search

nextcloud / suspicious_login

Detect and warn about suspicious IPs logging into Nextcloud
GNU Affero General Public License v3.0
84 stars 25 forks source link

Server Internal Error - users completely locked out #556

Closed Githopp192 closed 2 years ago

Githopp192 commented 2 years ago

Actual behaviour

Some user reported - they are not able to login via WEB anymore. They got "Server internal error" message.

Steps to reproduce

Users did try to logon several times - login not possbile anymore. Locked out

After disabling suspicous_login - the users could login again and server internal error gone

Expected behaviour

Nextcloud proudly praises of the many apps that are available. On the other hand, these apps should not interfere with the core function to the detriment of the cloud stability in general.

app errors

ScreenShot271

Client configuration details

--------------------------------

Winows 10, Mac & ore

Server configuration details

Version: Intel(R) Xeon(R) E-2136 CPU @ 3.30GHz Max Speed : 4300 MHz Current Speed: 3300 MHz Memory: 16GB

Operating System: CentOS Linux release 8.4.2105

Upstream OS : Derived from Red Hat Enterprise Linux 8.4

Webserver: Apache/2.4.37 (centos)

Database: mysql 10.3.28-MariaDB,

PHP version: PHP Version => 7.4.25

[PHP Modules] apcu bcmath bz2 calendar Core ctype curl date dom exif fileinfo filter ftp gd gettext gmp hash iconv igbinary imagick intl json ldap libsmbclient libxml mbstring memcached msgpack mysqli mysqlnd openssl pcntl pcre PDO pdo_mysql pdo_sqlite Phar posix readline redis Reflection session shmop SimpleXML smbclient sockets sodium SPL sqlite3 standard sysvmsg sysvsem sysvshm tokenizer xml xmlreader xmlwriter xsl Zend OPcache zip zlib

[Zend Modules] Zend OPcache

Nextcloud: - version: 21.0.5.1

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from:

Signing status:

Login as admin user into your Nextcloud and access http://example.com/index.php/settings/integrity/failed paste the results here.

No errors have been found. { "system": { "memcache.distributed": "\OC\Memcache\Redis", "memcache.locking": "\OC\Memcache\Redis", "memcache.local": "\OC\Memcache\APCu", "filelocking.enabled": true, "redis": { "host": "REMOVED SENSITIVE VALUE", "port": 0, "dbindex": 0, "timeout": 1.5, "password": "REMOVED SENSITIVE VALUE" }, "passwordsalt": "REMOVED SENSITIVE VALUE", "secret": "REMOVED SENSITIVE VALUE", "trusteddomains": [ ], "datadirectory": "REMOVED SENSITIVE VALUE", "htaccess.RewriteBase": "\/", "overwriteprotocol": "https", "dbtype": "mysql", "version": "21.0.5.1", "dbname": "REMOVED SENSITIVE VALUE", "dbhost": "REMOVED SENSITIVE VALUE", "dbport": "", "dbtableprefix": "oc", "mysql.utf8mb4": true, "dbuser": "REMOVED SENSITIVE VALUE", "dbpassword": "REMOVED SENSITIVE VALUE", "installed": true, "maintenance": false, "theme": "", "loglevel": 2, "auth.bruteforce.protection.enabled": true, "check_for_working_htaccess": true, "updater.release.channel": "stable", "logfile": "\/media\/log\/nextcloud.log", "instanceid": "REMOVED SENSITIVE VALUE", "mail_from_address": "REMOVED SENSITIVE VALUE", "mail_smtpmode": "xxxx", "mail_smtpauthtype": "LOGIN", "mail_domain": "REMOVED SENSITIVE VALUE", "mail_smtpsecure": "tls", "mail_smtpauth": 1, "mail_smtpname": "REMOVED SENSITIVE VALUE", "mail_smtppassword": "REMOVED SENSITIVE VALUE", "mail_smtphost": "REMOVED SENSITIVE VALUE", "mail_smtpport": "xxxxx", "session_lifetime": xxxx, "session_keepalive": false, "default_phone_region": "xxxx", "knowledgebaseenabled": false, "log_rotate_size": 3145728, "mail_sendmailmode": "smtp", "app_install_overwrite": [ "passman", "dicomviewer", "radio", "cookbook", "health" ] },

Enabled:

ChristophWurst commented 2 years ago

Sounds like a dependency conflict with the Flysystem library

Githopp192 commented 2 years ago

Sounds like a dependency conflict with the Flysystem library

yes, i do like the appropr. FlySystem :-)

How we can troubleshoot this?

ChristophWurst commented 2 years ago

There must be at least one other app shipping a incompatible version of https://packagist.org/packages/league/flysystem. You could search your apps/ directory for paths like league/flysystem.

Githopp192 commented 2 years ago

Christoph .. first time after reading "flysystem" i thought, you have made a typo. After you did repeat "flysystem", i realized - ok, seems to be something behind the story :-)

That's what the search found:

nextclod# find . -name 'flysystem'

./nextcloud/3rdparty/league/flysystem ./nextcloud/apps/files_external_onedrive/vendor/hevelius/flysystem-onedrive ./nextcloud/apps/files_external_onedrive/vendor/league/flysystem ./nextcloud/apps/files_external_onedrive/vendor/league/flysystem-cached-adapter

Is ONEDRIVE one of the culprits (i almost knew, that microsoft has got their fingers in). ?

ChristophWurst commented 2 years ago

Then this is even a known issue: https://github.com/nextcloud/suspicious_login/issues/509#issuecomment-883790040 ;)