How can I see the IP from which a post originated?

Contribute Feature
1

Is there a way to see the IP from which a specific post was made?

2

I don’t think Discourse tracks IP at that level. As far as I know it only tracks it by Registration and Last Login/Visit on the User, not on a post/topic.

1개의 좋아요
3

Huh. I’m surprised. Per post/topic IP logging would help to see if an account was compromised.

4개의 좋아요
4

Again this is needed for security or even legal reasons, as if some entity requests the IP from where the msg was posted from

1개의 좋아요
5

It would be a good idea if we recorded the IP with each post. Do we have the data structures in place to do this, @zogstrip? Maybe as a post actions or post history table column?

5개의 좋아요
6

Yeah, each post revision should store the ip that created it.

9개의 좋아요
7

Perhaps also consider storing if an API key was used in combination with the IP to create the post, this might aid in any clean up as a result of an API key abuse - either a users or the master API key.

3개의 좋아요
8

I revive this old topic. Is it still so that it’s not possible to determine from which IP address a post was sent from?

9

Seeing that nobody answered, I suppose it is not possible.

I am asking because this week a regular user contacted us admins at our forum. (This is something any admin could run into so sharing the experience is smart.) He told that he hadn’t written a post which had been posted from his account. Obviously I killed all his active sessions and forced him to reconfirm his email. The email hadn’t been changed btw. That could be deduced by looking where the system had previously sent email digests (a nice tip!). The user told that he also changed his password so he should be safe from future attacks.

It is weird that the post was nothing offensive or “funny” or anything that you might be tempted to post on someone else’s behalf. It was a proper post on a proper topic! It would make no sense that someone would work to hack his account just to publish that post.

So probably someone had access to a device where the user had a live session going or the user had saved his password to a browser. But the user denies that: he claims that he uses the forum only with his phone and his PC. He says that there is no chance someone had access to those.

We have no clue of how we could gain more clues of what happened. Seeing the IP address from which the post was sent from would be a nice hint.

1개의 좋아요
10

Assuming it was recent you can just grep for his username in the nginx logs.

zgrep username /var/discourse/shared/standalone/log/var-log/nginx/access.log.*.gz

3개의 좋아요
11

It was two days ago. Thank you for the tip! The fellow admin @ljpp should try this and ask for help if he needs.

12

안녕하세요, 이 정보를 어떻게 가져올 수 있나요? 주제 작성자와 같은 질문을 가지고 있으며, 이 정보는 보안 및 법적 이유로 매우 유용할 것입니다.

13

should … 이 아니라 does가 아닙니다. GDPR 관련 우려 사항 등이 있어서, 당분간 이 기능을 추가할 계획은 없습니다.

3개의 좋아요
14

여러분이 이 기능을 추가하고 싶지 않은 이유는 충분히 이해하지만, 이것이 GDPR과 관련이 있을 것 같지는 않습니다.

GDPR에 따르면, IP 주소가 개인/사적인 정보이더라도 보안 관련 이벤트 추적이나 무단 접근 시도와 같은 정당한 사유가 있을 경우 동의 없이도 수집 및 처리할 수 있습니다.

모든 상황에서 모든 IP를 기록해야 한다는 뜻은 아니지만, 단순히 마지막에 기록된 IP만 보여주는 것 외에, 예를 들어 최근 30일치(그리고 해당 IP와 연관된 동작)를 제한하는 옵션을 추가하는 것을 고려해 보시는 것이 어떨까요?

4개의 좋아요
16

이런 기능이 아직 구현되지 않은 것 같아서 Contribute > Feature 채널로 이 주제를 옮길게요. :+1:

2개의 좋아요