Proper access control is essential for server security. This guide covers both vanilla whitelist/op systems and advanced permission plugins.

Understanding Access Control

Learn the different levels of player access control:

Access Control Methods:

Whitelist: Only approved players can join
Operators (OPs): Players with admin commands
Permission plugins: Fine-grained control over features
Blacklist/Bans: Prevent specific players from joining
Groups/Ranks: Organize players by permission level

Default Permission Levels:

Level 0: Regular player (no commands)
Level 1: Bypass spawn protection
Level 2: Use cheat commands (/gamemode, /give)
Level 3: Use operator commands (/ban, /kick)
Level 4: Use all commands including /stop

Enable and Manage Whitelist

Set up whitelist to control who can join:

Whitelist Commands:

# Enable whitelist
/whitelist on

# Disable whitelist
/whitelist off

# Add player to whitelist
/whitelist add PlayerName

# Remove player from whitelist
/whitelist remove PlayerName

# List all whitelisted players
/whitelist list

# Reload whitelist from file
/whitelist reload

Configure in server.properties:

# Enable whitelist on server start
white-list=true

# Enforce whitelist (kick non-whitelisted players)
enforce-whitelist=true

Always add yourself to the whitelist before enabling it, or you'll be locked out of your own server!

Manage Operators (OPs)

Grant administrative privileges to trusted players:

OP Commands:

# Grant OP status
/op PlayerName

# Remove OP status
/deop PlayerName

# Set OP permission level (1-4)
/op PlayerName 3

# List all operators (console only)
/list ops

OP Permission Levels in Detail:

Level 1: Can bypass spawn protection only
Level 2: + /clear, /difficulty, /gamemode, /give, /tp
Level 3: + /ban, /kick, /op, /deop
Level 4: + /stop, /save-all, /save-on/off

Edit Configuration Files

Manually manage access through configuration files:

Important Files:

whitelist.json: List of whitelisted players
ops.json: List of operators with levels
banned-players.json: Banned player list
banned-ips.json: Banned IP addresses

Example whitelist.json:

[
  {
    "uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
    "name": "Notch"
  },
  {
    "uuid": "61699b2e-d327-4a01-9f1e-0ea8c3f06bc6",
    "name": "Dinnerbone"
  }
]

Example ops.json:

[
  {
    "uuid": "069a79f4-44e9-4726-a5be-fca90e38aaf5",
    "name": "Notch",
    "level": 4,
    "bypassesPlayerLimit": false
  }
]

Install Permission Plugin

Set up advanced permissions with LuckPerms (recommended):

Download LuckPerms: Get from luckperms.net
Install plugin: Place .jar in plugins folder
Restart server: Let plugin generate config files
Configure storage: Choose between file or database storage
Set up web editor: Enable for easy permission management

Basic LuckPerms setup:

# Open web editor
/lp editor

# Create a group
/lp creategroup vip

# Add permission to group
/lp group vip permission set essentials.fly true

# Add player to group
/lp user PlayerName parent add vip

Create Permission Groups

Organize players into groups with specific permissions:

Common Group Structure:

default: Basic permissions for all players
member: Regular trusted players
vip: Donors or special members
helper: Basic moderation abilities
moderator: Full moderation powers
admin: Server administrators
owner: Full server control

Group Permission Examples:

# Default group permissions
essentials.spawn
essentials.rules
essentials.help
essentials.motd

# VIP permissions
essentials.fly
essentials.nick
essentials.workbench
essentials.hat

# Moderator permissions
essentials.kick
essentials.mute
essentials.jail
essentials.invsee

Configure Advanced Permissions

Set up complex permission scenarios:

Permission Inheritance:

# Make VIP inherit from member
/lp group vip parent add member

# Make moderator inherit from helper
/lp group moderator parent add helper

# View inheritance tree
/lp group moderator parent info

Negative Permissions:

# Deny specific permission
/lp group member permission set essentials.god false

# Remove inherited permission
/lp group vip permission unset essentials.tnt

Temporary Permissions:

# Grant temporary permission
/lp user Player permission settemp essentials.fly true 1h

# Temporary group membership
/lp user Player parent addtemp vip 30d

Integrate with Other Plugins

Connect permissions with other server features:

Common Permission Nodes:

WorldEdit: worldedit.* for full access
EssentialsX: essentials.* for all commands
WorldGuard: worldguard.region.* for regions
GriefPrevention: griefprevention.* for claims

Permission Checking:

# Check player permissions
/lp user PlayerName permission check essentials.fly

# List all permissions for player
/lp user PlayerName permission info

# Check effective permissions
/lp user PlayerName meta info

Best Practices and Security

Maintain secure and organized access control:

Principle of least privilege: Give minimum required permissions
Regular audits: Review who has what permissions
Document permissions: Keep a list of what each group can do
Test permissions: Verify groups work as expected
Backup configurations: Save permission files regularly
Use UUID-based: More secure than name-based permissions
Monitor abuse: Track permission usage with logs

Well-configured permissions create a fair and enjoyable server environment. Start simple and add complexity as needed.

Whitelist and Permissions Management