Admin Notification for failed login

🍱 Features & apps
1

Is there an Option to get notified by email if someone tried to login several times with wrong credentials? Or to get an Email for Errors in logging?

2

If it’s a public server you’re going to get spammed to death :laughing:

I don’t know of a native option, but there may be an app.

3

If you have shell access you could write an inotify script to send you an email, like (untested):

while inotifywait -e modify /var/www/html/data/nextcloud.log; do
    failed_message=$(tail -n1 /var/www/html/data/nextcloud.log|grep "Login failed")
    if [[ $failed_message ]]; then
        echo "Login failure: $failed_message"|mail -s "Login Failure on Nextcloud" [your_email]
    fi
done
1 Like
4

I thought about the blocked bruteforce attempts. When a user/ip gets blocked => notification to admins

5

I use Nagios with check_logfiles for this job and get alerts for both failed and successful logins:

$seekfilesdir   = '/var/lib/naemon/check_logfiles/nextcloud';
$protocolsdir   = '/var/lib/naemon/check_logfiles/nextcloud';
$options        = 'report=long';

@searches       = ({
        logfile         => '/var/www/html/nextcloud/data/nextcloud.log',
        rotation        => 'loglog0log1',

        criticalpatterns => [
                'Login failed',
        ],

        warningpatterns => [
                'Login attempt',
                'Login successful',
                'Logout occurred',
        ],

        criticalexceptions => [
        ],

       # Some exceptions, if needed:
        warningexceptions => [
                'remoteAddr.*12\.34\.', 
                'user.*foobar.*admin_audit.*\(Android\) ownCloud-android.*13\.0\.1\.1',

        ],
});