Security review - users, passwords and tokens

General questions
1

Hi all,

Is there any way for a super user to see all active users and when their password was last changed?

Is there any way for a super user to see all active tokens by user and when they were created and/or last used?

Thanks in advance!!

2

At the moment it is not possible to see the last time a password was updated or global view of available tokens in the UI. It is possible to see these in the DB directly with the user_token_auth containing the user and status of a token and the user table containing the last modified column.

3

Thanks Jason we are on Matomo Cloud, not self hosted. What are our options? Thanks

4

I have created a GitHub issue around the last password update. The data is already in the DB so in my mind that doesn’t seem too hard to implement, I could be wrong. For the tokens I have another issue open Add Super User Impersonation Feature · Issue #23469 · matomo-org/matomo that could help. For now, though on the cloud you wouldn’t have access to this data. It would depend on how often you need to audit these numbers. You could for example ask for a dump.

5

If anyone on prem would like a “last time updated” column, a colleague Ronan has created a feature to enable the last time the password was modified. You can find it here: Chardonneaur/UsersPasswordModified: Adds a password last modified column to the superuser Users Manager report.