blizzthewolf/SeaCogs
1
0
Fork 1
forked from cswimr/SeaCogs
Code Pull requests Activity

docs(pterodactyl): don't make the user give the subuser permissions it doesn't need

Browse source
This commit is contained in:
Seaswimmer 2024-03-02 13:21:12 -05:00
parent 7e4d4b348a
commit 030291113b
Signed by untrusted user: cswimr
GPG key ID: B8953EC01E5C4063
3 changed files with 4 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

BIN
.docs/img/pterodactyl/setup/1.png
View file

Binary file not shown.
Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 167 KiB

After

Width:  |  Height:  |  Size: 167 KiB

BIN
.docs/img/pterodactyl/setup/2.png
View file

Binary file not shown.
Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 156 KiB

After

Width:  |  Height:  |  Size: 52 KiB

14
.docs/pterodactyl/getting-started.md
View file

@ -43,21 +43,15 @@ Now, install the Pterodactyl cog:
This is **optional**, but highly recommended, for security reasons. This is **optional**, but highly recommended, for security reasons.
Navigate to your `Users` page, and click the `New User` button. Navigate to your `Users` page, and click the `New User` button.
Type in an email address, and press `Select all permissions`. Type in an email address, and scroll down to the `Control` header.
*The bot doesn't need all of the permissions you just gave it to function, we'll deal with that in a moment.* Click the checkmark on that header to select all of the permissions contained under the header.
Now, scroll back up to the top of the prompt and press `Invite User`.
![image](../img/pterodactyl/setup/1.png) ![image](../img/pterodactyl/setup/1.png)
![image](../img/pterodactyl/setup/2.png)
Now, you'll need to check the email you just entered into the subusers page, and create an account. I won't cover this, as it'll change depending on what host you're using. Now, you'll need to check the email you just entered into the subusers page, and create an account. I won't cover this, as it'll change depending on what host you're using.
Moving on, the bot doesn't need all of the permissions you just gave it. This poses a security risk, should the bot be compromised. We can fix this by importing only the permissions the bot requires. Import the following string into your subuser's permissions.
```json
["websocket.connect","control.read-console","control.console","control.start","control.stop","control.restart","startup.read","startup.update","settings.rename","settings.reinstall"]
```
![image](../img/pterodactyl/setup/2.png)
## Getting an API Key ## Getting an API Key
**Log out of your primary account, and switch to the sub-user you just created.** **Log out of your primary account, and switch to the sub-user you just created.**