Wrong (malformed) external storage credentials saved in `oc_storages_credentials`

alexanderhofstaetter commented 3 years ago

Hello!

I am using Nextcloud 20.0.2 (docker) with LDAP + external storage and several external SMB mounts (all with "credentials saved in database" enabled).

It seems that the credentials saved in the corrspondeing table (oc_storages_credentials) are wrong and therefore all SMB shares are showing errors.

When I initially add the external storage SMB mounts in the settings and then a user logs in the first time, the SMB shares work (with the correct login) which gets correctly saved in the DB.

Afterwards I can find one single entry on the oc_storages_credentials-table

However, when I (as an admin) navigate to: https://cloud.example.org/settings/users the table oc_storages_credentials gets (pre)populated with all the users (and some random credentials) - this also includes all users who weren´t logged-in yet. When the user logs in afterwards the credentials entry is already there and does not get updated.

Steps to reproduce

Add external SMB mount with option "credentials saved in database"
Manually check the MYSQL table oc_storages_credentials - it should be empty
As an admin: navigate to (/settings/users)
Recheck the MYSQL table oc_storages_credentials - there is an entry for every user now
Login as new user and try to access a SMB share - access denied.

Expected behaviour

Do not populate the table oc_storages_credentials on "user list settings page"
If the current user credentials does not match the ones in the DB -> update it

Actual behaviour

password::logincredentials/credentials entries are getting deployed initially from the admin user ...

Debugging results

In the file Files_External\Lib\Auth\Password\LoginCredentials.php:

When I output the $sessionCredentials->getLoginName() on each request I get two results:

for the admin user listing all users on the settings page: there is a full browser page with binary crap printed.
while logged in with the specific user it prints the actual loginame of that user

Bugfix (Dirty)

When I change line 77 in Files_External\Lib\Auth\Password\LoginCredentials.php: from if (is_null($credentials)) to if (\OC::$server->getUserSession()->isLoggedIn()) it works correctly.

With thix change the credentials gets stored on every request and therefore the wrong (initialized) ones getting overwritten.

It looks like there is some impersonation going on here.

Server configuration

I am using this docker image (no modifications): https://github.com/nextcloud/docker/tree/master/.examples/dockerfiles/full/fpm-alpine

Operating system: Docker on Ubuntu 20.04.1 LTS Web server: nginx with php-fpm Database: mariadb 10.5 as docker container PHP version: 7php .4 Nextcloud version: 20.0.2 Updated from an older Nextcloud/ownCloud or fresh install: updated from nextcloud 18.0.11 -> 19.0 -> 20.0.2 (in one go) Where did you install Nextcloud from:

Signing status:

Signing status

``` No errors have been found. ```

List of activated apps:

App list

Enabled: - accessibility: 1.6.0 - activity: 2.13.3 - cloud_federation_api: 1.3.0 - comments: 1.10.0 - dav: 1.16.1 - drawio: 0.9.8 - external: 3.7.1 - extract: 1.2.5 - federatedfilesharing: 1.10.1 - federation: 1.10.1 - files: 1.15.0 - files_external: 1.11.1 - files_linkeditor: 1.1.3 - files_pdfviewer: 2.0.1 - files_rightclick: 0.17.0 - files_sharing: 1.12.0 - files_trashbin: 1.10.1 - files_versions: 1.13.0 - files_videoplayer: 1.9.0 - logreader: 2.5.0 - lookup_server_connector: 1.8.0 - metadata: 0.12.0 - notifications: 2.8.0 - oauth2: 1.8.0 - photos: 1.2.0 - provisioning_api: 1.10.0 - ransomware_protection: 1.8.0 - settings: 1.2.0 - sharebymail: 1.10.0 - socialsharing_email: 2.1.0 - text: 3.1.0 - theming: 1.11.0 - theming_customcss: 1.7.0 - twofactor_backupcodes: 1.9.0 - twofactor_nextcloud_notification: 3.0.0 - twofactor_totp: 5.0.0 - twofactor_u2f: 6.0.0 - updatenotification: 1.10.0 - user_ldap: 1.10.2 - viewer: 1.4.0 - workflowengine: 2.2.0 Disabled: - admin_audit - contactsinteraction - dashboard - encryption - firstrunwizard - nextcloud_announcements - password_policy - privacy - recommendations - serverinfo - spreed - support - survey_client - systemtags - user_status - weather_status

Nextcloud configuration:

Config report

``` { "system": { "memcache.local": "\\OC\\Memcache\\APCu", "apps_paths": [ { "path": "\/var\/www\/html\/apps", "url": "\/apps", "writable": false }, { "path": "\/var\/www\/html\/custom_apps", "url": "\/custom_apps", "writable": true } ], "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "cloud.example.org" ], "trusted_proxies": "***REMOVED SENSITIVE VALUE***", "forwarded_for_headers": [ "HTTP_X_FORWARDED_FOR" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "20.0.2.2", "overwrite.cli.url": "https:\/\/cloud.example.org", "overwriteprotocol": "https", "overwritehost": "cloud.example.org", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "ldapIgnoreNamingRules": false, "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory", "default_language": "de", "force_language": "de", "default_locale": "de_AT", "force_locale": "de_AT", "skeletondirectory": false, "simpleSignUpLink.shown": false, "auth.bruteforce.protection.enabled": false, "twofactor_enforced": "true", "twofactor_enforced_groups": [ "admin" ], "twofactor_enforced_excluded_groups": [], "updater.release.channel": "stable", "lost_password_link": "https:\/\/account.example.org\/", "loglevel": 3, "maintenance": false, "redis": { "host": "***REMOVED SENSITIVE VALUE***", "password": "***REMOVED SENSITIVE VALUE***", "port": 6379 }, "mail_smtpmode": "smtp", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "25", "mail_smtpauthtype": "LOGIN", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_sendmailmode": "smtp", "mail_smtpauth": 1, "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "mail_smtpsecure": "tls", "theme": "", "data-fingerprint": "80b0cc4ffe12fed9a53adc96d893708e" }, "apps": { "accessibility": { "enabled": "yes", "installed_version": "1.6.0", "types": "" }, "activity": { "enable_email": "no", "enabled": "yes", "installed_version": "2.13.3", "notify_email_calendar": "0", "notify_email_calendar_event": "0", "notify_email_calendar_todo": "0", "notify_email_comments": "0", "notify_email_favorite": "0", "notify_email_file_changed": "0", "notify_email_file_created": "0", "notify_email_file_deleted": "0", "notify_email_file_favorite_changed": "0", "notify_email_file_restored": "0", "notify_email_public_links": "0", "notify_email_remote_share": "0", "notify_email_shared": "0", "notify_email_systemtags": "0", "notify_notification_calendar": "0", "notify_notification_calendar_event": "0", "notify_notification_calendar_todo": "0", "notify_notification_comments": "0", "notify_notification_favorite": "0", "notify_notification_file_changed": "0", "notify_notification_file_favorite_changed": "0", "notify_notification_group_settings": "1", "notify_notification_personal_settings": "1", "notify_notification_public_links": "0", "notify_notification_remote_share": "0", "notify_notification_security": "1", "notify_notification_shared": "0", "notify_notification_twofactor_totp": "1", "notify_notification_twofactor_u2f": "1", "notify_setting_batchtime": "3600", "notify_setting_self": "0", "notify_setting_selfemail": "0", "notify_stream_calendar": "1", "notify_stream_calendar_event": "1", "notify_stream_calendar_todo": "1", "notify_stream_comments": "1", "notify_stream_favorite": "1", "notify_stream_file_changed": "1", "notify_stream_file_created": "1", "notify_stream_file_deleted": "1", "notify_stream_file_favorite": "0", "notify_stream_file_restored": "1", "notify_stream_public_links": "1", "notify_stream_remote_share": "1", "notify_stream_shared": "1", "notify_stream_systemtags": "1", "types": "filesystem" }, "admin_audit": { "enabled": "no", "installed_version": "1.10.0", "types": "logging" }, "backgroundjob": { "lastjob": "203" }, "breezedark": { "enabled": "no", "installed_version": "18.0.12", "types": "" }, "bruteforcesettings": { "enabled": "no", "installed_version": "1.6.0", "types": "" }, "calendar": { "enabled": "no", "installed_version": "2.1.2", "types": "" }, "cloud_federation_api": { "enabled": "yes", "installed_version": "1.3.0", "types": "filesystem" }, "comments": { "enabled": "yes", "installed_version": "1.10.0", "types": "logging" }, "contactsinteraction": { "enabled": "no", "installed_version": "1.1.0", "types": "dav" }, "core": { "backgroundjobs_mode": "cron", "default_encryption_module": "OC_DEFAULT_MODULE", "enterpriseLogoChecked": "yes", "installed.bundles": "[\"CoreBundle\"]", "installedat": "1587561481.299", "lastcron": "1607375700", "lastupdateResult": "[]", "lastupdatedat": "1607315700", "oc.integritycheck.checker": "[]", "public_files": "files_sharing\/public.php", "public_webdav": "dav\/appinfo\/v1\/publicwebdav.php", "shareapi_allow_group_sharing": "yes", "shareapi_allow_public_upload": "yes", "shareapi_allow_resharing": "yes", "shareapi_allow_share_dialog_user_enumeration": "yes", "shareapi_default_expire_date": "yes", "shareapi_default_internal_expire_date": "yes", "shareapi_enable_link_password_by_default": "no", "shareapi_enabled": "yes", "shareapi_exclude_groups": "no", "shareapi_exclude_groups_list": "[\"\"]", "shareapi_expire_after_n_days": "60", "shareapi_internal_enforce_expire_date": "no", "shareapi_internal_expire_after_n_days": "90", "theming.variables": "a68415316c50f236d52de756db4b7262", "updater.secret.created": "1593261797", "vendor": "nextcloud" }, "dashboard": { "enabled": "no", "installed_version": "7.0.0", "types": "" }, "dav": { "buildCalendarReminderIndex": "yes", "buildCalendarSearchIndex": "yes", "chunks_migrated": "1", "enabled": "yes", "installed_version": "1.16.1", "regeneratedBirthdayCalendarsForYearFix": "yes", "types": "filesystem" }, "deck": { "enabled": "no", "installed_version": "0.8.2", "types": "dav" }, "drawio": { "DrawioLang": "auto", "DrawioOffline": "no", "DrawioTheme": "kennedy", "DrawioUrl": "https:\/\/www.draw.io", "DrawioXml": "yes", "enabled": "yes", "installed_version": "0.9.8", "types": "filesystem" }, "encryption": { "enabled": "no", "installed_version": "2.6.0", "masterKeyId": "master_66b7a0f5", "publicShareKeyId": "pubShare_66b7a0f5", "recoveryKeyId": "recoveryKey_66b7a0f5", "types": "filesystem" }, "external": { "enabled": "yes", "installed_version": "3.7.1", "max_site": "3", "sites": "***REMOVED SENSITIVE VALUE***", "types": "" }, "extract": { "enabled": "yes", "installed_version": "1.2.5", "types": "" }, "federatedfilesharing": { "enabled": "yes", "installed_version": "1.10.1", "types": "" }, "federation": { "enabled": "yes", "installed_version": "1.10.1", "types": "authentication" }, "files": { "cronjob_scan_files": "500", "default_quota": "10 GB", "enabled": "yes", "installed_version": "1.15.0", "types": "filesystem" }, "files_external": { "allow_user_mounting": "no", "enabled": "yes", "installed_version": "1.11.1", "types": "filesystem", "user_mounting_backends": "ftp,dav,owncloud,sftp,amazons3,swift,smb,\\OC\\Files\\Storage\\SFTP_Key,\\OC\\Files\\Storage\\SMB_OC" }, "files_linkeditor": { "enabled": "yes", "installed_version": "1.1.3", "types": "" }, "files_pdfviewer": { "enabled": "yes", "installed_version": "2.0.1", "types": "" }, "files_rightclick": { "enabled": "yes", "installed_version": "0.17.0", "types": "" }, "files_sharing": { "enabled": "yes", "incoming_server2server_group_share_enabled": "yes", "incoming_server2server_share_enabled": "yes", "installed_version": "1.12.0", "lookupServerEnabled": "no", "lookupServerUploadEnabled": "no", "outgoing_server2server_group_share_enabled": "yes", "outgoing_server2server_share_enabled": "yes", "types": "filesystem" }, "files_trashbin": { "enabled": "yes", "installed_version": "1.10.1", "types": "filesystem,dav" }, "files_versions": { "enabled": "yes", "installed_version": "1.13.0", "types": "filesystem,dav" }, "files_videoplayer": { "enabled": "yes", "installed_version": "1.9.0", "types": "" }, "firstrunwizard": { "enabled": "no", "installed_version": "2.7.0", "types": "logging" }, "geoblocker": { "chosenService": "0", "enabled": "no", "installed_version": "0.2.0", "types": "" }, "groupfolders": { "enabled": "no", "installed_version": "6.0.5", "types": "filesystem,dav" }, "impersonate": { "enabled": "no", "installed_version": "1.5.0", "types": "" }, "logreader": { "enabled": "yes", "installed_version": "2.5.0", "levels": "00011", "live": "", "types": "" }, "lookup_server_connector": { "enabled": "yes", "installed_version": "1.8.0", "types": "authentication" }, "metadata": { "enabled": "yes", "installed_version": "0.12.0", "types": "" }, "nextcloud_announcements": { "enabled": "no", "installed_version": "1.7.0", "pub_date": "Thu, 24 Oct 2019 00:00:00 +0200", "types": "logging" }, "notes": { "enabled": "no", "installed_version": "3.2.0", "types": "" }, "notifications": { "enabled": "yes", "installed_version": "2.8.0", "types": "logging" }, "oauth2": { "enabled": "yes", "installed_version": "1.8.0", "types": "authentication" }, "onlyoffice": { "enabled": "no", "installed_version": "4.1.4", "types": "filesystem" }, "password_policy": { "enabled": "no", "installed_version": "1.8.0", "types": "" }, "photos": { "enabled": "yes", "installed_version": "1.2.0", "types": "" }, "polls": { "enabled": "no", "installed_version": "1.3.0", "types": "" }, "privacy": { "enabled": "no", "installed_version": "1.2.0", "readableLocation": "at", "types": "" }, "provisioning_api": { "enabled": "yes", "installed_version": "1.10.0", "types": "prevent_group_restriction" }, "ransomware_protection": { "enabled": "yes", "installed_version": "1.8.0", "types": "logging" }, "recommendations": { "enabled": "no", "installed_version": "0.6.0", "types": "" }, "serverinfo": { "enabled": "no", "installed_version": "1.8.0", "types": "" }, "settings": { "enabled": "yes", "installed_version": "1.2.0", "types": "" }, "sharebymail": { "enabled": "yes", "enforcePasswordProtection": "no", "installed_version": "1.10.0", "types": "filesystem" }, "socialsharing_email": { "enabled": "yes", "installed_version": "2.1.0", "types": "" }, "spreed": { "conversations_files_public_shares": "0", "enabled": "no", "has_reference_id": "yes", "installed_version": "10.0.3", "project_access_invalidated": "1", "stun_servers": "***REMOVED SENSITIVE VALUE***", "types": "prevent_group_restriction" }, "support": { "enabled": "no", "installed_version": "1.1.0", "types": "session" }, "survey_client": { "enabled": "no", "installed_version": "1.6.0", "types": "" }, "systemtags": { "enabled": "no", "installed_version": "1.8.0", "types": "logging" }, "tasks": { "enabled": "no", "installed_version": "0.12.1", "types": "" }, "text": { "enabled": "yes", "installed_version": "3.1.0", "types": "dav" }, "theming": { "backgroundMime": "image\/jpeg", "cachebuster": "18", "color": "#1062ae", "enabled": "yes", "faviconMime": "image\/png", "imprintUrl": "***REMOVED SENSITIVE VALUE***", "installed_version": "1.11.0", "logoMime": "image\/png", "logoheaderMime": "image\/png", "name": "My Cloud", "privacyUrl": "***REMOVED SENSITIVE VALUE***", "slogan": "***REMOVED SENSITIVE VALUE***", "types": "logging", "url": "***REMOVED SENSITIVE VALUE***" }, "theming_customcss": { "enabled": "yes", "installed_version": "1.7.0", "types": "" }, "twofactor_backupcodes": { "enabled": "yes", "installed_version": "1.9.0", "types": "" }, "twofactor_nextcloud_notification": { "alex.hofstaetter_3993_enabled": "0", "alex.hofstaetter_enabled": "0", "enabled": "yes", "installed_version": "3.0.0", "types": "" }, "twofactor_totp": { "enabled": "yes", "installed_version": "5.0.0", "types": "" }, "twofactor_u2f": { "enabled": "yes", "installed_version": "6.0.0", "types": "" }, "updatenotification": { "core": "18.0.11.2", "drawio": "0.9.8", "enabled": "yes", "extract": "1.2.5", "files_linkeditor": "1.1.3", "installed_version": "1.10.0", "metadata": "0.12.0", "notify_groups": "[]", "socialsharing_email": "2.1.0", "spreed": "8.0.13", "theming_customcss": "1.6.0", "twofactor_totp": "5.0.0", "twofactor_u2f": "6.0.0", "types": "", "update_check_errors": "0" }, "user_ldap": { "background_sync_interval": "1800", "background_sync_offset": "0", "background_sync_prefix": "s01", "cleanUpJobOffset": "0", "enabled": "yes", "installed_version": "1.10.2", "s01_lastChange": "1607316770", "s01has_memberof_filter_support": "1", "s01home_folder_naming_rule": "", "s01last_jpegPhoto_lookup": "0", "s01ldap_agent_password": "***REMOVED SENSITIVE VALUE***", "s01ldap_attributes_for_group_search": "", "s01ldap_attributes_for_user_search": "", "s01ldap_backup_host": "dc2.intern.example.org", "s01ldap_backup_port": "636", "s01ldap_base": "OU=Example,DC=intern,DC=example,DC=org", "s01ldap_base_groups": "OU=Gruppen,OU=Example,dc=intern,DC=example,DC=org\nOU=Netzlaufwerke,OU=Service-Berechtigungen,OU=Example,dc=intern,DC=example,DC=org", "s01ldap_base_users": "OU=Benutzer,OU=Example,dc=intern,DC=example,DC=org", "s01ldap_cache_ttl": "0", "s01ldap_configuration_active": "1", "s01ldap_default_ppolicy_dn": "", "s01ldap_display_name": "displayname", "s01ldap_dn": "SA-LDAP-Nextcloud", "s01ldap_dynamic_group_member_url": "", "s01ldap_email_attr": "mail", "s01ldap_experienced_admin": "0", "s01ldap_expert_username_attr": "sAMAccountName", "s01ldap_expert_uuid_group_attr": "distinguishedName", "s01ldap_expert_uuid_user_attr": "sAMAccountName", "s01ldap_ext_storage_home_attribute": "", "s01ldap_gid_number": "gidNumber", "s01ldap_group_display_name": "cn", "s01ldap_group_filter": "(&(|(objectclass=group)))", "s01ldap_group_filter_mode": "1", "s01ldap_group_member_assoc_attribute": "member", "s01ldap_groupfilter_groups": "", "s01ldap_groupfilter_objectclass": "group", "s01ldap_host": "ldaps:\/\/dc1.intern.example.org", "s01ldap_login_filter": "(&(&(|(objectCategory=person)(objectclass=user)))(|(samaccountname=%uid)(userPrincipalName=%uid)))", "s01ldap_login_filter_mode": "1", "s01ldap_loginfilter_attributes": "sAMAccountName", "s01ldap_loginfilter_email": "1", "s01ldap_loginfilter_username": "1", "s01ldap_matching_rule_in_chain_state": "available", "s01ldap_nested_groups": "1", "s01ldap_override_main_server": "0", "s01ldap_paging_size": "0", "s01ldap_port": "636", "s01ldap_quota_attr": "", "s01ldap_quota_def": "", "s01ldap_tls": "0", "s01ldap_turn_off_cert_check": "1", "s01ldap_turn_on_pwd_change": "0", "s01ldap_user_avatar_rule": "default", "s01ldap_user_display_name_2": "", "s01ldap_user_filter_mode": "1", "s01ldap_userfilter_groups": "", "s01ldap_userfilter_objectclass": "person\nuser", "s01ldap_userlist_filter": "(&(|(objectclass=person)(objectclass=user)))", "s01use_memberof_to_detect_membership": "1", "types": "authentication" }, "user_status": { "enabled": "no", "installed_version": "1.0.1", "types": "" }, "viewer": { "enabled": "yes", "installed_version": "1.4.0", "types": "" }, "weather_status": { "enabled": "no", "installed_version": "1.0.0", "types": "" }, "workflowengine": { "enabled": "yes", "installed_version": "2.2.0", "types": "filesystem" } } } ```

Are you using external storage, if yes which one: SMB

Are you using encryption: no encryption at rest

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

LDAP config

Client configuration

Browser: Chromoum 87 Operating system: macOS 10.15.7

Logs

In the nextcloud log section you can find the log of the initial user login who gets "denied" on the SMB storage due to wrong stored credentials.

Nextcloud log (data/nextcloud.log)

Nextcloud log

alexanderhofstaetter commented 3 years ago

I am still debugging and the credentials are definitly wrong in the DB!

File: `Files_External\Lib\Auth\Password\LoginCredentials.php``

When I print_r($user->getUID())for debugging in function getCredentials(IUser $user), I get the following result on the /settings/user page.

Please note: Only my username is displayed correctly, all other users are completely crapped.

@nickvergessen - I think this behaviour is due to recent changes in https://github.com/nextcloud/server/commits/master/lib/private/Security/CredentialsManager.php - can you confirm?

nickvergessen commented 3 years ago

Hi @alexanderhofstaetter can you contact me via email at <my github name>@nextcloud.com thanks!

nickvergessen commented 3 years ago

Fixed with https://github.com/nextcloud/server/pull/25224

nextcloud / server