In my case, it was the reverse proxy configuration causing the problem. I forgot to set it up to forward the request IP to the Nextcloud server.
Brute force protection — Nextcloud latest Administration Manual latest documentation
My assumption is, that the client sends the credentials repeatedly, when the authentication fails (what i experience with the filemanager dolphin) and nextcloud treats these repeated attempts as brute-force attack. Thus entering the wrong password one time locks you out until you have cleared the table oc_bruteforce_attempts in whatever way. We all know, that a brute-force attack is conducted with varying passwords and login names. So how nextcloud handles the scenario with always the same wrong credentials, i would call questionable, to say at least.
To enhance nextclound in this respect, i wrote a patch, that counts several login attempts with the same credentials as one single attempt. It can be obtained from http://getwings.eu/pub/nextcloud-enhance-brute-force-29.0.2.patch . To apply, cd to the base directory of your installation. This is, where ls shows you these subentries:
3rdparty console.php index.php package-lock.json themes
apps COPYING lib public.php updater
AUTHORS core occ remote.php version.php
composer.json cron.php ocs resources
composer.lock dist ocs-provider robots.txt
config index.html package.json status.php
Assumed, “patch” and “curl” are available (if not, install them), you can run the following command after changing to the user, who owns the installation, e.g. with sudo -u www-data /bin/bash :
curl http://getwings.eu/pub/nextcloud-enhance-brute-force-29.0.2.patch | patch -p 1
(For nextcloud >= 31.0 or in general if in the file lib/private/Security/Bruteforce/Backend/DatabaseBackend.php the variable $trimmedMetaData can be found, use the file http://getwings.eu/pub/nextcloud-enhance-brute-force-31.0.3.patch)
The modification should be in effect instantly as php automatically reads the modified files. If you have concerns, you can make safety copies of the files lib/private/User/Session.php and lib/private/Security/Bruteforce/Backend/DatabaseBackend.php for the case, something fails. The patch is written for version 29.0.2.2 and whether is applies also for other versions, depends on whether there are modifications in the same parts. The patch must be applied after each software update or reinstallation, cause it is overwritten.
The two added functions are in no way dealing with the rest of the class, where i put them. They are generally applicable and should probably be better in some utilities library, but as i’m not part of the nextcloud developers, i don’t know, where it should go best. Never mind.
Nextcloud is an AGPL open source project. Have you considered submitting a PR for consideration/discussion? GitHub - nextcloud/server: ☁️ Nextcloud server, a safe home for all your data