Hello, everyone!
We have got nextcloud server with users of our mail server (via LDAP). To avoid brute force attacks we installed fail2ban with filter “Login failed” on nextcloud.log. But Linux and Android clients send many messages with “Login failed” in nextcloud.log such as:
{“reqId”:“i9O9FvJFykbG/AxIt+IP”,“remoteAddr”:“10.1.1.65”,“app”:“core”,“message”:“Login failed: ‘epopova’ (Remote IP: ‘10.1.1.65’)”,“level”:2,“time”:“2017-05-17T05:58:27+00:00”,“method”:“PROPFIND”,“url”:"/remote.php/dav/files/epopova/",“user”:“epopova”,“version”:“11.0.3.2”}
As a result IP adress is blocked.
Nextcloud version : 11.0.3.2 (the same was on 11.0.2)
Operating system and version : Debian 8.7
Apache version : 2.4.10
PHP version: 7.0