2. PHPRunner General questions
  3. [SOLVED] PHPRunner audit log on MS Azure showing all IP addresses as 172.16.0.1
This topic is locked
[SOLVED]

PHPRunner audit log on MS Azure showing all IP addresses as 172.16.0.1

 		8/7/2021 9:57:00 PM
PHPRunner General questions
Dalkeith author

Hi I'm using the standard logging set up by PHPRunner to audit

Whatever login I use

Wi fi
Mobile
at home somewhere else at cafe

Always being recorded as 172.16.0.1

I can set up an IP firewall on the server however to ban the web application from accepting random IPs through MS Azure and that works I know what my IP is and I can prevent anyone else from reaching the PHP application..

ASP NET runner on MS Azure recording this correctly.

Not so PHP Runner version 10.5
I have two different PHP runner projects on MS Azure web app service and both exhibiting the same behaviour. I will at some point do auditing for an application not hosted on Web app service. Interesting that the asp net runner application hosted on MS Azure web app service is showing the correct IP Addresses.

Suggestions anyone.
HJB 8/8/2021

Sign-in logs in Azure Active Directory

I ran through the above URL content and understand, Azure itself logs too and provides options on even "per web application"
basis to view or to download log details. So, going this way, it can help you out to views logs of your current issue.

img alt

Not really knowing whether the content of the above screenshot has any connection with your current issue, it could be or not one
possible explanation for reasons WHY on some of your Azure web applications it works and it doesn't work on your current one.

Admin 8/9/2021

My guess is that Azure handles PHP and ASP.NET apps differently and PHP apps are routed through a load balancer or a reverse proxy. More info in this article.

What you can do is to edit include/audit.php file replacing $_SERVER["REMOTE_ADDR"] with $_SERVER['HTTP_X_FORWARDED_FOR']. Personally I won't recommend this, because $_SERVER['HTTP_X_FORWARDED_FOR'] value is taken from HTTP headers and cannot be fully trusted. For logging purposes it is probably fine but do not use it for any security features like restricting the acccess to your app.
Dalkeith author 8/10/2021

Thanks I was pretty sure it was something like that.
Dalkeith author 8/10/2021

Just tried it and it worked however I note that every time I rebuild the project it re-writes the audit.php file and so the variable is changed back.

Is there a way of permanently changing the audit.php variable for this project so that I don't need to be constantly changing that variable?