GM Accounts

What a GM Account Is

There is no separate staff login. A GM account is an ordinary account, the same email and password any player uses, with a grant recorded against it. The grant carries a level and the game it applies to.

Because it names a game, one login can be staff on one server and a plain player on the next. An account with the top level on your Golden Age server has no powers at all on your Red Army server until you grant it there too. The accounts database is shared between the games on a machine; the grants are not.

An account with no grant is a player. That is the default and there is nothing to set.

The Five Levels

Levels are cumulative. Level 3 can do everything levels 1 and 2 can.

Level	Name	In game	In the control panel
0	Player	Nothing beyond normal play.	No access.
1	Moderator	Player management: mute, kick, ban, unban, server notices.	No access.
2	Game Master	Items, monsters and the world: spawn things, move and heal players, teleport, set money and level.	No access.
3	Administrator	Server operation: reload game data, announce, start a shutdown.	Read access to settings, staff and server detail, plus the server controls.
4	Super Administrator	Everything.	Everything, including editing settings and granting levels.

Two thresholds matter more than the rest.

• The control panel opens at Administrator. Below level 3 the Admin link does not appear, and the pages behind it refuse the request rather than rendering empty.
• Editing server settings and granting levels needs Super Administrator. An Administrator sees every setting and the whole staff list; only a Super Administrator can change either.

The panel refuses two things without exception. It will not let you change your own grant, which is what stops you promoting yourself and what stops you locking yourself out by accident. And it will not take the last Super Administrator down a level or revoke them, because a server with nobody at the top can no longer edit settings or hand out levels. It says so and tells you to promote somebody else first.

Making Your First Administrator

A fresh install has no staff at all. Nothing is seeded with a level, on any game, which means the first grant has to come from outside the normal rules. There are two ways to make it, and they suit different people rather than ranking against each other.

• The bootstrap password, printed in the console by the website the RF versions ship with. No tools, no database, browser only.
• The command line tool in the archive, which writes the grant directly. This is the offline path, it works with the server stopped, and it is the only path on the two Gate to Heavens servers, whose website does not carry the control panel yet.

Either one gets you to the same place: an account holding Super Administrator on that game.

The bootstrap password

1. Start the website.
2. Look in the console. While this game has no Super Administrator, the website prints a bootstrap password as a warning, on its own lines, in the output you are already watching. The same value is written into settings.cfg under [webserver] as SUPER_PASSWORD, so it is still there after the console has scrolled.
3. Open your own site and sign in. Use whatever email address you want the account to have, and the bootstrap password in place of the real one.
4. You are signed in, and that account is now a Super Administrator on this game. If the email was new, the account is created and the password you typed becomes its real password.

Four things to know about that password.

• It only exists while nobody is behind it. The website checks on every start. If any account already holds Super Administrator on this game, it blanks SUPER_PASSWORD and logs that it did.
• It is single use. The moment it works, it is blanked on disk. The same string never works twice.
• It is regenerated on every restart while nobody has been promoted, so a value somebody read over your shoulder last week is already dead.
• An empty value signs nobody in. The comparison is skipped entirely unless a real value is on disk, so a blank line is no door at all.

The reason for all of that: bootstrap access is the one credential a server cannot avoid shipping, so the design gives it the shortest life it can have.

If no password appears in the console, the troubleshooting page has the two reasons and what to do about each.

The offline tool

The archive ships a small program called gmadmin in the tools folder at the top of the archive, on RF and on Gate to Heavens alike. It reads the same settings.cfg the servers read and writes to the same accounts database, so it works on the file-based database with nothing installed, and on MySQL without a client.

It finds that settings.cfg on its own, from where the program sits, so it works whether you run it from the folder you unzipped or double-click it in tools. Run it with --help and it prints everything below.

gmadmin list                          accounts holding a grant on a game
gmadmin search <text>                 find an account by email or display name
gmadmin create <email> <name>         create an account (asks for the password)
gmadmin passwd <email>                set an account's password (asks for it)
gmadmin grant <email> <game> <level>  give an account a level on a game
gmadmin revoke <email> <game>         take the grant away again

Passwords are typed in when it asks, never given on the command line. A command line is readable by other users on the machine and it stays in your shell history.

Granting yourself the top level on a Golden Age server, from the folder you extracted it into:

cd C:\games\rf-golden-age
tools\gmadmin.exe grant [email protected] rf2232 4

If you have not registered on your own site yet, there is no account to grant, so make one first:

tools\gmadmin.exe create [email protected] Ron
tools\gmadmin.exe grant [email protected] rf2232 4

The same two commands on Linux, from the same folder:

cd ~/rf-golden-age
tools/gmadmin create [email protected] Ron
tools/gmadmin grant [email protected] rf2232 4

Check it landed, then start the server:

tools\gmadmin.exe list --game rf2232

On the two Gate to Heavens servers

Gate to Heavens and Gate to Heavens Classic read the same grants and mean the same five levels by them, but their website has no control panel and prints no bootstrap password. The tool is the normal way to make staff there, and it is the same three commands with a different game key:

cd C:\games\gth-classic
tools\gmadmin.exe grant [email protected] classicgth 3
tools\gmadmin.exe list --game classicgth

The game server reads a player’s level when they log in, so somebody already online keeps the level they had until they come back. Taking a level away is the exception on Golden Age: it re-checks a staff member’s level on every command they run, so a revoke there stops them at once rather than at their next login.

If you lose access to every admin account

You are not locked out permanently. Take the last Super Administrator grant away and restart the website: with nobody behind the door, it generates a fresh bootstrap password and prints it, and you are back at the start of this section.

tools\gmadmin.exe revoke [email protected] rf2232

Expect to redo the grants for anyone else who held one, because you have just removed the only account that could have made them. On Gate to Heavens there is no door to reopen, so use the tool to grant a level to an account you do control instead.

Promoting Everyone Else

Through the control panel

This is the normal path once you have a Super Administrator. Sign in on your site, open Admin in the header, then Staff. Search for the person by email address or display name, pick a level, save. The change applies the next time they enter the world.

The same page lists everyone who currently holds a grant, with their level, when it was granted, and any note attached to it.

Through the tool

The tool hands out and takes away the same levels the panel does, and it does not need the website running:

tools\gmadmin.exe search maria
tools\gmadmin.exe grant [email protected] rf2232 2
tools\gmadmin.exe revoke [email protected] rf2232

A level name works in place of its number, so grant [email protected] rf2232 "game master" is the same command.

Two things to know before you rely on it. It keeps no record of who made a grant or why: every grant it writes is noted as gmadmin, with no granting account, because it runs offline and there is nobody signed in to record. And every command that sets a password stops and asks for it, so create and passwd cannot run unattended in a script.

Use it for the games with no panel, for the setup you do before the website is up, and for the times the website is the thing that is broken.

Through the database

Grants live in one table, account_gm, in the shared accounts database. A row is keyed by account and game key. Level 0 is stored as no row at all, so revoking is a delete rather than an update.

On MySQL:

USE gommo_accounts;

INSERT INTO account_gm (account_id, game_key, level, note)
SELECT account_id, 'rf2232', 4, 'first admin'
FROM accounts
WHERE email = '[email protected]'
ON DUPLICATE KEY UPDATE level = 4;

On the default file-based database, from the directory holding settings.cfg. That is the archive root on the four RF releases and server/ on the two Gate to Heavens releases, and it is the directory the database path is measured from, not the folder the executables sit in:

sqlite3 db/gommo_accounts.db

INSERT INTO account_gm (account_id, game_key, level, note)
SELECT account_id, 'rf2232', 4, 'first admin'
FROM accounts
WHERE email = '[email protected]'
ON CONFLICT (account_id, game_key) DO UPDATE SET level = 4;

To revoke, on either backend:

DELETE FROM account_gm WHERE account_id = 42 AND game_key = 'rf2232';

Two of the columns are there for you rather than for the server. note is free text, and granted_by records the account that made the grant. Only the control panel fills both in, with the account you were signed in as and the note you typed. The tool fills in neither. So fill them in yourself if you go this way, because in six months the note is the only record of why somebody is staff.

Golden Age Ships With Its Commands Open

RF Online: Golden Age hands every account a set of in-game commands with no grant at all, and the files arrive that way. A tester can set their own level, spawn the item they came to look at, heal up and teleport to it without anybody being made staff first.

The open set is deliberately narrow. Everything in it acts on the account that typed it or reads something back, and nothing in it reaches another player: appointing a race leader and moving credits stay staff-only whatever else is set. The RF command reference lists what is in it and what each command does.

Every Client Is Told It Is a Developer

Open commands come with one side effect, and nothing on screen explains it.

While the set is on, the server tells every client at login that its account is a developer. That part is not optional. A Golden Age client decides for itself whether a % line is worth sending, and one signed in as an ordinary player never sends it, so the server would sit waiting for commands the client had already refused to pass on.

The client changes what it shows once it believes that. The effect people notice first: it stops asking for the FireGuard password. A player who set one is not prompted for it at login, and a player who has not set one is never offered the chance. Staff name tags stop being masked, and the observer and debug overlays open.

None of that grants any power on the server. Whether a command runs is decided here, by the level on the account and the level the command asks for, and a client that believes it is a developer is refused exactly like any other. What it changes is what your players see, and what they are asked for.

The One Setting That Turns It Off

Let every player run the safe GM commands, under GM Commands on the settings page of the control panel. Switch it off, save, and that is the whole undo.

Nothing else has to change. There is no command list to edit, no file to open, no rebuild and no database row to write. The access levels setting sitting under it moves individual commands in either direction, and it plays no part in taking the set back: leave it empty and everything goes back to needing a grant.

The two halves of the change land at different times, which is worth knowing before you decide it did not work.

• The commands close immediately. Anyone already in the world stops being able to run them the moment you save.
• The developer grade waits for the next login. A client is told what its account is when the character enters the world, and that is not revised mid-session. Somebody already online keeps the developer look, the missing FireGuard prompt included, until they log out and back in. New logins are told plain player straight away.

Saving a server setting needs Super Administrator. An Administrator sees the page and cannot save it, the same as every other setting on it.

Which Servers This Applies To

Of the four RF versions, Golden Age and only Golden Age. Giga 4 Part 2, Red Army and Secret of Holystone have no player command set to switch: an account with no grant gets nothing on those three, and each client is told what its account actually is, which is why Secret of Holystone asks for the FireGuard password the normal way. The two Gate to Heavens servers are a separate case, and What Works Today, further down this page, covers them.

The default suits what the Golden Age files are, which is a prototype people download to try 2.2.3.2 on their own machine. Turn it off before you open a server to people you do not know. Left on, every visitor can hand themselves the level cap, a full bag and any position on the map, and none of them is ever asked for a FireGuard password.

The Account Named Admin

A fresh accounts database creates one account of its own, [email protected], with a display name of Admin and a password that is identical in every copy of the download. It holds no grant on any game. It is an ordinary player account and it has been one since the seed stopped handing out levels.

So it cannot be used to make yourself staff, and there is nothing to remove from it afterwards. What is left is an account anybody who has read the archive can log into as a player on your server. Two reasonable answers:

• Change its password and keep it as your own spare login:

  tools\gmadmin.exe passwd [email protected]

• Leave it. On a private server for a handful of friends it is one more ordinary player who cannot do anything a new registration could not do anyway.

What is not reasonable is leaving it untouched on a public server and then granting it a level. That turns a widely known password into staff access.

Which Game a Grant Applies To

game_key is the internal key for the game, not its public name. There are six.

Game	Key
Gate to Heavens	moderngth
Gate to Heavens Classic	classicgth
RF Online (Giga 4 Part 2)	rfgiga4
RF Online: Red Army	rf215
RF Online: Secret of Holystone	rf216
RF Online: Golden Age	rf2232

A grant on the wrong key is a grant on a game you may not even run, and nothing will tell you. The control panel always grants for the game it belongs to, which is one more reason to prefer it. The tool takes the key from you, so read it back with gmadmin list --game <key> before you trust it.

What Works Today

The control panel ships with the four RF versions. It is part of the same website binary covered on the website page, and it appears in the header once your account reaches Administrator. Not every server control is implemented on every version yet; where one is missing, the panel says so rather than reporting success.

The five levels mean the same thing everywhere, but only Golden Age tiers its in-game commands today. On the other three RF versions any grant of Moderator or above runs every command that version has, so pick the level with that in mind until the split reaches them.

The two Gate to Heavens servers use the same table and the same five levels, and the game server reads a player’s level from it at login, so a grant means the same thing there. Their website does not carry the control panel yet, so grants on those two are made with the tool or the SQL above. There is no date for a Gate to Heavens control panel.

One more honest note about those two. While the game is in alpha, most of its in-game commands are deliberately open to every account so testers can use them. A grant there is recorded and read correctly, and it starts to matter when the command set is tiered.

Security

The bootstrap password is a door that only exists while the house is empty. Keep it that way: promote yourself the moment you see one, and check afterwards that SUPER_PASSWORD in settings.cfg is blank. A value sitting in there on a server that already has staff means the grants were cleared, and you should find out by whom. The sign-in path for it is rate limited the same way registration is, and every failed attempt is logged.

The tool is the other way in, so treat it the way you treat the database it writes to. Anyone who can run a program in that folder can make themselves staff, which is an argument for the server living somewhere only you can log into, not an argument against the tool.

Do not leave a Super Administrator grant on a shared test account. Test logins get handed round and their passwords get reused, and the top level can edit server settings and hand out more staff. Give each person their own account and the lowest level that lets them do the job.

Every grant is recorded: who it is for, what level, who made it, and when. The staff list shows the level, the date and the note, so write the note as the record of why. It does not show who made the grant; that is the granted_by column, and the SQL above is how you read it. The log carries the rest. A change made in the control panel is logged with the account that made it, and a bootstrap sign-in is logged with the address it came from.