2 questions (about ip addreses)

This forum is now closed as part of retiring phpBB2
Forum rules
READ: phpBB.com Board-Wide Rules and Regulations

This forum is now closed due to phpBB2.0 being retired.
Post Reply
quoron333
Registered User
Posts: 4
Joined: Tue May 13, 2008 11:01 pm

2 questions (about ip addreses)

Post by quoron333 » Tue May 13, 2008 11:06 pm

Under what circumstances can we reveal a user's IP address to someone else?

Also, is it possible for us to view failed login attempts and the usernames/passwords combinations attempted?

User avatar
ChrisRLG
Former Team Member
Posts: 3420
Joined: Wed Nov 24, 2004 3:18 pm
Location: Essex, UK
Contact:

Re: 2 questions (about ip addreses)

Post by ChrisRLG » Tue May 13, 2008 11:24 pm

Your point 1 - is a legal point - you would need to consult a lawer for the country that has juristiction for an answer.
I would suggest from a non-lawer view that you should not give that info to anyone outside your admin staff unless required by a court order.

Point 2.
You would need to consult your server access logs as they would be the only record of what was done.
Again outside what we at phpBB.com can advise or help with.
phpBB: The All Important Rules - Bertie Bear 3.0 - No support via PM system - use the forums please.
phpBB v2: Retirement (1/1/2009) : phpBB v3: Read Me Topic - Custom BBCodes - Support Template
Matthew 7:7"Ask and it will be given to you; seek and you will find; knock and a door will be opened to you."
My Links: MS MVP (Consumer Security) - Malware Removal:University - Own Forum: Custom BBCode testing

quoron333
Registered User
Posts: 4
Joined: Tue May 13, 2008 11:01 pm

Re: 2 questions (about ip addreses)

Post by quoron333 » Tue May 13, 2008 11:42 pm

Thanks.

1. That was my impression.

2. So, the server access logs would definitely have that information? I had the impression that it only recorded IP addresses and whether an attempt was successful or not?

User avatar
drathbun
Former Team Member
Posts: 12204
Joined: Thu Jun 06, 2002 3:51 pm
Location: TOPICS_TABLE
Contact:

Re: 2 questions (about ip addreses)

Post by drathbun » Wed May 14, 2008 2:29 am

The logs will not contain username and password information. A standard phpBB2 installation does not track that either, although current versions do have a "how-many-tries-can-I-make" setting that will lock someone out after a number of failures.
I blog about phpBB: phpBBDoctor blog
Still using phpbb2? So am I! Click below for details
Image

quoron333
Registered User
Posts: 4
Joined: Tue May 13, 2008 11:01 pm

Re: 2 questions (about ip addreses)

Post by quoron333 » Wed May 14, 2008 2:56 am

So is there no way to get info on which username/password combinations were attempted/failed?

I need to see if someone's attempting to crack one of my user's password. So, I want to see if there have been multiple login attempts made with that username and random password combinations. So, (even if hypothetically... if it's not practical), how could I get this info? Are there any MODs I can use in the future?

User avatar
drathbun
Former Team Member
Posts: 12204
Joined: Thu Jun 06, 2002 3:51 pm
Location: TOPICS_TABLE
Contact:

Re: 2 questions (about ip addreses)

Post by drathbun » Wed May 14, 2008 1:36 pm

You would have to write some code to capture the information. I have no idea if anyone has written a MOD for this or not. To be honest, it would not be very hard to write, but I would strongly suggest that you need to fully disclose to members that you're capturing login attempts. Some people can be quite protective of their passwords... if you log failed attempts (and the passwords attempted) you should be sure to care for them properly. Just my two cents. :)

Moving to MOD Requests. If someone is aware of code that has already been written (or is willing to write it for you) that's the best place.
I blog about phpBB: phpBBDoctor blog
Still using phpbb2? So am I! Click below for details
Image

quoron333
Registered User
Posts: 4
Joined: Tue May 13, 2008 11:01 pm

Re: 2 questions (about ip addreses)

Post by quoron333 » Wed May 14, 2008 2:15 pm

Thanks for your response. If anyone would like to write a MOD for it, it would be greatly appreciated.

I'm surprised that the server access logs don't have this info.

User avatar
ChrisRLG
Former Team Member
Posts: 3420
Joined: Wed Nov 24, 2004 3:18 pm
Location: Essex, UK
Contact:

Re: 2 questions (about ip addreses)

Post by ChrisRLG » Wed May 14, 2008 2:43 pm

quoron333 wrote:I'm surprised that the server access logs don't have this info.
They would be a security risk if they did.
phpBB: The All Important Rules - Bertie Bear 3.0 - No support via PM system - use the forums please.
phpBB v2: Retirement (1/1/2009) : phpBB v3: Read Me Topic - Custom BBCodes - Support Template
Matthew 7:7"Ask and it will be given to you; seek and you will find; knock and a door will be opened to you."
My Links: MS MVP (Consumer Security) - Malware Removal:University - Own Forum: Custom BBCode testing

Post Reply

Return to “[2.0.x] MOD Requests”