Store users IPs and ability to ban IPs

[xa-bi]

I have a chat where sometimes trolls come to mess with users. It would be nice to store user IPs and the ability to ban users from same IP.

It also be nice to have the option to make a chat public for non registered users ("readonly mode")
Yes I know there is an open issue #604 ,but just trying to bump it :)

Thanks in advance.

[lunitic]

Regarding this.. What about the idea to be able to "attach" a md5 or something similar of the IP beside the user posts.. Makes it possible to identify trolls posting from multiple accounts..

Lunitic IP: E03AE33EE8417CE2C9785274217636E0

Preferable some other scheme ...

[engelgabriel]

Maybe we could show the real IPs on of connected users on the admin panel?
And show last 8 characters of the hashed IP on the user profile tap.

[wtsarchive]

@engelgabriel For me it would be super useful to have as an admin user IPs shown in the user profile tab, because I had some people who tried to impersonate others on my chat.

[Gandalf-the-Grey]

Pleaes note that displaying IP publicly (i.e. not only to admins) is a privacy concern
even if they are simply hashed it's trivial to bruteforce, they should be at least salted

[WebSavvyDude]

As already mentioned, we should have the IP view ability for Administrators and Moderators and Owners.

This will not create any privacy concerns. Public users should not be able to view IP addresses.

[ghost]

Add reCAPTCHA - IP LOGGING for DMCA requests #10542

[reetp]

@WebSavvyGuy

This will not create any privacy concerns

It has legal connotations with GDPR. As soon as you link an IP to a user it is personally identifiable data and covered by GDPR.

Public users should not be able to view IP addresses

What about your when system gets hacked ?

@Gandalf-the-Grey is correct.

GDPR is a gamechanger regarding storing personally identifiable information, period. Love it or loath it, you can't change it.

[WebSavvyDude]

Almost every major website has some sort of logs stored with IPs.

Setting up some sort of disclaimer helps in those scenarios.

Why this chat doesn't have some sort of IP log by now is puzzling.

[reetp]

Almost every major website has some sort of logs stored with IPs.

Websites usually log via the webserver. Forums and other systems may then use the IP and link it to a user, but that now has consequences due to GDPR

Setting up some sort of disclaimer helps in those scenarios.

Not necessarily with GDPR. Disclaimers will do absolutely nothing to protect you from your responsibilities to look after the data if is personally identifiable - eg an IP linked to a user.

Why this chat doesn't have some sort of IP log by now is puzzling.

As per the first comment. And strangely enough not everyone needs it !

[WebSavvyDude]

@reetp

I am not convinced this GDPR you speak of applies to just IP being logged and associated with a "nickname/username"

Actually the Nginx logs for the rocket.chat service already show username and IP but its hard to access that and it needs better and organized ways to access it from the Admin panel.

Those IP logs do not really identify anybody at all. There would be several further steps required to identify someone after obtaining an IP address. Most of which involves law enforcement and then the assistance of the ISP. I can give you my IP address now, and I bet the average Joe could not identify me.

In a nutshell, almost every server running Rocket.chat already has IP logs and username. (100% confirmed if you use Nginx). It's just not configured into the admin panel.

To your second point....Yes, not everyone needs the IP but for standard security, it's pretty much the basics. But as I have stated in the past, this application is really good for internal (i.e office) and small scale use. Public and anonymous large scale use (as we tried to use it for in the past) it isn't good at all.

[reetp]

@WebSavvyGuy

I am not convinced this GDPR you speak of applies to just IP being logged and associated with a "nickname/username"

General Data Protection Regulation

If you don't know about it then I really suggest you go and read up. Plenty of stuff online about it. It is a game changer for data storage with personally identifiable information, particularly in the EU, but affecting anyone who has contact with EU citizens.

Who does the GDPR affect?
The GDPR not only applies to organisations located within the EU but it will also apply to organisations located outside of the EU if they offer goods or services to, or monitor the behaviour of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location.

What constitutes personal data?
Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.

[WebSavvyDude]

@reetp

Well almost the entire internet has to be rewritten then.

How much is enforceable, we would have to wait and see to find out. As you pointed out, mostly applied to EU. Also, some common sense has to be applied here. An IP address does not identify you directly. A lot of hurdles would have to be taken to get the actual person and even then it may not even be the same person. It could be a household, institution, service center. Adding "a computer IP address" as personal data is just careless by the GDPR people who wrote that.

Think of all the software/websites (forums, blogs, etc...basically any site that you need to register at and, heck any server with logs being recorded) out there that records IPs. This is more a function of your webserver via logs.

As i have already said, Rocket.chat does presently record usernames with IPs. (For me its located at /var/log/nginx/access.log) Are you saying they should remove that then?

Anyways, we are getting way off topic. My vote is to still add this feature to the admin panel so we can access the IP logs that already exist for this application and ban those who need banning.

But I am not holding my breath. (GDPR or no GDPR :) )

[reetp]

@WebSavvyGuy

Well almost the entire internet has to be rewritten then.

Welcome to 2018...

How much is enforceable, we would have to wait and see to find out

More than you may think. Especially if you are in the EU or have any dealings with the EU. Note other bugs on Rocket for GDPR compliance....

Adding "a computer IP address" as personal data is just careless by the GDPR people who wrote that.

Nope. It's intentional. It's the way it is, and I believe there is case law already in the EU regarding the status of IPs

Think of all the software/websites

Yup - they'll all need looking at unless you have zero visitors from the EU. But it's OK. You still have 24 days to get your compliance in order :-)

Note also the very first comment in this bug:

It would be nice to store user IPs and the ability to ban users from same IP.

So the intention is to retain that data to identify and ban that user. That becomes PII, and subject to GDPR.

So my original point was that this feature should be a toggle at most for those who want it, but not for those who do not.

[ghost]

Gee this thread is just a joke im sorry I even commented! Anything that is asked regarding IP loggin is stone walled, im out ill pay someone to rewrite a solution as nobody here is the slightest bit interested other then GDPR compliance well I have a huge budget I can deal with that when it arises right now Id like some access to these IPs you say are already logged! and a decent solution or at least some decent input in these threads it's like dealing with a bunch of five year olds asking about issues here.
#10542

[WebSavvyDude]

@WoWzee

I totally hear you. Let me know if you find a solution. We definitely need this feature but it's not going to happen with people striking fear into the developers with this GDPR nonsense.

Some idiot added "IP address" to the list of personal data into the FAQ's and now this is going to get them all paranoid. (which it already has some)

We run a website with tens of thousands of users and Rocket.chat was not able to handle the load (even on a powerful server) so keep that in mind for how much time and money you spend into modifying. We learned the hard way.

@reetp

Every single webserver stores IP address logs. I hope the EU shuts down the internet to the rest of the world. Let's see how long this law lasts.

[reetp]

I'm not saying you shouldn't have it.

I just just asked that you bear in mind that there are those of us who are subject to different laws, like it or not, and to respect that fact. The USA is not the only nation on the planet, nor does it have the only set of laws.

GDPR is here. It has been for 2 years. Just that it becomes mandatory on the 25th May. It can't simply be ignored. The EU is a market of 500 million people. It is not insignificant. And the fines for non compliance are large. GDPR is there to protect the privacy of the individual, which has been abused for far too long, and that is no bad thing IMHO.

Please stop using words like 'idiot' and 'nonsense'. They are superfluous in a grown up discussion. This about law, decided by judges.

[engelgabriel]

We are considering fro development a solution, that would have the following characteristics:

• Have a server side memory only map of the IP -> USER relationship
• Never store the IP -> USER relationship on the DB
• Enable the admins to ban a IP by reporting a USER
• Enable the method calls rate limiter to filter per IP
• Log abuses of the rate limiter per IP so can be used by Fail2Ban
• Only store a list of banned IPs on the DB
• List of banned IPs is only visible on the Admin Panel

Can you guys give us some feedback about this ideas?

[Lawri-van-Buel]

@engelgabriel
I got the following notes on the top of my mind.

• Keep in mind that ip adressen are not always fixed and can be used by multiple users. (Maybe only allow ban after multiple accounts from that up are blocked or list other accounts on a IP. ).

• Clusters need a way to share this data. Without the database this will be tricky.

• Givven the GDPR, we need a clear ground on which we are allowed this action. (Its not that the GDPR prohibits this, it just mandates you are upfront about it and clear in your privacy statement).

• As a side note user management on this level could also (and possibly would be better to) be bone through an external login provider over oAuth. (Gitlab/drupal/Wordpress all have dedicated code on rocketchat to do oAuth that I know and all are capably to manage users and ban abusers without adding complexity to rocketchat. The GDPR parts stay in affect but are now part of the website not the chat and all have more experience with abuse than rocketchat)
  [Full disclosure. I worked on the drupal integrations and maintain the drupal rocketchat module]

• Rate limiting is (if configurable & dynamic) a great idea.

[Gandalf-the-Grey]

To some of participants in this discussion: please do not spread FUD about GDPR, please consult your use cases with your own lawyers if you haven't already. GDPR doesn't change much for people that were doing things right. You should handle PII material with a proper care. If you are running an Internet service and can't do that properly you should really shut it down.

Obviously if that is such controversy let's just define option I_DONT_BELIEVE_IN_INTERNET_ABUSE=true that would cause to skip such logging.

Have a server side memory only map of the IP -> USER relationship
Never store the IP -> USER relationship on the DB

I see no reason for restricting ourselves. In the end we are keeping e-mail addresses in DB. How holding IP address is making it worse? As @Lawri-van-Buel noted, it introduce issues with clusters when sharing data.

Enable the admins to ban a IP by reporting a USER

Sounds good.

Enable the method calls rate limiter to filter per IP

Not sure if that's needed that much. Global settings for rate limiting to avoid general spam would be enough. Maybe with some exceptions (please note: reverse-proxy scenario, many-to-one relation in some scenarios)

Log abuses of the rate limiter per IP so can be used by Fail2Ban

Ideally I would love to have nginx/apache like log file with actions user/ip

Only store a list of banned IPs on the DB

As mentioned above, IMO no need for such restrictions, however, we might want to limit access to IP data to admins

List of banned IPs is only visible on the Admin Panel

Sounds good.

[vynmera]

I believe this is an important issue. If we want to make Rocket.Chat more usable for public usage, we'll need more powerful moderation tools. One of these would be IP bans.
Myself, I currently use a different login provider which allows me to ban IPs, but I feel it would be quite important to build this into Rocket.Chat.

Implementing this doesn't have to be insanely difficult - add a "ban" function to users, which will disable their account and find the user's last few IPs and restrict those from creating new accounts.
Even the admins don't need to see the IPs - this can be done in the background Discord-style.

As for law/GDPR/privacy issues: is an IP address not "data required for the operation of the service"? Every single webserver logs IPs too, so I feel it would be trivial to legalize the storing of IPs in such manner. If the admin doesn't want it, they should just be able to turn it off in the ban list.

Another good feature to add at this point is some sort of DNSBL / getipintel integration, to prevent people from using VPNs or Tor exit nodes (of course, it should be possible to disable, or add specific IPs/hosts that bypass this, for companies that use VPNs).
Rate limiting, CAPTCHA and/or fail2ban seem like useful features here too, to prevent bots trying to match leaked databases/common password against users.

Using Rocket.Chat publicly is difficult without proper moderation tools. Slack suffers from this too - let's beat them to it :)

[Lawri-van-Buel]

@vynmera

I believe this is an important issue. If we want to make Rocket.Chat more usable for public usage, we'll need more powerful moderation tools. One of these would be IP bans.

I would support more and better moderation tools.
IP bans are generally not wanted to moderate. (there to blunt a tool to be effective).
IP address do NOT represent individuals in all cases, which would mean you (potentially) ban a lot more users than you think. (this is especially true in not 1st world countries where IP's can be shared between neighbourhoods through NAT's).

To understand the complexities of banning we only need to take a look at IRC's history (like on freenode) and see that banning based purely on IP is not without high risks.

As for law/GDPR/privacy issues: is an IP address not "data required for the operation of the service"? Every single webserver logs IPs too, so I feel it would be trivial to legalize the storing of IPs in such manner. If the admin doesn't want it, they should just be able to turn it off in the ban list.

As for GDPR, any and all use needs to be declared and needs a base to use it. The test for whether it is data required for the operation of the service is simple ==> Is it possible to use the service without data 'x'. unfortunately, the answer is yes which would mean that just for banning purposes storing the IP is does not qualify as data required for the operation of the service. We would need a separate ground for it (I believe maintaining the integrity of the service to prevent abuse of a user could be a valid grounds. but I am no lawyer)

Another good feature to add at this point is some sort of DNSBL / getipintel integration, to prevent people from using VPNs or Tor exit nodes (of course, it should be possible to disable, or add specific IPs/hosts that bypass this, for companies that use VPNs).

An optional setting to provide a "ban" list based on 'DNSBL / getipintel / etc.' would be a really good feature. But probably belongs on the webserver side. and not in the rocket chat app.

Rate limiting, CAPTCHA and/or fail2ban seem like useful features here too, to prevent bots trying to match leaked databases/common password against users.

To utilize rate limiting with a fail2ban all we would need is a proper log entry in the webserver (for which there already exist fail2ban scripts)

I must stress that there are more moderation tools available in rocketchat than in Slack, especially through the API. While not as accessible as an UI element it offers more advanced use-cases.

We could use an admin tool alike to the Rocketchat native app on desktop that would expose these more advanced use-cases in a moderator friendly way.

@Gandalf-the-Grey

To some of participants in this discussion: please do not spread FUD about GDPR, please consult your use cases with your own lawyers if you haven't already. GDPR doesn't change much for people that were doing things right. You should handle PII material with a proper care. If you are running an Internet service and can't do that properly you should really shut it down.

I can not stress this enough myself. GDPR is only a gamechanger in regards to the potential "punishment" (e.a. fine's / legal remifacations) it is based on older laws that allready requirers the proper use and safeguards for utilizing PII. Ergo, most of it is stuff to consult a lawyer about as @Gandalf-the-Grey allready recommands.

[WebSavvyDude]

I do like the plans put forth by @engelgabriel

It’s a positive step in the right direction. Hope this becomes a reality.

I do not agree with the statement raised by another person that we should further limit this function because of a few rare cases of users sharing the same IP addresses. In that very unlikely event just delete it from your list.

[Lawri-van-Buel]

@WebSavvyGuy

In that very unlikely event just delete it from your list.

This is not a rare event on the global scale.
see IPv4_address_exhaustion -->Transition mechanisms

a real thing in Asia, Africa, South America and parts of Europe.
the real difficulty is that there is no reliable way to tell if the customer IP your blocking is the endpoint IP or a intermediate IP (like a NAT access point). This means that there is no way to detect the "wrong" setting. The customer that is banned without case basically has no more way to contact you (assuming you employ fail2ban or similar scheme).

It is also important to note that there are options in rocketchat to Block, Deactivate and Delete an existing account. And there is an option to require a valid email and an option to require a manual approval for users. (something that in an active community with lots of community admins / moderators should not be a problem).

IP bans are useful on a network layer, not on an application layer. since Rocketchat is an application it should NOT ban on IP. If tour setup requires IP level bans you should also employ network monitoring and network level firewalls that can actually blacklist an IP. (your basically entering the area of Denial of service attacks and targeted abuse that will require these level of tools)

TL;DR.
IP bans do not belong in an app, they beling on a(n) (application) firewall .

[vynmera]

@WebSavvyGuy An interesting idea I just thought of is that if you try to ban an IP that multiple people use, it'd give you a warning.
Also, perhaps we could optionally have it use the User-Agent as well.

[WebSavvyDude]

It is a rare event at the moment. You can always do an IP address ban list review periodically to filter out these unlikely events.

They can still contact you as this would be limited to Rocket.chat (i believe) They can still contact you via contact us page on your site.

Block, deactivate and delete are a joke. You just need to sign in again. If you use anonymous user, it's a matter of 1 second to get back. The ban request is for a good reason.

We run an extremely high traffic chat website. Have been doing it for 18 years. Been using ban, kick and mute functions for 18 years. We have never run into such an issue of a shared IP address or ever once saying "oh we don't need a ban button".

Yes, bans belong in an app.

[faziloub]

We really need this feature

[coders-kitchen]

The Merge Request will not close but only reference this issue.

@Lawri-van-Buel The feature in the Merge Request contains already the option to choose what to log. In detail you can deactivate logging of the following information

• Client IP
• Forward For IP
• UserAgent
• Username

each deactivated option will be displayed as a simple '-' sign.

[NameTheJew]

" We are currently adding a feature that logs at least the failed login attempts"

PLEASE DO NOT DO THIS DO NOT LOG IP. NO IP LOGS is a DISTINCT advantage and point of difference over DOXcord. Who cares if some admins (for dubious reasons) are BEGGING for IP logs. You DESTROY user confidence in the platform. You end up just creating another DOXcord. ZERO Knowledge is BEST for when subpoenas get received. And MANY political organizers have shifted to Rocket Chat, and VALUE the no IP feature. I have not seen ONE legitimate reason for these "admins" to need logs. Got a problem user, delete their account, require new account approval, or limit new accounts to a lounge, trolls and spammers solved. DO NOT CUCK AND BECOME ANOTHER DOXcord.

…

On Thu, 28 Feb 2019 at 00:41, Peter Daum ***@***.***> wrote: The Merge Request will not close but only reference this issue. @Lawri-van-Buel <https://github.com/Lawri-van-Buel> The feature in the Merge Request contains already the option to choose what to log. In detail you can deactivate logging of the following information - Client IP - Forward For IP - UserAgent - Username each deactivated option will be displayed as a simple '-' sign. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2885 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AnBXmusR0DkmLbRooG-B0trKSaw1NgW2ks5vRpkZgaJpZM4IHR7U> .

[NameTheJew]

@damianmcclure This entire thread is useless. Every single other online communication software like forums, message boards, etc have IP address logging to ban users. This should be Implemented.

translation:
"the internet is becoming an orweallian spy grid, so we should join in to"
GTFO
No logs is incredibly important in an age of doxing & honeypots.

[NameTheJew]

You shouldn't be expecting perfect IP privacy from Rocket.Chat

seems like an EXCELLENT Goal to have tho!
Need i remind you all the OTHER encryption feature https etc are to do everything possible to protect peoples privacy...
so why cuckout on IP logs?
webserver might show when someone "connected", but doesnt mean it can connect them to a specific post. (not if the encryption is being done right)

[faziloub]

@NameTheJew what if you get users terrorists? what if you get sick people that offer drugs and destroy people life from your server?? what if you get some criminals in your site how will you manage that ?? i think message audit panel & ip log and ability for admin to see ips and ban and read convos is for safety for client and users and even server owners

[WebSavvyDude]

Please get IP logs. Ignore the garbage arguments for not having it. The people who don’t want it have no users so probably can’t be bothered with it. Anybody with a half decent website with actual users will know the importance of IP logs. Worse case is let admins turn this feature on and off as they choose.

[faziloub]

@WebSavvyGuy i agree the people who arnt planning to do troubles or to harms they dont get worried about admins getting their ip or reading their convo me personaly i dont worry about because i know its for safety of users facebook, skype , twitter , whatsapp kik, all chat apps have this features and they read the convo and they get users ip

[WebSavvyDude]

I’ve never seen people complain about a potential added feature that is beneficial. Even if it was made “optional” (turn on and off logging from the admin panel say)... they would be against it, which makes you wonder what their actual motives are.

Most servers already come with access logs, just making it more readable is all we ask. It is legal to give IP addresses to law enforcement agencies. (GDRP or otherwise) That would be one reason to have it.

[faziloub]

@WebSavvyGuy i agree with you 100%

[WebSavvyDude]

Yes, it’s really those people who b*tch and complain about it affecting privacy or GDRP which slows this feature down from being made. They don’t fully understand what GDRP and privacy is. Those two things are more about how you protect the data, not actually possessing it. Almost every server has access logs already. Is the whole world going to shut off their access logs because GDRP was introduced?. Of course not, thats not how it works.

[NameTheJew]

muh terrorists

LOL, are you serious. Cos terrorists just LOVE to tell everyone their secret plans.
Any REAL terrorist cell would host their own private encrypted chats.
And would likely be using public wifi & a vpn.
If someone is advocating violence, you delete their account. Limit new account access to rooms. Require approval for new accounts.
IP bans DONT WORK. Restart router/phone, get a new dynamic IP.

99.999% of the time people are talking shit on the internet.
We are NOT the police. We have no business fighting "thought crimes".
Statistically, You have more chance of being hit by lightening, then being killed by a terrorist.
Terrorism is a ridiculous hyperbolic argument, that government lean on all the time to justify mass surveillance, & endless BS wars.

feature that is beneficial.

except IP logging is NOT beneficial to users, or administrators.
It will NOT stop people changing IP and re-joining server.
IP LOGGING HAS ONE PURPOSE > DOXING USERS
I help administer a political rocket chat server with over a couple of hundred users
I've never once wanted IP logs, nor needed them.

muh failed logins

WHO CARES... really. We tell all our users to setup 2FA.
Some retard can sit their all day long and try guess the password
They aren't getting past the 2FA

If rocket chat implements IP logging, ive already made the decision i will FORK rocketchat, and create a privacy focused chat server.

[WebSavvyDude]

@NameTheJew Please stop with your nonsense.

You are assuming EVERY single person out there is sophisticated enough to host their own private encrypted chats, or "smart" enough to use a VPN.

There are legitimate situations where users have been committing criminal offences and were caught doing so because we had their IP address and provided it to the police/law enforcement agency. Yes, terrorism brought up by the other post is a far fetched example but there are smaller crimes (although serious enough) that require an IP address for law enforcement. Because we had access to IP logs, we were able to assist law enforcement to arrest thousands of users over the years. I won't get into specifics but not only is IP logs beneficial for administrators to protect their own servers, it has proven to be beneficial to protect the general public when working with law enforcement.

Personally, i don't really care what happens because we stopped using Rocket.chat due to technical limitations with high volume amount of users but i received this update in my email and needed to respond.

Yes, please fork rocketchat and create your own privacy focused chat server where you guys can post all day about how great not having IP logs are...but stop trying to argue against something that is very much needed by many other rocket.chat users. (Most are just asking for it as an OPTION, not something permanent that every adminstrator has to use)

Would you be open to it being an optional feature? Would love to hear your answer to that LOL.

[NameTheJew]

Please stop with your nonsense.

no my concerns are entirely VALID, and represent the interests of all rocket chat USERS.
Go read about all the people who got DOXED using discord, because they received a subpoena, which then implicated EVERYONE in the chat.
Also, a "bad" admin could exploit logs for their own criminal intentions.

You want to "catch criminals" go join the FEDS (im pretending you haven't already).
Rocketchats priority should be its USERS
Not helping feds catch political activists, whistle blowers etc
in some countries this litterally protects users lives !!!
Saudi arabia will execute political dissidents for "wrong think"
its is NOT our responsibility to make the feds job easier.

we stopped using rocket chat.

then you have NO BUSINESS HERE discussing the future of this software.
stop glowing & leave.

[NameTheJew]

Would you be open to it being an optional feature?

Of course NOT.
How would users know if logging was on of off?
Right now, users can feel confident their words are free from DOX.
If the feature exists, then this platform can no longer be trusted.

[WebSavvyDude]

How would users know if logging was on of off?

Thats what a site disclaimer is for. You tell users what you have and how you protect it or when you remove it. Whether they believe it or not, it's their choice. I doubt everyone is going to go run and check that Rocket.chat indeed doesn't have IP logging.

Also, a "bad" admin could exploit logs for their own criminal intentions.

If you have the unfortunate circumstance of a "bad" admin, i am sure that said website wouldn't have too many visitors for long. Also, GDRP can go hard on that website, not to mention any law enforcement.

Rocketchats priority should be its USERS
Not helping feds catch political activists, whistle blowers etc

The tool is there to help them if it's needed, you paranoid &!#*.

Right now, users can feel confident their words are free from DOX.

You should rephrase your statement to say:

"Right now, users can feel confident their actions are free from any criminal responsibility."

Why don't you just tell all your users to use VPNs if they are so scared of being DOX'd because of their freedom of speech? Oh, it would be an inconvenience to them wouldn't it? Well that's the same answer I have in response to your suggestion of running a private chat server with users manually approved.

then you have NO BUSINESS HERE discussing the future of this software.
stop glowing & leave.

I can express my opinion if I want to. You gonna stop me? LOL. Aren't you all for freedom of speech. How contradictory you are now. I may use this product again in the future if there are improvements. They are on the right track. This discussion is a great step in that direction.

You are just so absolutely ridiculous. How can people lose confidence in a product if this feature was OPTIONAL. Maybe you are losing confidence in the ability to hide things on the internet and don't like the fact that you can and should be held responsible for your actions if through words on the internet. I am starting to think that is what your website is all about. Probably a platform to express hate crimes, etc. If users are so paranoid about DOX as you say they are, use a VPN. Let's face it your DOX reasoning is just a dumb excuse. Your username is also reflective of the type of person you are so STFU and create that privacy focused server you were talking about earlier. Run along now.

[JoshStrobl]

Christ, can the devs lock this discussion with the "heated" reason? It has turned into an absolute cesspool and derailed from the actual discussion / development topic at hand.

[coders-kitchen]

so no updates on this apart from a completed heated discussion?

[Lawri-van-Buel]

OK, To get this discussion back on track, and give a short overview of the issues (as I see them):
The Asked question is "@xa-bi Can you add an feature that enables storing an users connected IP address and have the ability to ban on IP basis?"

• Some people think (I am one of them) that mandatory storing / displaying of the IP address is a bad idea. Among other things GDPR compliance and rogue admins have been given as to why this is an bad idea.
• I have stated that IP banning is not a proportional or effective means of controlling bad users. IP's are often shared between users and banning on user level already exists (just make registering an account mandatory, this would also help by making people agree to a rule set and allow for notifications, e.a. no anonymous accounts)
• I have also stated that if you really need to manage users on an IP level employ a different mechanism for logging in than the native Rocket.Chat username / password box. For example Drupal could be used as a manager of user accounts (with a much finer degree of control than Rocket.Chat ever could){Note, I am the maintainer of the Rocket.Chat Drupal module, and one of the people that set up the Drupalchat.eu service so a little Biased towards those}.
• As reason given (in this thread) for wanting IP logging and Banning, Terrorism and other criminal activity have been given, while I do agree we should help law enforcement when they ask for our assistance (as ordered by the courts) I do not think I would need something as crude as "ip logging" to facilitate them.
• Another issue that has been raised is against Logging IP's is the (legitimate) fear of DOXing, as some have claimed happens on some Discord services.

in short I believe the following:

1. None has met the burden of proof as to why you need IP logging (and there is no other way but IP logging for your issue). A requirement we need to be GDPR compliant.
2. IP logging and banning are crude tools that just as MAC filters have there limited use but should be wielded with care.
3. We can not assume all users are in the same legal area, We should setup Rocket.Chat as compliant to every legal zone it is being used in as possible. Within reason.
4. We should use Evidence and arguments to discuss things, not feelings and rhetoric.

[coders-kitchen]

Thanks a lot.
Just a few comments from my side

• I agree that this must not be mandatory, but it should be an option to at least write them on unsuccessful attempts to a log. Which the linked PR provides.
• Yes indeed, IP banning might be sometimes an overkill and will/may affect other users. And I completely agree that IP bans are not the tool for punishing malicious users. There are better and safer ways to do so - as you already outlined. But at least in our case it's not about banning malicious users instead preventing brute force attempts to hack account(s). Which is from my understanding a legitimate reason in GDPR sense.

How should we continue now?

[WebSavvyDude]

As mentioned before, lets make this OPTIONAL.

That would solve those problems with people who are really scared of GDRP (there are many ways to remain GDRP compliant) or having rogue admins (are you serious? lol... re-examine your hiring practices then).

An optional feature should pretty much keep everyone happy (except one person here).

[Lawri-van-Buel]

* I agree that this must not be mandatory, but it should be an option to at least write them on unsuccessful attempts to a log. Which the linked PR provides.

Optional IP logging (e.a. a config options) would not be something I am against. (For example to comply easily with the PATRIOT-act for USA based Hosters)

* Yes indeed, IP banning might be sometimes an overkill and will/may affect other users. And I completely agree that IP bans are **not** the tool for punishing malicious users. There are better and safer ways to do so - as you already outlined. But at least in our case it's not about banning malicious users instead preventing brute force attempts to hack account(s). Which is from my understanding a legitimate reason in GDPR sense.

There already is rate limiting in place on Rocket.Chat, does that not suffice for your needs?
does it need to be expended? Also, Rate limiting can also be achieved on the Firewall level (e.a. a Firewall can only allow 'x' number of packages / second)

[Lawri-van-Buel]

That would solve those problems with people who are really scared of GDRP (there are many ways to remain GDRP compliant) or having rogue admins (are you serious? lol... re-examine your hiring practices then).

Not everybody uses Payed admins, (think about non-profit or other volunteer vocations).
If we Limit the impact a rogue admin has, we also limit the impact an attacker can have. (it hinders misuse whether intentional and unintentional).

An optional feature should pretty much keep everyone happy (except one person here).

I Agree

[WebSavvyDude]

Don’t get me wrong i understand your point about rogue admins (we use volunteer ones also).

But the “chances of one going rogue” is far less than the chances of a person abusing a service criminally.

We have worked with the FBI, Homeland Security and Interpol and countless law enforcement agencies many times over the years with our services. The ability to provide them IP addresses has led to hundreds of arrests. Without that valuable piece of information, you can only imagine what users can get away with.

I am happy to see you at least agree to an optional solution.

Worse case they can make it an “add on” if this really raises some really legitimate concerns (i still don’t see any strong arguments against it as an option)

[coders-kitchen]

As it seems there is an agreement around "If it's optional, than it's ok" - please correct me if my understanding is wrong, how do we proceed now with (#13387) ?

[damianmcclure]

So has anyone made an integration or something yet? It's been 3 years since this post has opened.

[reetp]

So has anyone made an integration or something yet? It's been 3 years since this post has opened.

Read the previous comment (and note that this is an extremely contentious issue). That PR needs updating to pass.

"This branch is out-of-date with the base branch"

You can of course take that code and roll your own if you want.