Need an opinion from a leading member of the community

[conradp24]

Hi All,
The logs for the forum that I run in support of this group demonstrates that particular individuals had access to part of the forum that they should not have had. Rather than inform us they spent time snooping through information that they should not have had access to.

This may become a larger issue, the people involved did not suspect how detailed the logs were and spent a considerable time on there. They have been caught out in a lie, but continue to deny any wrongdoing.

I am reaching out on here, in the hope that a senior member of the community could provide their own perspective on the logs if I tell them what to look for?
Currently, the transgressors are claiming that phpBB's logs are faulty. The issue is fairly serious, so to prove this down the line I need somebody with "credentials" on phpBB that could provide an opinion on:

• When the person first accessed the private part of the forum.
• How long did they look at the forum.
• There is the suggestion that he invited a second person to have a look by sharing a link to a particular part of the forum. Mainly, because the second person went directly to that part of the forum when they logged on, no loading of the home page. Is it possible to confirm this possibility?

Effectively, that is all that is involved. I've already done the work but need it seconded for the Information Commisioners Office in the UK.

Any takers?

[Paul]

First of all, let me start that I am no real expert on this .

phpBB doesn't keep any records on what forum or topic is viewed by which user, only when a post is made you can view specifics about which IP has been used, and when moderator actions are done you can view that in the moderator log.
Using who is online or the sessions table doesn't prove anything. If a user has no permission to view a page, who is online/sessions will still be showing that the user is on that page, but he might have received an error that he/she has no permission. phpBB doesn't log this by default.
Using the webserver access logs also doesn't give a 100% sure answer the user has been able to view a specific forum/topic, for the same reason.

[KevC]

Agreed.
It would be best if you could post a sample of the log (maybe with sensitive info blanked out) so we can explain if the information is actually being misinterpreted.

[warmweer]

Hi All,
The logs for the forum that I run in support of this group demonstrates that particular individuals had access to part of the forum that they should not have had. Rather than inform us they spent time snooping through information that they should not have had access to.

This may become a larger issue, the people involved did not suspect how detailed the logs were and spent a considerable time on there. They have been caught out in a lie, but continue to deny any wrongdoing.

If you haven't changed the user's permissions (implying that they are as they were when "having access" to unauthorised parts of the board, use phpBB's features to look at the board using one of those user's permission settings: not by explicitely changing your permissions but by simulating them:
In the ACP /users and groups/ below the username of the user there's a "Test out user’s permissions"... (not 100% sure where, nor about the wording - no access to an ACP at this time) but there is an option to view the board using the user's permission setting.)

[thecoalman]

• When the person first accessed the private part of the forum.
• How long did they look at the forum.
• There is the suggestion that he invited a second person to have a look by sharing a link to a particular part of the forum. Mainly, because the second person went directly to that part of the forum when they logged on, no loading of the home page. Is it possible to confirm this possibility?

Effectively, that is all that is involved. I've already done the work but need it seconded for the Information Commisioners Office in the UK.

Any takers?

If you know the IP's of the users or you can look them up under "IP addresses this user has posted from" on the information link on any post they made. Download the access logs from the server.

Using notepad++ open the logs, using the find panel use the "Mark" tab and put a check next to "bookmark line". Once you have searched for and marked all the lines on upper right tool panel click search >> bookmark >> remove unmarked lines .

You can pare this down further by removing unnecessary lines by searching for and marking styles/prosilver etc. and removing the bookmarked line.

As long as you know the IP this will give all activity for it....


---------------------edit---------------

Just add this will tell you requests made, someone cam make request for topic/forum but that doesn't necessarily mean they got access to it. The server response is in the line, 200 indicates it succeeded.... however you may want to double check with test user to make sure it's in sync with phpBB.