Core: ownCloud {core} Login failed: '[email protected]' (Remote IP: 'x.x.x.x')

[brianjmurrell]

Steps to reproduce

1. Unknown
   2.
   3.

Expected behaviour

I shouldn't get sporadic login errors

Actual behaviour

I get sporadic login errors of the form:

ownCloud {core} Login failed: '[email protected]' (Remote IP: 'x.x.x.x')

Note however that these are only sporadic and that generally, from the client that makes Owncloud produce the above errors, everything works, so the client is configured correctly.

I have also logged the password being given to checkPassword() when this is logged and it is correct.

Server configuration

Operating system:
CentOS Linux 7.completely.up.to.date

Web server:
Apache

Database:
MySQL

PHP version:
5.4.16

ownCloud version: (see ownCloud admin page)
9.1.5

Updated from an older ownCloud or fresh install:
Updated

Where did you install ownCloud from:
EPEL

Signing status (ownCloud 9.0 and above):

Integrity checker has been disabled. Integrity cannot be verified.

The content of config/config.php:

Log in to the web-UI with an administrator account and click on
'admin' -> 'Generate Config Report' -> 'Download ownCloud config report'
This report includes the config.php settings, the list of activated apps
and other details in a well sanitized form.

Produced an empty file

List of activated apps:
Contacts
Calendar

Are you using external storage, if yes which one: local/smb/sftp/...
No

Are you using encryption: yes/no
No

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
No

Client configuration

Browser:
N/A
Using Davdroid

Operating system:
Android

Logs

Web server error log

It's empty

ownCloud log (data/owncloud.log)

Only contains the above error string

Browser log

N/A

[PVince81]

Which client is causing this ? Only davdroid or any client ?

[brianjmurrell]

I can't really say for sure. Given the nature of the debugging that I have done, I would say that any client could trigger the bug, but since I only use davdroid, that's all I can confirm for sure.

[karakayasemi]

By default, owncloud does not allow login with e-mail, If a user try to login with e-mail, loginController firstly trying to login by using email as username and giving this error. The LoginController tries to get the username with the getByEmail function after the first unsuccessful attempt. If function returns a user it tries second login attempts with username and password.
IMHO, these logs are created by the first login attempt with email.

[brianjmurrell]

I have changed my DavDroid configuration to use the bare username (i.e. LHS of my e-mail address). We'll see if these errors go away now.

[karakayasemi]

If you use username probably it will disappear. But maybe still we need to refactor auth logic. We are logging two times when failed login attempts with e-mail. One of them for only e-mail, other is for the username. Every time even successful login attempts, when a user used email in login, we are logging one time failed login attempt. For example, followings are logs for only one unsuccessful attempt with email, first one for email, other one is for username:

{"reqId":"u3JkCI4HpYFVNxN0sreu","level":2,"time":"2017-07-04T12:43:18+00:00","remoteAddr":"192.168.157.1","user":"--","app":"core","method":"POST","url":"\/core\/index.php\/login","message":"Login failed: '[email protected]' (Remote IP: '192.168.157.1')"}
{"reqId":"u3JkCI4HpYFVNxN0sreu","level":2,"time":"2017-07-04T12:43:19+00:00","remoteAddr":"192.168.157.1","user":"--","app":"core","method":"POST","url":"\/core\/index.php\/login","message":"Login failed: 'ocadmin' (Remote IP: '192.168.157.1')"}

[karakayasemi]

@brianjmurrell any update?

[brianjmurrell]

Seems like that might have made the problem go away.

Any reason to not just s/@.*$// from login names?

[karakayasemi]

No problem with the characters. The only problem occurs when login username matches with any user's email address.

[brianjmurrell]

Ahhh. Reading back, I see what you are saying...

If a user try to login with e-mail, loginController firstly trying to login by using email as username and giving this error. The LoginController tries to get the username with the getByEmail function after the first unsuccessful attempt. If function returns a user it tries second login attempts with username and password.

So when the login string matches the pattern /.+@.+\..+$/ why not skip the first login attempt and jump directly to trying to find the user by e-mail address?

You could probably even refine the RE to be more strict about matching legal domain names on the RHS of the @.

[karakayasemi]

I am willing to refactor loginController if we plan such things.

[karakayasemi]

Somehow we need to try only one login attempt to prevent unnecessary failed login log.
Maybe first we can check is user input a valid email. If it is we can try to call getByEmail function. If its output count greater than 0, we can try just login with email address user. If these conditions are not met, we can just try to login with original user input

[individual-it]

the username itself can look like an email address but in that case the user name login must be performed

[karakayasemi]

It does not create any problem unless if a user's uid is the same as another user's email. We will try email login if only getByEmail function output count greater than 0.

[ownclouders]

Hey, this issue has been closed because the label needs info is set and there were no updates for 14 days. Feel free to reopen this issue if you deem it appropriate.

[karakayasemi]

As far as I know, this issue is still exist.

[brianjmurrell]

As far as I know, this issue is still exist.

Indeed. I see I answered the question but nobody removed the _needs info_ label.

[ownclouders]

Hey, this issue has been closed because the label status/STALE is set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.

(This is an automated comment from GitMate.io.)

[brianjmurrell]

This needs to be reopened. AGAIN. I don't see any comments or patch links that suggest that this issue has been fixed.

This automatic closing of tickets just because nobody has had time to fix them is annoying. This is the second time this has happened to this ticket. Just because an issue has not had the resources applied to it to be fixed doesn't mean it magically went away.

Can somebody who has authority to do so, please reopen this and leave it reopened until it gets fixed?

[ownclouders]

Hey, this issue has been closed because the label status/STALE is set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.

(This is an automated comment from GitMate.io.)

[DeepDiver1975]

We did add some fixes to the prevent unexpected 'Login failed' log entries. These fixes live in 10.0.7 which was released just this week. Any chance to update and give it a try?

Please note that 9.1 will receive it's last minor release these day and then the 9.1 series is EOL.

[karakayasemi]

I can still reproduce the problem with current core master branch. The problem is different than recent changes. If you try to log in with your e-mail address, we are generating at least 1 redundant failed login log entry in this line https://github.com/owncloud/core/blob/master/core/Controller/LoginController.php#L201, even it is a successful attempt. Because we do not distinguish e-mail address and username in trying to log in. First, LoginController is trying to log in with the username and if it fails, it is attempting one more login with the e-mail address.

[DeepDiver1975]

THX @karakayasemi - I see your point now. No idea on how to address this.
Ideas are welcome!

[karakayasemi]

Somehow we need to try only one login attempt to prevent unnecessary failed login log. As an easy hack, If the username input string matches the mail address format and a user with this mail address exists, we can try to login with the mail address. If these conditions not met, we can try to login with username.
The only problem that I see in this solution, maybe a username can be same with another user e-mail address. In that case, username login never occurs. But, IMHO it is a small possibility.

[ownclouders]

Hey, this issue has been closed because the label status/STALE is set and there were no updates for 7 days. Feel free to reopen this issue if you deem it appropriate.

(This is an automated comment from GitMate.io.)

[andrescarrasco]

I am also experiencing this issue, but I don't get it at login. I get it while syncing files with the windows desktop client, apparently for each request that is being authenticated, I get a login failed message.

I am running version 10.0.7.2
with the desktop client 2.4.1 (build 9270)

For authentication the app password is being utilized.

{"reqId":"4792bf79-e77f-47bd-b814-16f3b7d5f736","level":2,"time":"2018-04-19T17:12:13+00:00","remoteAddr":"fe80::XXXX:XXXX:XXXX:XXXX","user":"kof","app":"core","method":"PROPFIND","url":"\/owncloud\/remote.php\/dav\/files\/kof\/raft\/simpleRaft-master\/simpleRaft","message":"Login failed: 'kof' (Remote IP: 'fe80::XXXX:XXXX:XXXX:XXXX')"}

{"reqId":"ecae8d4f-961a-4742-8732-41b2657f90ec","level":2,"time":"2018-04-19T17:12:18+00:00","remoteAddr":"fe80::XXXX:XXXX:XXXX:XXXX","user":"kof","app":"core","method":"PROPFIND","url":"\/owncloud\/remote.php\/dav\/files\/kof\/raft\/simpleRaft-master\/simpleRaft\/boards","message":"Login failed: 'kof' (Remote IP: 'fe80::XXXX:XXXX:XXXX:XXXX')"}

[djgrubson]

same problem here we cannot login in to GUI at all
{"reqId":"cuffTIUiLGzN3QYKJGqr","level":2,"time":"2018-06-26T22:51:05+00:00","remoteAddr":"x.x.x.x","user":"chris","app":"core","method":"GET","url":"\/apps\/files\/","message":"Login failed: 'owncloud' (Remote IP: 'xx.xx.xx.xx')"} {"reqId":"cuffTIUiLGzN3QYKJGqr","level":2,"time":"2018-06-26T22:51:06+00:00","remoteAddr":"xx,xx,xx,xx,","user":"--","app":"core","method":"GET","url":"\/apps\/files\/","message":"Login failed: 'owncloud' (Remote IP: 'xx.xx.xx.xx)"}
is there an update or fix for this problem it stopping us from using owncloud?

my vers is 10.0.8-1+1.1

[PVince81]

Can you guys who are still having the error confirm that you are using database users and logging in with email address ? This would align with https://github.com/owncloud/core/issues/28234#issuecomment-369550108

[PVince81]

@djgrubson the bug above is only about bad login entries in the log, not about being unable to log in at all. Please raise a separate ticket with your environment details as it's likely a different issue.

Same applies for anyone here who cannot login at all, not just having the log filled with entries but being able to login.

This will help better analyze the issue without getting into misunderstandings due to talking about different issues. Thanks

[PVince81]

also important to mention in your env, whether you are using fail2ban based on scanning for such entries, in which case bogus entries could prevent a login if they happen too often

[djgrubson]

@PVince81 I have stopped fail2ban and now can login in into UI, thanks for pointing this out.
Thanks for help all.

[djgrubson]

I also had auth_basic enabled in nginx which I heard doesn’t really work well with owncloud?