[LON-CAPA-users] IP address of student submission - help prevent cheating

Tue Aug 20 09:26:38 EDT 2019

Stuart,
Thank you for explanation; I will work on it with our domain coordinator.

My general concern is that, today's technology has changed the way students cheat.
The tricks they use can effectively negate the advantages of online assessment tools, including Blackboard, LON-CAPA and other.
Due to all these tricks being widely used (according to numerous reports and publications), I strongly believe that unless teaching community counteracts cheating with even better technology, tools like LON-CAPA may lose the advantage of preventing cheating.

Randomization in LON-CAPA won't help if a student emails his/her problem to a paid online tutor and  in a few minutes receives the answer with complete solution.
I tried eliminating this option by using LON-CAPA in conjunction with lockdown browser. This will not let them use any website except Blackboard, LON-CAPA and other whitelisted.
With lockdown browser, they cannot use email either. 
I do not allow cellphones during exams. 
I also set slots with passwords, which has to be entered before students can see the problems.
However with smart watches, students can still cheat by sending their password to online tutor and letting this tutor complete the test for them.
This is why I think it is important to check the actual IP address and compare it with the local range of IP addresses or with the actual IP address of students in the class.

Thank you again,
Grigory Simin   

-----Original Message-----
From: LON-CAPA-users [mailto:lon-capa-users-bounces at mail.lon-capa.org] On Behalf Of Raeburn, Stuart
Sent: Tuesday, August 20, 2019 07:55
To: Discussion list for LON-CAPA users <lon-capa-users at mail.lon-capa.org>
Subject: Re: [LON-CAPA-users] IP address of student submission

GS,

>
> Any advice on using $env ?
>

The value of $ENV{'REMOTE_ADDR'}  is stored in $env{'request.host'} as part of session initialization when a user logs-in to LON-CAPA.  

Within a problem script you could retrieve the value set in $env{'request.host'} using an &EXT() call, e.g.,

$ip = &EXT('request.host');

However, $env{'request.host'} is only set at log-in time, and once a user's browser has a LON-CAPA session cookie, the same browser could connect to the same LON-CAPA server from a different IP address (e.g., by changing WiFi network) and the current $ENV{'REMOTE_ADDR'} would differ from $env{'request.host'}.

Because of that, $ENV{'REMOTE_ADDR'} is used internally by LON-CAPA instead of  $env{'request.host'} whenever IP checking is needed, as is the case where access to resources is being restricted by IP address, e.g., the acc parameter (Client IP/Name Access Control) is set, or slots (with IP restrictions) are in use.

A modification is needed to /home/httpd/lib/perl/Apache/lonnet.pm to allow the value of $ENV{'REMOTE_ADDR'} to be retrieved via an &EXT(() call in a loncapa perl script block. 

See the changes shown in: mail.lon-capa.org/pipermail/lon-capa-cvs/Week-of-Mon-20190819/028747.html
which support retrieval of the value with a call to: &EXT('client.remote_addr') in a script block.

Policies on privacy may apply at an institution regarding access to a user's IP address, e.g., for compliance with GDPR.  In the future, an option will be added to the LON-CAPA domain configuration, such that a user's preferences can include either an opt-in or an opt-out for storage of the user's IP address. 

>
> $timestamp=time();
>

Notes:

1. The approved method to access the current UNIX time from a script block is to call:

&EXT('system.time')

2 .If a LON-CAPA instance has been set up to use a reverse proxy, then $ENV{'REMOTE_ADDR'} will record the IP address of the reverse proxy, instead of the remote IP address of the client.  In such cases $ENV{HTTP_X_FORWARDED_FOR} may include the original client IP address. 

The value of the X-Forwarded-For request header is a comma separated string of IP addresses:

<client>, <proxy1>, <proxy2>

where <client> is the remote IP address, and <proxy1> (and optionally <proxy2>) are IP address(es) of intermediate prox(ies).  In order for the value of <client>to be reliable, <proxy1> (and optionally <proxy2>) must be IP addresses of trusted proxy server(s).  Institutional policies on privacy may apply to use of information from $ENV{HTTP_X_FORWARDED_FOR}.

Stuart Raeburn
LON-CAPA Academic Consortium

________________________________________
From: LON-CAPA-users <lon-capa-users-bounces at mail.lon-capa.org> on behalf of SIMIN, GRIGORY <SIMIN at engr.sc.edu>
Sent: Monday, August 19, 2019 6:08 PM
To: Discussion list for LON-CAPA users
Subject: Re: [LON-CAPA-users] IP address of student submission

Stuart,
Any advice on using $env ?
I tried including it in my script as follows

$timestamp=time();
$Time=localtime();
$IP=$ENV{'REMOTE_ADDR'};

However it did not work.
Timestamp and local time are displayed correctly $IP was not assigned any value.
Thanks,
GS

-----Original Message-----
From: LON-CAPA-users [mailto:lon-capa-users-bounces at mail.lon-capa.org] On Behalf Of Raeburn, Stuart
Sent: Monday, August 19, 2019 17:49
To: Discussion list for LON-CAPA users <lon-capa-users at mail.lon-capa.org>
Subject: Re: [LON-CAPA-users] IP address of student submission

GS,

Currently the IP address shown in LON-CAPA in grade details is the stored IP address of the remote client from which the submission was made.  The IP address recorded in the submission transaction for each student is the value of: $ENV{'REMOTE_ADDR'}.  Note: a situation where that IP address will be a LON-CAPA server's own IP address is when you are viewing grade details for transactions resulting from bubblesheet grading (of a printed exam), by a Course Coordinator.

The IP address might also be different from a student's actual IP address if students at your institution use an institutional VPN,  or a proxy for web access to your LON-CAPA instance.

Stuart Raeburn
LON-CAPA Academic Consortium
________________________________________
From: LON-CAPA-users <lon-capa-users-bounces at mail.lon-capa.org> on behalf of SIMIN, GRIGORY <SIMIN at engr.sc.edu>
Sent: Monday, August 19, 2019 5:13 PM
To: Discussion list for LON-CAPA users
Subject: [LON-CAPA-users] IP address of student submission

All,
Is there a way to check the IP address of a machine that student submitted the answer from?
In the grade details I can see the host name and the IP address, which is not the user IP address but the IP address of the LON-CAPA server.
Being able to track the student IP address would be very helpful to prevent cheating. Some students these days simply allow paid "ghosts" to login and solve the problems for them.

Thank you all,
GS
_______________________________________________
LON-CAPA-users mailing list
LON-CAPA-users at mail.lon-capa.org
https://protect2.fireeye.com/url?k=ed0c554f-b19e1f7a-ed0c1b8e-0cc47ad9bff8-3601ea00e5bab510&q=1&u=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__protect2.fireeye.com_url-3Fk-3D40c30202-2D1c513955-2D40c34cc3-2Dac1f6b0e67e4-2De219c5328f1cc789-26q-3D1-26u-3Dhttps-253A-252F-252Furldefense.proofpoint.com-252Fv2-252Furl-253Fu-253Dhttp-2D3A-5F-5Fmail.lon-2D2Dcapa.org-5Fmailman-5Flistinfo-5Flon-2D2Dcapa-2D2Dusers-2526d-253DDwICAg-2526c-253DnE-5F-5FW8dFE-2DshTxStwXtp0A-2526r-253DVsGo3jOm8tGLd6f-2DKlhT-2Dg-2526m-253DVJwZXH9WVorK7sD-2DyOjgs2GjMUO8PDKpjiIBxDWm4ik-2526s-253DjVp7Wx-2DhMDUq0A5zopNnKHLKN3Cd1f-2D7znIbW-2DZrocM-2526e-253D%26d%3DDwICAg%26c%3DnE__W8dFE-shTxStwXtp0A%26r%3DVsGo3jOm8tGLd6f-KlhT-g%26m%3DD-GiYyrbDvL7kTIdfyVgJAQDOGqIwGo2P9OnQX4nK50%26s%3DQzCPK_685F2S8bix0Swe6QWoNW5j7Po690X4jzO6YOY%26e%3D
_______________________________________________
LON-CAPA-users mailing list
LON-CAPA-users at mail.lon-capa.org
https://protect2.fireeye.com/url?k=fd94e1ea-a106abdf-fd94af2b-0cc47ad9bff8-67321e4c4be7247c&q=1&u=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__protect2.fireeye.com_url-3Fk-3Ddcc76de5-2D805556b2-2Ddcc72324-2Dac1f6b0e67e4-2D2958c9bd566926a9-26q-3D1-26u-3Dhttp-253A-252F-252Fmail.lon-2Dcapa.org-252Fmailman-252Flistinfo-252Flon-2Dcapa-2Dusers%26d%3DDwICAg%26c%3DnE__W8dFE-shTxStwXtp0A%26r%3DVsGo3jOm8tGLd6f-KlhT-g%26m%3DD-GiYyrbDvL7kTIdfyVgJAQDOGqIwGo2P9OnQX4nK50%26s%3DThx7FHijIrTdko-W272JHcwTfen-ls1Ov4cAH8gCMns%26e%3D
_______________________________________________
LON-CAPA-users mailing list
LON-CAPA-users at mail.lon-capa.org
https://protect2.fireeye.com/url?k=4593080a-1901423f-459346cb-0cc47ad9bff8-75625d2c5998aa40&q=1&u=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttp-3A__mail.lon-2Dcapa.org_mailman_listinfo_lon-2Dcapa-2Dusers%26d%3DDwICAg%26c%3DnE__W8dFE-shTxStwXtp0A%26r%3DVsGo3jOm8tGLd6f-KlhT-g%26m%3DD-GiYyrbDvL7kTIdfyVgJAQDOGqIwGo2P9OnQX4nK50%26s%3DQOlWViQk7gzec3IYd2AbkycvO3i3_fwsq3B6d4Z-jBo%26e%3D
_______________________________________________
LON-CAPA-users mailing list
LON-CAPA-users at mail.lon-capa.org
https://protect2.fireeye.com/url?k=b2eb7456-ee793e63-b2eb3a97-0cc47ad9bff8-4153611faf6636c2&q=1&u=http%3A%2F%2Fmail.lon-capa.org%2Fmailman%2Flistinfo%2Flon-capa-users