Linux sync client keeps failing to login every 30 minutes, cannot uninstall

Hola, Nextcoud community,

Nextcloud version 15.0.2)
Server Operating system and version Ubuntu 18.04 (on vultr VPS):
Client Operating system and version Pop!-OS 18.10 (self-installed on non-System76 laptop):
Apache version 2.4.29 (Ubuntu):
PHP version 7.2:

My issue:

Installed Nextcloud sync client on a Linux laptop (running Pop!-OS – System76’s tweaked version of Ubuntu). Got it set up and working, no issues. Days (weeks?) later, I finally noticed constant failed login attempts in my NC log … may have started immediately upon my sync client install, maybe later.

All failed logins are coming for my NC admin user, from my laptop’s IP address. I get anywhere from 1-4 login attempts at a time, every 10, 12, 15, or 20 minutes, but most commonly, every 30 minutes.

This behavior stops when I turn off the laptop, or disconnect it from the Internet (duh), but nothing else seems to stop it. I have now uninstalled and purged the Nextcloud sync client from that laptop … and it is still doing it.

There is a Nextcloud GUI sync connection wizard that keeps randomly popping up on the laptop screen, inviting me to connect to either my own, or a publicly hosted, NC instance … I have no idea where this wizard is coming from, nor how it got installed, nor how to remove it. I also don’t actually know if it is the culprit for the continuous failed login attempts – just assuming it’s the guilty party at this point.

I have multiple other sync clients working just fine with my NC instance, running on Linux Mint and on mobile (custom Android ROM) … though no other instances of Pop!.

Thoughts? Thanks in advance.

Is this the first time you’ve seen this error? Yes:

Steps to replicate it:

  1. Turn on laptop.
  2. Wait up to 30 minutes.

The output of your Nextcloud log in Admin > Logging:

{"reqId":"12345678987654321","level":2,"time":"2019-03-28T12:30:53+00:00","remoteAddr":"99.99.99.99","user":"--","app":"core","method":"GET","url":"/remote.php/webdav/","message":"Login failed: 'caretaker' (Remote IP: '99.99.99.99')","userAgent":"--","version":"15.0.2.0","id":"123456789"}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):
Skipping this ... pretty sure this is clientside issue, but I can add it if you like.

The output of your Apache/nginx/system log in /var/log/____:
Skipping this, too, for now. 1) it's huge, and 2) I looked through it, and I'm not seeing any kind of relevant log entries on/about the time of the failed login attempts (and nothing at all in the error.log) -- although, y'know, I may just not understand what I'm looking at. Ask me if you think this is needed, and I'll post it.

Did you do:
sudo apt list cache next*
If not, do it and if anything shows up do a sudo apt purge.

1 Like

Thank you @peteman52 … I’m not familiar with this “list cache” option in apt, quick web search does not enlighten me (all I’m getting is apt-cache info).

I ran it, and yes, several things show up, but none of them are eligible for purge … at least, that’s what apt-get purge tells me. Curiously, my Linux Mint system does not recognize that command at all … is this newer than Ubuntu 14.04, or is it Pop!-OS specific?

Additionally, the things that show up have (to me, at least) weird formatting … not sure what to make of them. What exactly am I supposed to purge? Here’s what I get–

nextcloud-client-caja/cosmic,cosmic 2.5.2-20190319.015224~cosmic1 all
nextcloud-client-dolphin/cosmic 2.5.2-20190319.015224~cosmic1 amd64
nextcloud-client-dolphin/cosmic 2.5.2-20190319.015224~cosmic1 i386
nextcloud-client-l10n/cosmic,cosmic 2.5.2-20190319.015224~cosmic1 all
nextcloud-client-nautilus/cosmic,cosmic 2.5.2-20190319.015224~cosmic1 all
nextcloud-client-nemo/cosmic,cosmic 2.5.2-20190319.015224~cosmic1 all
nextcloud-client/cosmic 2.5.2-20190319.015224~cosmic1 amd64
nextcloud-client/cosmic 2.5.2-20190319.015224~cosmic1 i386

Seems like you have me on the right track; can you lead me a little bit further?

Thanx

My mistake. It is
sudo apt-get purge
If the conduct of your Nextcloud client is as you describe I would do a
sudo apt-get purge next*
and then install it new.
I suppose that you don’t need the 32-bit libraries (those with i386).
To prevent that those are installed you have to go to
/etc/apt/sources.list.d
and edit the file nextcloud<something>.list:
deb [arch=amd64] http…

1 Like

No, @peteman52 , that gets me back to Square One. I did exactly that, “sudo apt-get purge next*” yesterday. Should be all gone, I thought. I do get a long list of line-items like this:

‘package nextcloud-client-caja is not installed, so not removed.’

So something Nextcloud-y is obviously still installed on the machine, trying to log in to my server instance, 2+ times per hour.

Are you saying I need to reinstall it, as well? Seems like the purge should have completely removed everything, but clearly that’s not the case. What don’t I understand about apt-get purge?

thanx

You should only reinstall it if you want to use the Nextcloud-client.
If you did a “sudo apt-get purge next*” then you shouldn’t get a list with the “apt list cache” command???

1 Like

Yeah … and yet I do.

I’d be perfectly happy to reinstall it if I can get it working correctly, w/o the constant ghost-login attempts. Uninstalling it was just my last-ditch nuclear option to resolve that issue … except even that failed to stop it.

So again, thanks for trying. I guess I’ll just leave this thread here for now, see if anyone else has any ideas?

thanx,
rich

You could still do a
sudo apt list --installed|grep next

If nothing shows up, nothing is installed and you may install new.
Otherwise do a “apt-get purge” for the shown packets

1 Like

Same issue, I guess. “sudo apt list --installed|grep next” showed a list of packages, but when I tried to remove or purge them, it says they don’t exist, and there’s nothing to remove.

I just removed the nextcloud-dev/client ppa … that seemed to help. I was able to purge / update / upgrade / autoclean & autoremove a bunch of stuff … and now, apt swears to God that there is nothing “nextcl*” on my machine, at all.

But guess what? It’s still trying to log into my NC server. Seriously, WTF? I’m beginning to think I’ve got some kind of weird virus/malware thing going on here.

If nothing Nextcloud-y shows up in ps -A, I would indeed start looking for some other process.

I’ve never used POP!, but they seem to have GNOME Desktop as the default. This makes the likely culprit, in my mind, GNOME Online Accounts. If you’ve got it set up to sync your contacts or calendar, that could certainly be the cause of this behavior.
You can find Online Accounts in the GNOME Settings app. Assuming your Nextcloud account is configured there, they have controls for removing or disabling it.

Thank you, @mactrent , nothing ‘Nextcloud-y’ comes up in ps -A. Past my bedtime now, so I will revisit this in the morning. Please check back tomorrow, if/when you have time.

r

So, I got this figured out, and then sloppily never came back here to close out the thread.

The issue was in fact, GNOME-specific. I now forget the exact function, but GNOME has an automated account login feature, and apparently, the first time I tried to connect my Nextcloud client sync utility to my Nextcloud server, I used the wrong password … and that’s the one GNOME memorized, and continued to use to try re-logging in, roughly every 30 minutes … forever.

The solution was to find this GNOME auto-login service, find that specific login entry, and kill it. Nothin’ to do with Nextcloud.

Belated thanx again.

1 Like