Is there a way to see the IP from which a specific post was made?
I don’t think Discourse tracks IP at that level. As far as I know it only tracks it by Registration and Last Login/Visit on the User, not on a post/topic.
「いいね！」 1
Huh. I’m surprised. Per post/topic IP logging would help to see if an account was compromised.
「いいね！」 4
Again this is needed for security or even legal reasons, as if some entity requests the IP from where the msg was posted from
「いいね！」 1
It would be a good idea if we recorded the IP with each post. Do we have the data structures in place to do this, @zogstrip? Maybe as a post actions or post history table column?
「いいね！」 5
Yeah, each post revision should store the ip that created it.
「いいね！」 9
Perhaps also consider storing if an API key was used in combination with the IP to create the post, this might aid in any clean up as a result of an API key abuse - either a users or the master API key.
「いいね！」 3
I revive this old topic. Is it still so that it’s not possible to determine from which IP address a post was sent from?
Seeing that nobody answered, I suppose it is not possible.
I am asking because this week a regular user contacted us admins at our forum. (This is something any admin could run into so sharing the experience is smart.) He told that he hadn’t written a post which had been posted from his account. Obviously I killed all his active sessions and forced him to reconfirm his email. The email hadn’t been changed btw. That could be deduced by looking where the system had previously sent email digests (a nice tip!). The user told that he also changed his password so he should be safe from future attacks.
It is weird that the post was nothing offensive or “funny” or anything that you might be tempted to post on someone else’s behalf. It was a proper post on a proper topic! It would make no sense that someone would work to hack his account just to publish that post.
So probably someone had access to a device where the user had a live session going or the user had saved his password to a browser. But the user denies that: he claims that he uses the forum only with his phone and his PC. He says that there is no chance someone had access to those.
We have no clue of how we could gain more clues of what happened. Seeing the IP address from which the post was sent from would be a nice hint.
「いいね！」 1
Assuming it was recent you can just grep for his username in the nginx logs.
zgrep username /var/discourse/shared/standalone/log/var-log/nginx/access.log.*.gz
「いいね！」 3
It was two days ago. Thank you for the tip! The fellow admin @ljpp should try this and ask for help if he needs.
こんにちは、この情報を取得する方法はありますか？トピックの投稿者と同じ質問ですが、この情報はセキュリティや法的な理由から非常に役立ちます。
すべき … する ではありません。GDPR の懸念などがあり、近々これを追加するとは期待していません。
「いいね！」 3
確かに、皆さんがこの機能を追加したくないことはよくわかりますが、これが GDPR と何らかの関係があるとは考えにくいです。
GDPR によれば、IP アドレスは個人データに該当しますが、セキュリティ関連のイベントの追跡や不正アクセスの試行の検知など、正当な理由があれば（同意なしでも）収集・処理することが認められています。
すべての状況ですべての IP アドレスを記録すべきだと言っているわけではありませんが、最後の記録された IP の表示に加え、例えば「過去 30 日間」の IP とそれに関連するアクションを記録するといった制限を設けるオプションを検討されてはいかがでしょうか。
「いいね！」 4
これはまだ実装されていないと思うので、トピックを Feature に移動します。
「いいね！」 2