Hello,
We noticed that in the Moodle version 2.1.2, the action of logging as someone else was not logged.
We have seen that the problem is actually a bug (see http://tracker.moodle.org/browse/MDL-28385)
However, we found that the actions performed as a different users were not logged. (In stealth mode)
For security reasons, we question the choice.
Indeed, we see that problems of security of not logging these actions.
Is there a reason you do not logging?
In reply to Gilles-Philippe Leblanc
Re: Why the loginas functionnality is in stealth mode
by sam marshall -
My post is not directly relevant to the issue reported here which I agree is a serious one and should be fixed. But because it's related, I wanted to mention a couple of other things relating to our experience at the OU that might be of interest to people who are interested in the security implications of this feature.
We have disabled the loginas feature in our Moodle installation partly for this reason - actually didn't know it had 'stealth mode' but we knew logging wasn't sufficient.
It's easy to disable by setting the capability so that nobody can do it - except admin of course, admin can do anything but hopefully you trust the admin.
Our policy is that when staff are using a 'log in as' type feature, they must only have 'read only' access (for example, if they log in as a student and they go to a forum, they should see all the forum posts that the student can see, but they cannot actually make a new post while logged in as that user). Obviously Moodle loginas feature doesn't do this.
For now we implemented a custom feature instead that automatically creates 'example student' user in each course and using a custom user interface in a block, lets you log in as that student only (using a new capability, not the standard loginas one). We did this without making core changes.
At some point (probably in the Moodle 2.3 development timescale) we have to make loginas a particular student in 'read-only' mode possible on our system (presumably a block on all capabilities marked as 'write' in the read/write option).
I'd been assuming we would also do this using our own custom code somehow, but if anyone else is interested in a 'read-only' option for loginas, let me know here and I'll think about whether it can be done as a core feature.
--sam
In reply to sam marshall
Re: Why the loginas functionnality is in stealth mode
First, thank you for that. This will help us reflect on the issue of allowing some users to use this powerful feature.
But I want to specifie that before reading your clarification, our wish was rather logging actions performed as a different user rather than to restrict the possible actions.
However, if more features about login as are available in the future, we will be more than happy to enjoy it.
The point is not necessarily that we do not trust those who have access to the functionality but about identity theft and security issue. Its always a good think to keep logs of actions.
Finally, if anyone knows the reason why the trace left by a user is not logged, we would like to know.
In reply to Gilles-Philippe Leblanc
Re: Why the loginas functionnality is in stealth mode
by sam marshall -
I agree, I don't intend to take away from your point - your bug is pretty clear. It just brought to mind a different but related point.
Re your 'why was this done' question the answer is, because somebody incorrectly thought it was a good idea. It looks like similar code about $USER->realuser in 1.9 (is that the same thing?) was there in 2002... Back then there wasn't a process for documenting everything with MDL numbers.
It's obviously not a good idea, I doubt people would be opposed to fixing it.
--sam
In reply to sam marshall
Re: Why the loginas functionnality is in stealth mode
Thank you very much for your answer. I'll check further if a task is created about that and created it if needed.
We will also look at our side it would be the best approach may be one similar to yours, to bypass this problem. Our security officer does not really seem to appreciate the idea of keeping the current behavior...
In reply to sam marshall
Re: Why the loginas functionnality is in stealth mode
I have created a task in the Moodle:
http://tracker.moodle.org/browse/MDL-30304