Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-69247

Check that everyone doesn't have the same lastip address

    XMLWordPrintable

    Details

    • Affected Branches:
      MOODLE_310_STABLE, MOODLE_39_STABLE

      Description

      Found as part of MDL-69074

      Default installed now have a more secure setting, in theory, but a narrow value for getremoteaddrconf is just as insecure as a wide value because everyone will end up with the same ip.

      So proposing to improve the getremoteaddrconf by looking at the last N users who logged and seeing if they share the same ip address, and if there is a very high degree of overlap that is a heuristic that the setting is wrong.

      There are some use cases like labs and exams where lots of people will legitimately have the same ip so this can never be perfect.

        SELECT count(*), lastip
          FROM (
                   SELECT lastip
                     FROM {user}
                 ORDER BY lastlogin DESC limit 1000
               ) AS ips
      GROUP BY lastip
      ORDER BY count(*) DESC, lastip
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              brendanheywood Brendan Heywood
              Participants:
              Component watchers:
              Adrian Greeve, Jake Dallimore, Mathew May, Mihail Geshoski, Peter Dias, Sujith Haridasan
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated: