers. No tools, no database, browser only.
• GoMMO Manager's Accounts window, in every RF archive on Windows, which writes the grant directly. This is the offline path, and it works with the servers stopped.

Either one gets you to the same place: an account holding Super Administrator on that game. The two Gate to Heavens servers have the bootstrap password and no manager.

The bootstrap password

1. Start your website: the GameCP on the RF versions, the webserver on Gate to Heavens.
2. Read the password. On Windows with an RF release, press Show Admin Password in GoMMO Manager and it reads the current one straight out of settings/settings.cfg. Otherwise look in the console, where the website prints it as a warning on its own lines while this game has no Super Administrator. Either way the same value is on disk under [webserver] as SUPER_PASSWORD, so it survives the console scrolling past.
3. Open your own site and sign in. Use whatever email address you want the account to have, and the bootstrap password in place of the real one.
4. You are signed in, and that account is now a Super Administrator on this game. If the email was new, the account is created and the password you typed becomes its real password.

Four things to know about that password.

• It only exists while nobody is behind it. The website checks on every start. If any account already holds Super Administrator on this game, it blanks SUPER_PASSWORD and logs that it did.
• It is single use. The moment it works, it is blanked on disk. The same string never works twice.
• It is regenerated on every restart while nobody has been promoted, so a value somebody read over your shoulder last week is already dead.
• An empty value signs nobody in. The comparison is skipped entirely unless a real value is on disk, so a blank line is no door at all.

The reason for all of that: bootstrap access is the one credential a server cannot avoid shipping, so the design gives it the shortest life it can have.

If no password appears in the console, the troubleshooting page has the two reasons and what to do about each.

GoMMO Manager's Accounts window

Every RF archive ships GoMMO Manager at its top level, and its Accounts button opens a window over the same accounts database the servers use. It reads settings/settings.cfg itself, so it works on the file-based database with nothing installed, and on MySQL without a client, and it does not need the servers running.

From it you can search accounts by email or display name, create an account, set its password, set its staff level on this game from 0 to 4, ban or unban it, clear a forgotten UI lock, and delete it.

To make yourself the first administrator: open Accounts, create your account if you have not registered yet, select it, and set its level to 4 (Super Administrator). Start the servers, and the GameCP's admin area is yours.

On Linux there is no manager. Use the bootstrap password.

On the two Gate to Heavens servers

Gate to Heavens and Gate to Heavens Classic read the same grants and mean the same five levels by them. Their webserver prints the same bootstrap password and it works exactly as above; the grant it makes is for the game that webserver runs, classicgth or moderngth. Once one account holds Super Administrator, the control panel's Staff page handles everyone after that.

In game, their commands split differently from the table above. A player can use /help, /who (names and levels) and /info on their own character. A Moderator adds the commands for reaching and watching players: /goto, /summon, /tp, /warp, /hide. A Game Master adds everything that changes a character, the world or the economy. Muting, kicking, banning and server notices are Administrator commands. /help lists exactly what your level allows.

The game server reads a player's level when they log in, so somebody already online keeps the level they had until they come back. Taking a level away is the exception on 2.2.3.2: it re-checks a staff member's level on every command they run, so a revoke there stops them at once rather than at their next login.

If you lose access to every admin account

You are not locked out permanently. Take the last Super Administrator grant away (in the manager's Accounts window, set their level to 0; or delete their account_gm row) and restart the website: with nobody behind the door, it generates a fresh bootstrap password and prints it, and you are back at the start of this section.

Expect to redo the grants for anyone else who held one, because you have just removed the only account that could have made them.

Promoting Everyone Else

Through the control panel

This is the normal path once you have a Super Administrator. Sign in on your site, open Admin in the header, then Staff. Search for the person by email address or display name, pick a level, save. The change applies the next time they enter the world.

The same page lists everyone who currently holds a grant, with their level, when it was granted, and any note attached to it.

Through GoMMO Manager

The Accounts window hands out and takes away the same levels the panel does, and it does not need the GameCP running. It keeps no record of who made a grant or why, because it runs offline and nobody is signed in to record. Use it for the setup you do before the GameCP is up, and for the times the GameCP is the thing that is broken.

Through the database

Grants live in one table, account_gm, in the shared accounts database. A row is keyed by account and game key. Level 0 is stored as no row at all, so revoking is a delete rather than an update.

On MySQL:

USE gommo_accounts;

INSERT INTO account_gm (account_id, game_key, level, note)
SELECT account_id, 'rf2232', 4, 'first admin'
FROM accounts
WHERE email = '[email protected]'
ON DUPLICATE KEY UPDATE level = 4;

On the default file-based database, from the directory the database path is measured from: the top of the archive on the RF releases (where db/ sits, beside settings/) and server/ on the two Gate to Heavens releases, not the folder the executables sit in:

sqlite3 db/gommo_accounts.db

INSERT INTO account_gm (account_id, game_key, level, note)
SELECT account_id, 'rf2232', 4, 'first admin'
FROM accounts
WHERE email = '[email protected]'
ON CONFLICT (account_id, game_key) DO UPDATE SET level = 4;

To revoke, on either backend:

DELETE FROM account_gm WHERE account_id = 42 AND game_key = 'rf2232';

Two of the columns are there for you rather than for the server. note is free text, and granted_by records the account that made the grant. Only the control panel fills both in, with the account you were signed in as and the note you typed. GoMMO Manager fills in neither. So fill them in yourself if you go this way, because in six months the note is the only record of why somebody is staff.

Some Versions Ship With Their Commands Open

RF Online 2.2.3.2, 1.5 and 4.15 hand every account a set of in-game commands with no grant at all, and the files arrive that way. A tester can set their own level, spawn the item they came to look at, heal up and teleport to it without anybody being made staff first.

The open set is deliberately narrow. Everything in it acts on the account that typed it or reads something back, and nothing in it reaches another player: appointing a race leader and moving credits stay staff-only whatever else is set. The RF command reference lists what is in it and what each command does.

Every Client Is Told It Is a Developer

Open commands come with one side effect, and nothing on screen explains it.

While the set is on, the server tells every client at login that its account is a developer. That part is not optional. A 2.2.3.2 client decides for itself whether a % line is worth sending, and one signed in as an ordinary player never sends it, so the server would sit waiting for commands the client had already refused to pass on.

The client changes what it shows once it believes that. The effect people notice first: it stops asking for the FireGuard password. A player who set one is not prompted for it at login, and a player who has not set one is never offered the chance. Staff name tags stop being masked, and the observer and debug overlays open.

None of that grants any power on the server. Whether a command runs is decided here, by the level on the account and the level the command asks for, and a client that believes it is a developer is refused exactly like any other. What it changes is what your players see, and what they are asked for.

The One Setting That Turns It Off

Let every player run the safe GM commands, under GM Commands on the settings page of the GameCP. Switch it off, save, and that is the whole undo.

Nothing else has to change. There is no command list to edit, no file to open, no rebuild and no database row to write. The access levels setting sitting under it moves individual commands in either direction, and it plays no part in taking the set back: leave it empty and everything goes back to needing a grant.

The two halves of the change land at different times, which is worth knowing before you decide it did not work.

• The commands close immediately. Anyone already in the world stops being able to run them the moment you save.
• The developer grade waits for the next login. A client is told what its account is when the character enters the world, and that is not revised mid-session. Somebody already online keeps the developer look, the missing FireGuard prompt included, until they log out and back in. New logins are told plain player straight away.

Saving a server setting needs Super Administrator. An Administrator sees the page and cannot save it, the same as every other setting on it.

Which Servers This Applies To

RF Online 2.2.3.2, 1.5 and 4.15. The older four RF versions have no player command set to switch: an account with no grant gets nothing there, and each client is told what its account actually is, which is why 2.1.6 asks for the FireGuard password the normal way. The two Gate to Heavens servers are a separate case, and What Works Today, further down this page, covers them.

The default suits what those server files are, which is a prototype people download to try a version on their own machine. Turn it off before you open a server to people you do not know. Left on, every visitor can hand themselves the level cap, a full bag and any position on the map, and none of them is ever asked for a FireGuard password.

Which Game a Grant Applies To

game_key is the internal key for the game, not its public name.

A grant on the wrong key is a grant on a game you may not even run, and nothing will tell you. The control panel and GoMMO Manager always grant for the game they belong to. SQL takes the key from you, so read it back with SELECT * FROM account_gm WHERE game_key = '<key>' before you trust it.

What Works Today

The control panel ships with every RF version and with Gate to Heavens Classic. It is part of the same binary covered on the GameCP page, and it appears in the header once your account reaches Administrator. Not every server control is implemented on every version yet; where one is missing, the panel says so rather than reporting success.

The five levels mean the same thing everywhere, but only the three newest tier their in-game commands today. On the older four RF versions any grant of Moderator or above runs every command that version has, so pick the level with that in mind until the split reaches them.

The two Gate to Heavens servers use the same table and the same five levels, and the game server reads a player's level from it at login, so a grant means the same thing there. The first grant on those two is made with the bootstrap password, the same as everywhere else.

One more honest note about those two. While the game is in alpha, most of its in-game commands are deliberately open to every account so testers can use them. A grant there is recorded and read correctly, and it starts to matter when the command set is tiered.

Security

The bootstrap password is a door that only exists while the house is empty. Keep it that way: promote yourself the moment you see one, and check afterwards that SUPER_PASSWORD in settings.cfg (in settings/ on the RF releases) is blank. A value sitting in there on a server that already has staff means the grants were cleared, and you should find out by whom. The sign-in path for it is rate limited the same way registration is, and every failed attempt is logged.

GoMMO Manager is the other way in, so treat it the way you treat the database it writes to. Anyone who can run a program in that folder can make themselves staff, which is an argument for the server living somewhere only you can log into.

Do not leave a Super Administrator grant on a shared test account. Test logins get handed round and their passwords get reused, and the top level can edit server settings and hand out more staff. Give each person their own account and the lowest level that lets them do the job.

Every grant is recorded: who it is for, what level, who made it, and when. The staff list shows the level, the date and the note, so write the note as the record of why. It does not show who made the grant; that is the granted_by column, and the SQL above is how you read it. The log carries the rest. A change made in the control panel is logged with the account that made it, and a bootstrap sign-in is logged with the address it came from.