ULX logs no longer show IP address of those joining

[Storm]

Hi I may have a conflicting addon but it used to be my logs showed this: XXXXXXX spawned in server (72.241.XXX.176:27005)<STEAM_0:0:2xxxx756. Now the IP no longer shows. Can you tell me how I can force this back on? Is there something I can put in the server.cfg?

[JamminR]

Storm, we were notified a few months ago that, due to a Valve security issue that allows files to be read by a client, it was a 'feature' that was easily being abused.
Some exploiters were using IP addresses to DDoS and other nasty functions of players on servers.
We removed the functionality.
I'd hoped we were going to add a boolean to allow the end user to decide how secure they wanted their logs, but, as a stopgap, I guess we decided total removal was best for now.

[MrPresident]

Was the removal to stop people from seeing a player's IP address post connection? Because you can still freely get IP address of connected players with 'status' in console.

[Storm]

Yes it was to get the IP of trolls after they ran from the server. Many players simply switch Steam ID's after they are banned and return to the server to do as much damage as possible.

[JamminR]

MrP. Yes.
The exploiter could hop on the server while no one was on, grab all the ulx log files, then leave and peruse the logs over past <x> hours and every IP would be there.

Storm, I can change my IP quicker than I can my SteamID. 1 minute for a router reboot, and it is often in a totally different range (ie, if banning me, you couldn't use a x.x.x.* ban)
(Then again, I don't have more than one Steam account)
If I did, changing my IP would only be about one minute longer, depending on Steam sign-in time.

I understand feature vs safety. Speaking for Megiddo/SticklyMan's latest code session, I believe they just decided it was safer to not have it, considering how easily volatile an IP address is.

[Decicus]

Correct me if I'm wrong, but the default "log on" in server.cfg should log Steam ID and IP address (<Server dir>/logs/), unless that's a feature that ULX added.

[JamminR]

See your point. I'm not aware of it it does.
As I believe you're trying to question why we even did it 'since <x> does it anyway>' I'm going to turn it around.
1) That now places even more of a security enhancement back on Valve (a) FIX the exploit where users can grab files using whatever command it is, b) Is IP needed? ))
2) Places less need of ULX having IP in our logs.

We can only control ULX and ULib. We did it to try to make exploiting user's servers that much more difficult.

[Storm]

Yes it is available in regular logs but those arent available to me until server restarts. I have to either kick players off and restart it or wait for hours.

[Decicus]

See your point. I'm not aware of it it does.
As I believe you're trying to question why we even did it 'since <x> does it anyway>' I'm going to turn it around.
1) That now places even more of a security enhancement back on Valve (a) FIX the exploit where users can grab files using whatever command it is, b) Is IP needed? ))
2) Places less need of ULX having IP in our logs.

We can only control ULX and ULib. We did it to try to make exploiting user's servers that much more difficult.

I wasn't actually trying to make that point, I was just trying to give Storm an alternative.

Yes it is available in regular logs but those arent available to me until server restarts. I have to either kick players off and restart it or wait for hours.

Look up the ConVar "sv_logflush". It will write to logs in realtime, but it may affect the server performance so be careful with that.
May I ask what gamemode you're running?

[JamminR]

To be honest, any one with minimal lua knowledge could look at the diff of our code on github and see the line that changed, and simply make thier own addon that would add it back and create thier own 'join_log.txt' file. Those without lua knowledge would make it a great time to learn, g-lua, (it does use a Gmod hook not in lua by default)
You then run the risk of the above already mentioned issues though.

[Storm]

My servers are TTT, Prop Hunt, Murder, and Stop It Slender.

[Megiddo]

We're actually planning on moving everything in ULX to be only Steam-ID based, but this made a good first step. What JamminR says is right, it's much better to ban by Steam ID than IP address, and we are definitely still logging the Steam ID.

As far as the Source logs, I'm not sure on the details of the file grab exploit, but I'd guess that it can't reach what's in the logs folder or Valve would have taken stronger action against the exploit.