[Bug]: Severe Bruteforce Bug Disabling Primary User

⚠️ This issue respects the following points: ⚠️

[X] This is a bug, not a question or a configuration/webserver/proxy issue.
[X] This issue is not already reported on Github (I've searched it).
[X] Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
[X] I agree to follow Nextcloud's Code of Conduct.

Bug description

I disabled (did not remove) brute force months ago in favor of fail2ban. Now, my webdav logins are being recorded as webdav login failures and causing -disabled & removed- bruteforce application to disable my primary user account. Yes, the ip address is whitelisted in fail2ban.

I have to manually enter phpmyadmin and clear my local ip from oc_bruteforce_attempts table in the db in order to regain access. using the occ security:bruteforce:reset ip_address to reset brute force had no effect... until -after- I reinstalled bruteforce and whitelisted my IP (note this failed to solve the problem).

NC bruteforce ignores the whitelist values, so I tried completely removing bruteforce from the server. Net results is now occ security:bruteforce:reset ip_address does respond...

The only way to keep my primary user account functional is to run a cron job to remove my IP from oc_bruteforce_attempts & re-enable my user every minute. (An obvious waste of resources)

Things that I have tried:

1.) I installed, verified whitelist of my IPs (problem persisted), then completely removed the brute force app, still problem persists as oc_bruteforce_attempts table is still in db 2.) I completely deactivated ModSec, for the specific virtualhost of my nextcloud instance, bug not ModSec related, problem persisted 3.) I re-created the problem with ethernet cable and/or wifi connections 4.) I added my ip address as a trusted domain, problem persists 5.) I added my ip as a truested proxy, problem persists. 6.) I disconnected all sync clients, and only accessed via web nextcloud via Chromium browser, the problem persists. 7.) I accessed redis-cli and used “flushall” , problem persists

Steps to reproduce

1.) Fresh install NC23 Upgrade to NC via updater scirpt while bruteforce app is disabled, but not removed 2.) Overview = All checks passed 3.) Clean Apache2 error log (only modsec errors blocking internet bots, no errors related to my IP) 4.) disconnect all sync devices, only log in via web GUI.

FYI, NC was installed via Virtualmin script and updated by the NC updater script

Expected behavior

I don't expected the bruteforce app that has been disabled and now removed to randomly start banning a whitelisted and safe IP address that has been working for almost 2 months.

Installation method

Other

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

[X] Default user-backend (database)
[ ] LDAP/ Active Directory
[ ] SSO - SAML
[ ] Other

Configuration report

root@admin:~# sudo -u adminuser php /home/adminuser/public_html/occ config:list system
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "www.example.com",
            "example.com",
            "xxx.xxx.xxx.xxx"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "24.0.1.1",
        "overwrite.cli.url": "https:\/\/www.example.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memcache.local": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": true,
        "memcache.locking": "\\OC\\Memcache\\APCu",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "default_phone_region": "CN",
        "log_type": "file",
        "logfile": "\/home\/adminuser\/ncerrors\/error.log",
        "loglevel": 2,
        "logdateformat": "F d, Y H:i:s",
        "trashbin_retention_obligation": "3, 7",
        "mail_smtpmode": "sendmail",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "PLAIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "auth.bruteforce.protection.enabled": "false",
        "theme": "",
        "app_install_overwrite": [
            "files_antivirus",
            "qownnotesapi",
            "appointments"
        ],
        "data-fingerprint": "9e02b4166b5ccd02c2e1fa2c15895a44",
        "mail_smtpsecure": "tls"
    }
}

List of activated Apps

root@admin:~# sudo -u adminaym php /home/adminaym/public_html/occ app:list
Enabled:
  - accessibility: 1.10.0
  - activity: 2.16.0
  - admin_audit: 1.14.0
  - announcementcenter: 6.3.0
  - appointments: 1.12.5
  - apporder: 0.15.0
  - approval: 1.0.9
  - breezedark: 24.0.1
  - calendar: 3.3.1
  - checksum: 1.1.4
  - circles: 24.0.0
  - cloud_federation_api: 1.7.0
  - comments: 1.14.0
  - contacts: 4.1.1
  - contactsinteraction: 1.5.0
  - cookbook: 0.9.12
  - cospend: 1.4.6
  - dashboard: 7.4.0
  - data_request: 1.11.0
  - dav: 1.22.0
  - deck: 1.7.0
  - drop_account: 2.0.0
  - duplicatefinder: 0.0.14
  - event_update_notification: 1.5.0
  - federatedfilesharing: 1.14.0
  - federation: 1.14.0
  - file_sharing_invalid_notifier: 0.1.1
  - files: 1.19.0
  - files_accesscontrol: 1.14.0
  - files_automatedtagging: 1.14.0
  - files_downloadactivity: 1.13.0
  - files_downloadlimit: 1.0.1
  - files_fulltextsearch: 24.0.0
  - files_fulltextsearch_tesseract: 24.0.0
  - files_pdfviewer: 2.5.0
  - files_retention: 1.13.1
  - files_rightclick: 1.3.0
  - files_sharing: 1.16.2
  - files_snapshots: 1.0.4
  - files_trashbin: 1.14.0
  - files_versions: 1.17.0
  - files_videoplayer: 1.13.0
  - files_zip: 1.1.1
  - fileslibreofficeedit: 1.0.4
  - firstrunwizard: 2.13.0
  - forms: 2.5.0
  - fulltextsearch: 24.0.0
  - fulltextsearch_elasticsearch: 24.0.0
  - groupfolders: 12.0.0
  - groupquota: 0.1.8
  - health: 1.5.1
  - impersonate: 1.11.0
  - listman: 20.1.1
  - logreader: 2.9.0
  - lookup_server_connector: 1.12.0
  - mail: 1.12.1
  - nextcloud_announcements: 1.13.0
  - notes: 4.3.1
  - notifications: 2.12.0
  - notify_push: 0.4.0
  - oauth2: 1.12.0
  - password_policy: 1.14.0
  - pax_fax: 1.0.5
  - photos: 1.6.0
  - privacy: 1.8.0
  - provisioning_api: 1.14.0
  - quota_warning: 1.14.0
  - ransomware_protection: 1.13.0
  - recommendations: 1.3.0
  - registration: 1.5.0
  - richdocuments: 6.1.0
  - richdocumentscode: 21.11.402
  - root_cache_cleaner: 0.1.2
  - serverinfo: 1.14.0
  - settings: 1.6.0
  - sharebymail: 1.14.0
  - spreed: 14.0.2
  - support: 1.7.0
  - survey_client: 1.12.0
  - systemtags: 1.14.0
  - tables: 0.1.2
  - tasks: 0.14.4
  - terms_of_service: 1.10.2
  - text: 3.5.1
  - theming: 1.15.0
  - twofactor_backupcodes: 1.13.0
  - twofactor_nextcloud_notification: 3.4.0
  - updatenotification: 1.14.0
  - user_retention: 1.7.0
  - user_status: 1.4.0
  - user_usage_report: 1.8.0
  - viewer: 1.8.0
  - weather_status: 1.4.0
  - welcome: 1.0.1
  - workflowengine: 2.6.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"YpMBnn23cQX6q2lXkvztJAAAAAE","level":3,"time":"2022-05-29T05:16:25+00:00","remoteAddr":"XXX.XXX.XXX.XXX","user":"fathertime","app":"core","method":"GET","url":"/index.php/core/preview.png?file=/Documents/China%20Life/Clients/Akira/DO%20NOT%20DELETE/Case%20Profile.ods&c=29f2b3c96ef1882f44cf320e064dafaa&x=150&y=150","message":"OC_Image::fixOrientation(): No image loaded","userAgent":"Mozilla/5.0 (Linux) mirall/3.5.1 (build 10305) (Nextcloud, ubuntu-5.13.0-44-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"24.0.1.1","id":"629301bf9e12e"}
{"reqId":"YpL@UQby2yIiDrbT20xaygAAAAo","level":4,"time":"2022-05-29T05:02:09+00:00","remoteAddr":"XXX.XXX.XXX.XXX","user":"fathertime","app":"webdav","method":"PROPFIND","url":"/remote.php/dav/files/fathertime/","message":"OC\\User\\LoginException: User disabled","userAgent":"Mozilla/5.0 (Linux) mirall/3.5.1 (build 10305) (Nextcloud, ubuntu-5.13.0-44-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"24.0.1.1","exception":{"Exception":"Sabre\\DAV\\Exception\\ServiceUnavailable","Message":"OC\\User\\LoginException: User disabled","Code":0,"Trace":[{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":180,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/lib/Server.php","line":352,"function":"exec","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/remote.php","line":166,"args":["/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","Line":161,"CustomMessage":"--"},"id":"629301f3b7804"}
{"reqId":"YpL@UQby2yIiDrbT20xaygAAAAo","level":3,"time":"2022-05-29T05:02:09+00:00","remoteAddr":"XXX.XXX.XXX.XXX","user":"fathertime","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/fathertime/","message":"User disabled","userAgent":"Mozilla/5.0 (Linux) mirall/3.5.1 (build 10305) (Nextcloud, ubuntu-5.13.0-44-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"24.0.1.1","exception":{"Exception":"OC\\User\\LoginException","Message":"User disabled","Code":0,"Trace":[{"file":"/home/adminuser/public_html/lib/private/User/Session.php","line":654,"function":"completeLogin","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/lib/private/User/Session.php","line":353,"function":"loginWithToken","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/lib/private/User/Session.php","line":450,"function":"login","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","line":129,"function":"logClientIn","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php","line":103,"function":"validateUserPass","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","line":251,"function":"check","class":"Sabre\\DAV\\Auth\\Backend\\AbstractBasic","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/lib/Connector/Sabre/Auth.php","line":154,"function":"auth","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":180,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":253,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/sabre/dav/lib/DAV/Server.php","line":321,"function":"start","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/lib/Server.php","line":352,"function":"exec","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/home/adminuser/public_html/remote.php","line":166,"args":["/home/adminuser/public_html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/home/adminuser/public_html/lib/private/User/Session.php","Line":370,"CustomMessage":"--"},"id":"6293021a0366e"}
{"reqId":"YpLpONKtljt3xgvqP45cJQAAAAM","level":3,"time":"2022-05-29T03:32:08+00:00","remoteAddr":"XXX.XXX.XXX.XXX","user":"--","app":"PHP","method":"GET","url":"/index.php/apps/theming/image/background","message":"count(): Parameter must be an array or an object that implements Countable at /home/adminuser/public_html/lib/private/Memcache/Redis.php#81","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36","version":"24.0.1.1","exception":{"Exception":"Error","Message":"count(): Parameter must be an array or an object that implements Countable at /home/adminuser/public_html/lib/private/Memcache/Redis.php#81","Code":0,"Trace":[{"function":"onError","class":"OC\\Log\\ErrorHandler","type":"::"},{"file":"/home/adminuser/public_html/lib/private/Memcache/Redis.php","line":81,"function":"count"},{"file":"/home/adminuser/public_html/lib/private/Template/SCSSCacher.php","line":380,"function":"clear","class":"OC\\Memcache\\Redis","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Template/SCSSCacher.php","line":278,"function":"resetCache","class":"OC\\Template\\SCSSCacher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Template/SCSSCacher.php","line":142,"function":"variablesChanged","class":"OC\\Template\\SCSSCacher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Template/CSSResourceLocator.php","line":109,"function":"process","class":"OC\\Template\\SCSSCacher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Template/CSSResourceLocator.php","line":61,"function":"cacheAndAppendScssIfExist","class":"OC\\Template\\CSSResourceLocator","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Template/ResourceLocator.php","line":78,"function":"doFind","class":"OC\\Template\\CSSResourceLocator","type":"->"},{"file":"/home/adminuser/public_html/lib/private/TemplateLayout.php","line":342,"function":"find","class":"OC\\Template\\ResourceLocator","type":"->"},{"file":"/home/adminuser/public_html/lib/private/TemplateLayout.php","line":250,"function":"findStylesheetFiles","class":"OC\\TemplateLayout","type":"::"},{"file":"/home/adminuser/public_html/lib/private/legacy/OC_Template.php","line":185,"function":"__construct","class":"OC\\TemplateLayout","type":"->"},{"file":"/home/adminuser/public_html/lib/public/AppFramework/Http/TemplateResponse.php","line":204,"function":"fetchPage","class":"OC_Template","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/Http/Dispatcher.php","line":178,"function":"render","class":"OCP\\AppFramework\\Http\\TemplateResponse","type":"->"},{"file":"/home/adminuser/public_html/lib/private/AppFramework/App.php","line":172,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Route/Router.php","line":298,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/home/adminuser/public_html/lib/base.php","line":1023,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/home/adminuser/public_html/index.php","line":36,"function":"handleRequest","class":"OC","type":"::"}],"File":"/home/adminuser/public_html/lib/private/Log/ErrorHandler.php","Line":92,"CustomMessage":"--"},"id":"6293021a042af"}

Additional info

When I install and remove bruteforce I get these errors:

INSTALL adminuser@admin:~$ tail -f ncerrors/error.log

{"reqId":"YpMCxvoqLJ-wmESL8mCLSAAAAAY","level":3,"time":"May 29, 2022 05:21:20","remoteAddr":"XXX.XXX.XXX.XXX","user":"fathertime","app":"core","method":"GET","url":"/index.php/core/preview.png?file=/Documents/China%20Life/Clients/Akira/DO%20NOT%20DELETE/Case%20Profile.ods&c=29f2b3c96ef1882f44cf320e064dafaa&x=150&y=150","message":"OC_Image::fixOrientation(): No image loaded","userAgent":"Mozilla/5.0 (Linux) mirall/3.5.1 (build 10305) (Nextcloud, ubuntu-5.13.0-44-generic ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"24.0.1.1"} {"reqId":"xh35HKcSk4DDFZ5idcsL","level":3,"time":"May 29, 2022 05:21:31","remoteAddr":"","user":"--","app":"PHP","method":"","url":"--","message":"count(): Parameter must be an array or an object that implements Countable at /home/adminuser/public_html/lib/private/Memcache/Redis.php#81","userAgent":"--","version":"24.0.1.1","exception":{"Exception":"Error","Message":"count(): Parameter must be an array or an object that implements Countable at /home/adminuser/public_html/lib/private/Memcache/Redis.php#81","Code":0,"Trace":[{"function":"onError","class":"OC\Log\ErrorHandler","type":"::"},{"file":"/home/adminuser/public_html/lib/private/Memcache/Redis.php","line":81,"function":"count"},{"file":"/home/adminuser/public_html/lib/private/App/AppManager.php","line":451,"function":"clear","class":"OC\Memcache\Redis","type":"->"},{"file":"/home/adminuser/public_html/lib/private/App/AppManager.php","line":326,"function":"clearAppsCache","class":"OC\App\AppManager","type":"->"},{"file":"/home/adminuser/public_html/lib/private/legacy/OC_App.php","line":455,"function":"enableApp","class":"OC\App\AppManager","type":"->"},{"file":"/home/adminuser/public_html/core/Command/App/Install.php","line":97,"function":"enable","class":"OC_App","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/symfony/console/Command/Command.php","line":255,"function":"execute","class":"OC\Core\Command\App\Install","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/symfony/console/Application.php","line":1009,"function":"run","class":"Symfony\Component\Console\Command\Command","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/symfony/console/Application.php","line":273,"function":"doRunCommand","class":"Symfony\Component\Console\Application","type":"->"},{"file":"/home/adminuser/public_html/3rdparty/symfony/console/Application.php","line":149,"function":"doRun","class":"Symfony\Component\Console\Application","type":"->"},{"file":"/home/adminuser/public_html/lib/private/Console/Application.php","line":211,"function":"run","class":"Symfony\Component\Console\Application","type":"->"},{"file":"/home/adminuser/public_html/console.php","line":99,"function":"run","class":"OC\Console\Application","type":"->"},{"file":"/home/adminuser/public_html/occ","line":11,"args":["/home/adminuser/public_html/console.php"],"function":"require_once"}],"File":"/home/adminuser/public_html/lib/private/Log/ErrorHandler.php","Line":92,"CustomMessage":"--"}}

Remove adminuser@admin:~$ tail -f ncerrors/error.log

nextcloud / server