ULX logs no longer show IP address of those joining

[Storm]

Hi I may have a conflicting addon but it used to be my logs showed this: XXXXXXX spawned in server (72.241.XXX.176:27005)<STEAM_0:0:2xxxx756. Now the IP no longer shows. Can you tell me how I can force this back on? Is there something I can put in the server.cfg?

[JamminR]

Storm, we were notified a few months ago that, due to a Valve security issue that allows files to be read by a client, it was a 'feature' that was easily being abused.
Some exploiters were using IP addresses to DDoS and other nasty functions of players on servers.
We removed the functionality.
I'd hoped we were going to add a boolean to allow the end user to decide how secure they wanted their logs, but, as a stopgap, I guess we decided total removal was best for now.

[MrPresident]

Was the removal to stop people from seeing a player's IP address post connection? Because you can still freely get IP address of connected players with 'status' in console.

[Storm]

Yes it was to get the IP of trolls after they ran from the server. Many players simply switch Steam ID's after they are banned and return to the server to do as much damage as possible.

[JamminR]

MrP. Yes.
The exploiter could hop on the server while no one was on, grab all the ulx log files, then leave and peruse the logs over past <x> hours and every IP would be there.

Storm, I can change my IP quicker than I can my SteamID. 1 minute for a router reboot, and it is often in a totally different range (ie, if banning me, you couldn't use a x.x.x.* ban)
(Then again, I don't have more than one Steam account)
If I did, changing my IP would only be about one minute longer, depending on Steam sign-in time.

I understand feature vs safety. Speaking for Megiddo/SticklyMan's latest code session, I believe they just decided it was safer to not have it, considering how easily volatile an IP address is.

[Decicus]

Correct me if I'm wrong, but the default "log on" in server.cfg should log Steam ID and IP address (<Server dir>/logs/), unless that's a feature that ULX added.

[JamminR]

See your point. I'm not aware of it it does.
As I believe you're trying to question why we even did it 'since <x> does it anyway>' I'm going to turn it around.
1) That now places even more of a security enhancement back on Valve (a) FIX the exploit where users can grab files using whatever command it is, b) Is IP needed? ))
2) Places less need of ULX having IP in our logs.

We can only control ULX and ULib. We did it to try to make exploiting user's servers that much more difficult.

[Storm]

Yes it is available in regular logs but those arent available to me until server restarts. I have to either kick players off and restart it or wait for hours.

[Decicus]

See your point. I'm not aware of it it does.
As I believe you're trying to question why we even did it 'since <x> does it anyway>' I'm going to turn it around.
1) That now places even more of a security enhancement back on Valve (a) FIX the exploit where users can grab files using whatever command it is, b) Is IP needed? ))
2) Places less need of ULX having IP in our logs.

We can only control ULX and ULib. We did it to try to make exploiting user's servers that much more difficult.

I wasn't actually trying to make that point, I was just trying to give Storm an alternative.

Yes it is available in regular logs but those arent available to me until server restarts. I have to either kick players off and restart it or wait for hours.

Look up the ConVar "sv_logflush". It will write to logs in realtime, but it may affect the server performance so be careful with that.
May I ask what gamemode you're running?

[JamminR]

To be honest, any one with minimal lua knowledge could look at the diff of our code on github and see the line that changed, and simply make thier own addon that would add it back and create thier own 'join_log.txt' file. Those without lua knowledge would make it a great time to learn, g-lua, (it does use a Gmod hook not in lua by default)
You then run the risk of the above already mentioned issues though.

[Storm]

My servers are TTT, Prop Hunt, Murder, and Stop It Slender.

[Megiddo]

We're actually planning on moving everything in ULX to be only Steam-ID based, but this made a good first step. What JamminR says is right, it's much better to ban by Steam ID than IP address, and we are definitely still logging the Steam ID.

As far as the Source logs, I'm not sure on the details of the file grab exploit, but I'd guess that it can't reach what's in the logs folder or Valve would have taken stronger action against the exploit.

[SaintSin]

I realize this thread is a bit old, but Megiddo mentions moving everything to SteamID. Although currently players are able to use FamilySharing settings to bypass steamID bans. McSimp posted a bit of code on the Facepunch forums. Would it not be better to have it ban SteamID by the lenders account then check if the lender is banned? Instead of server owners having to ban the same person up to 10 times.

Code: Lua

1. local APIKey = "<insert api key here>" -- See [url]http://steamcommunity.com/dev/apikey[/url]
2.  
3. local function HandleSharedPlayer(ply, lenderSteamID)
4.     print(string.format("FamilySharing: %s | %s has been lent Garry's Mod by %s",
5.             ply:Nick(),
6.             ply:SteamID(),
7.             lenderSteamID
8.     ))
9.  
10.     if not (ULib and ULib.bans) then return end
11.  
12.     if ULib.bans[lenderSteamID] then
13.         ply:Kick("The account that lent you Garry's Mod is banned on this server")
14.     end
15. end
16.  
17. local function CheckFamilySharing(ply)
18.     http.Fetch(
19.         string.format("http://api.steampowered.com/IPlayerService/IsPlayingSharedGame/v0001/?key=%s&format=json&steamid=%s&appid_playing=4000",
20.             APIKey,
21.             ply:SteamID64()
22.         ),
23.        
24.         function(body)
25.             body = util.JSONToTable(body)
26.  
27.             if not body or not body.response or not body.response.lender_steamid then
28.                 error(string.format("FamilySharing: Invalid Steam API response for %s | %s\n", ply:Nick(), ply:SteamID()))
29.             end
30.  
31.             local lender = body.response.lender_steamid
32.             if lender ~= "0" then
33.                 HandleSharedPlayer(ply, util.SteamIDFrom64(lender))
34.             end
35.         end,
36.        
37.         function(code)
38.             error(string.format("FamilySharing: Failed API call for %s | %s (Error: %s)\n", ply:Nick(), ply:SteamID(), code))
39.         end
40.     )
41. end
42.  
43. hook.Add("PlayerAuthed", "CheckFamilySharing", CheckFamilySharing)

by: McSimp


https://developer.valvesoftware.com/wiki/Steam_Web_API#IsPlayingSharedGame_.28v0001.29

[Megiddo]

It's just something we haven't considered yet, SaintSin. Thanks for bringing it to our attention. We will probably integrate something similar to what you posted.

[LuaTenshi]

It's just something we haven't considered yet, SaintSin. Thanks for bringing it to our attention. We will probably integrate something similar to what you posted.

As an added layer you can also check if the user is VAC banned or not, and have the option to have the server notify admins when a VAC banned account joins/ and or have a hook that gets called so that devs can do things like auto kick/ban VAC banned accounts and or move people who have been VAC banned to a special server group if they don't already have a rank on the server. All in all it would help in keeping cheaters out of your server. (I know VAC does not really work in Gmod, but if a person likes to hack in other games, he probably will also hack on Gmod.)