-1

I work for the goverment and one project targets employees that might apply something from their employer, for example a vacation period. They login with username and password.

I want to record their actions and be able to proof that they did so, for example, when one asks for 3 days off, I must record it in a way so I can prove the time and what they asked. So later they can't deny it.

Currently, the best I can do is to log all the data (PHP 7.3 $_SERVER, $_POST, $_GET, $_SESSION), get a trusted timestamp from our official TS provider and save this. Server, Centos 7.

How do I proof however that this data is not manufactured? The connection is encrypted, so I can't get the employee's ISP do return any logs. We also own the server so there is no 3rd party server provider to ensure the traffic.

Is there a way?

Thanks for your help.

  • Why you don’t use ntlm, so the login would be there ADDS login already, can’t cheat it – yagmoth555 Dec 26 '18 at 22:46
  • This ultimately isn't a technical question. You need to determine what whoever administers the program would accept as suitable evidence. – womble Dec 26 '18 at 23:32
  • How do I proof however that this data is not manufactured - First you need to clearly define who you are protecting against. If nobody else has root/admin access on the server, then nobody else should be able to tamper with the logs. – Zoredache Dec 27 '18 at 0:33
1

I would suggest implementing two-factor authentication which sends an SMS/TXT to the user to verify they are the one logging in.

Google Authenticator might be another solution.

You have not provided a lot about your environment. It's apparent you have a PHP server installed somewhere, but I have no idea if it's Windows or Linux (or something else).

With more info, it might be possible to give yo more specific advice.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.