Nc Nextcloud 18.0.0 and security scan

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face: is for home/non-enterprise users. If you’re running a business, paid support can be accessed via where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:


Or for longer, use three backticks above and below the code snippet:


Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 12.0.2):
Operating system and version (eg, Ubuntu 17.04):
Apache or nginx version (eg, Apache 2.4.25):
PHP version (eg, 7.1):

The issue you are facing:

Is this the first time you’ve seen this error? (Y/N):

Steps to replicate it:

  2. scan

The output of your Nextcloud log in Admin > Logging:


The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):


The output of your Apache/nginx/system log in /var/log/____:


ummm… what’s the exact problem here?

The problem clearly is that my isp starting to ask questions why they received some 6K emails originated from me sent via cron task to
Only thing I can link to www is the owner of the cron task that accrording to nc MUST be www.

Check the cron task and what it does - no idea why email is sent to begin with - even if the email were valid and pointed to me, I dont want emails sent to me every 15 minutes

this shows clearly that your (?) IP has a security level of A+ and runs nc v

this might belong to your other thread…

yep - did that test and shows up fine, but…?
why is my isp receiving up towards 60000 emails from me going *not to me, but to iinet

The ONLY(!) thing I managed to link is that the cron job running every 15 minutes to sync data also sends these emails out - as per mail log.

nc clearly state that this cron must(!) run as user www - The log also show this user being the one sent it and received it - and as it happen, turns out to be a valid email, so no exception is flagged.

But clearly based on my isp phoning me this morning, its cause for concern - hence me trying to track down what the hell is going on.

U want logs, ok - what logs - a repetitive log from the mail *that show exactly what I already posted every 15 minute or other logs

Happy to provide what you think you need, but considering this clearly seem to be linked to the cron job that I also provided full details on Im not sure exactly what other logs you are asking for.

Again, since the email sends, theres no issues flagged.


Perhaps you can post the content of an email.
Perhaps you can temporary switch from cron.php to AJAX to stop mailing.

I tried that, but the app keeps reverting back to cron for some reason - No idea why *only thing I can imagine is that there;s some smarts built in sensing that a scheduled cron task exists.

Reboot - Ajax shows - Once booted fully, reverts back to cron - Weird

You must edit your crontab in the linux shell and comment out or delete the */15 -entry in all crontabs. Perhaps after them restart cron or reboot. I do not know if it necessary.

Problem with posting content of email, is that the email never reach me - its sent to *i.e not me - hence iinet isp called me up today asking questions

The only thing worth noting is that and dont ask me how and why - the entire nc installation disappeared mid June *suspect it might have had to do with me upgrading from php72 to 73.
All my config stored elsewhere intact, but nc gone.
All other services still running and as such the cron tried to access /usr/local/www/nextcloud/cron.php that no longer existed.

Once restoring a working nc I hoped this issue would go away, but sadly no! ?

iinet sent me this

Cron www@nextcloud /usr/local/bin/php -f /usr/local/www/nextcloud/cron.php

Could not open input file: /usr/local/www/nextcloud/cron.php

Makes sense considering the cron.php no longer existed, but why my mail log still show references to www I started to look on logs in more details where I found these refs to that dont make sense

You can send all stuff to devnull and then perhaps there is no email.
But your cron.php not works. TEST THE CRON COMMAND ON COMMAND LINE.
You must set the correct path to “cron.php” !!!

0 5 * * * /example/script >/dev/null 2>&1

Normally not to setting to /dev/null because someone likes emails with errors.

Ok, Will try that for now - but still would like the issue identified - reverting to Ajax is not ideal and once I take down the cron I suspect the issue goes away, leaving me in darkness

Happy to pass on whatever logs you think you can make sense of though

ps. really appreciate you trying to assist with this most annoying issue

You only must find the correct command:

sudo -u www php /path/to/nextcould/cron.php

Test it from root (Debian, …) or user (Ubuntu) and if it works copy and paste it to cron-entry.
Post errors.
If correct i hope the emails disappear. Or use the /dev/null-directive but then cron.php still not works. :wink:

So crontab edited and restarted cron - will wait some 15 min and see if this sheit reappear in the mail logs

Soooo weird


but fyi - path to cron.php IS(!) correct

root@nextcloud:~ # sudo -u www php /usr/local/www/nextcloud/cron.php
PHP Warning: Version warning: Imagick was compiled against ImageMagick version 1691 but version 1690 is loaded. Imagick will run but may behave surprisingly in Unknown on line 0
root@nextcloud:~ #

This is sooo weird - edited and removed the cron task as u suggested - restarted cron - 1/2 hour later after a refresh of nc page this shows up again cron WTF???

But in saying this, the mail log does not show any activity since 10:00 PM half an hour since change

Your system can send emails to the server admin or a server user. It can contain errors or warnings, so you can redirect these e-mails to a real mail address (by default it is delivered to the local mailbox on the system). If you have a dedicated or virtual server, you can change this:

postmaster: root
webmaster: root
clamav: root

So you can add your mail address easily. Depending on an error, this can generate quite a few mails.
Other option is that Nextcloud can send out notification mails for users. This will be triggered by the cronjob. By default, the system itself tries to deliver mails, if you have a mail server installed, this is great. But in Nextcloud you can define a relay, or you can as well put such a thing on the system level such as ssmtp (which might be easier to dump or control.

Why do you send mails to, do you use this or a sudomain as your hostname?

It ends up being the same problem like the one you described in: Cron job attemtping to send email every 5 minutes

Closing here.

1 Like