Nc Nextcloud 18.0.0 and security scan

duffbeer59 · July 2, 2020, 10:41am

Support intro

Sorry to hear you’re facing problems

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can

Nextcloud version (eg, 12.0.2):
Operating system and version (eg, Ubuntu 17.04):
Apache or nginx version (eg, Apache 2.4.25):
PHP version (eg, 7.1):

The issue you are facing:

Is this the first time you’ve seen this error? (Y/N):

Steps to replicate it:

The output of your Nextcloud log in Admin > Logging:

PASTE HERE

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

PASTE HERE

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE

JimmyKater · July 2, 2020, 11:13am

ummm… what’s the exact problem here?

duffbeer59 · July 2, 2020, 12:02pm

The problem clearly is that my isp starting to ask questions why they received some 6K emails originated from me sent via cron task to www@iinet.net.au
Only thing I can link to www is the owner of the cron task that accrording to nc MUST be www.

Check the cron task and what it does - no idea why email is sent to begin with - even if the email were valid and pointed to me, I dont want emails sent to me every 15 minutes

JimmyKater · July 2, 2020, 12:22pm

this shows clearly that your (?) IP has a security level of A+ and runs nc v 19.0.0.12

this might belong to your other thread…

duffbeer59 · July 2, 2020, 1:18pm

yep - did that test and shows up fine, but…?
why is my isp receiving up towards 60000 emails from me going *not to me, but to iinet www@iinet.net.au

The ONLY(!) thing I managed to link is that the cron job running every 15 minutes to sync data also sends these emails out - as per mail log.

nc clearly state that this cron must(!) run as user www - The log also show this user being the one sent it and received it - and as it happen, turns out to be a valid email, so no exception is flagged.

But clearly based on my isp phoning me this morning, its cause for concern - hence me trying to track down what the hell is going on.

U want logs, ok - what logs - a repetitive log from the mail *that show exactly what I already posted every 15 minute or other logs

Happy to provide what you think you need, but considering this clearly seem to be linked to the cron job that I also provided full details on Im not sure exactly what other logs you are asking for.

Again, since the email sends, theres no issues flagged.

regards

devnull · July 2, 2020, 1:32pm

Perhaps you can post the content of an email.
Perhaps you can temporary switch from cron.php to AJAX to stop mailing.

duffbeer59 · July 2, 2020, 1:44pm

I tried that, but the app keeps reverting back to cron for some reason - No idea why *only thing I can imagine is that there;s some smarts built in sensing that a scheduled cron task exists.

Reboot - Ajax shows - Once booted fully, reverts back to cron - Weird

devnull · July 2, 2020, 1:45pm

You must edit your crontab in the linux shell and comment out or delete the */15 -entry in all crontabs. Perhaps after them restart cron or reboot. I do not know if it necessary.

duffbeer59 · July 2, 2020, 1:52pm

Problem with posting content of email, is that the email never reach me - its sent to *i.e not me - hence iinet isp called me up today asking questions

The only thing worth noting is that and dont ask me how and why - the entire nc installation disappeared mid June *suspect it might have had to do with me upgrading from php72 to 73.
All my config stored elsewhere intact, but nc gone.
All other services still running and as such the cron tried to access /usr/local/www/nextcloud/cron.php that no longer existed.

Once restoring a working nc I hoped this issue would go away, but sadly no! ?

iinet sent me this

Cron www@nextcloud /usr/local/bin/php -f /usr/local/www/nextcloud/cron.php

Could not open input file: /usr/local/www/nextcloud/cron.php

Makes sense considering the cron.php no longer existed, but why my mail log still show references to www I started to look on logs in more details where I found these refs to that dont make sense

devnull · July 2, 2020, 1:56pm

You can send all stuff to devnull and then perhaps there is no email.
But your cron.php not works. TEST THE CRON COMMAND ON COMMAND LINE.
You must set the correct path to “cron.php” !!!

0 5 * * * /example/script >/dev/null 2>&1

http://www.auxnet.org/index.php/the-news/228-stop-cron-daemon-from-sending-email-for-each-job

Normally not to setting to /dev/null because someone likes emails with errors.

duffbeer59 · July 2, 2020, 1:58pm

Ok, Will try that for now - but still would like the issue identified - reverting to Ajax is not ideal and once I take down the cron I suspect the issue goes away, leaving me in darkness

Happy to pass on whatever logs you think you can make sense of though

ps. really appreciate you trying to assist with this most annoying issue

devnull · July 2, 2020, 2:02pm

You only must find the correct command:

sudo -u www php /path/to/nextcould/cron.php

Test it from root (Debian, …) or user (Ubuntu) and if it works copy and paste it to cron-entry.
Post errors.
If correct i hope the emails disappear. Or use the /dev/null-directive but then cron.php still not works.

duffbeer59 · July 2, 2020, 2:04pm

So crontab edited and restarted cron - will wait some 15 min and see if this sheit reappear in the mail logs

Soooo weird

duffbeer59 · July 2, 2020, 2:07pm

ok,

but fyi - path to cron.php IS(!) correct

duffbeer59 · July 2, 2020, 2:22pm

root@nextcloud:~ # sudo -u www php /usr/local/www/nextcloud/cron.php
PHP Warning: Version warning: Imagick was compiled against ImageMagick version 1691 but version 1690 is loaded. Imagick will run but may behave surprisingly in Unknown on line 0
root@nextcloud:~ #

duffbeer59 · July 2, 2020, 2:34pm

This is sooo weird - edited and removed the cron task as u suggested - restarted cron - 1/2 hour later after a refresh of nc page this shows up again cron WTF???

duffbeer59 · July 2, 2020, 2:38pm

But in saying this, the mail log does not show any activity since 10:00 PM half an hour since change

tflidd · July 5, 2020, 12:33pm

Your system can send emails to the server admin or a server user. It can contain errors or warnings, so you can redirect these e-mails to a real mail address (by default it is delivered to the local mailbox on the system). If you have a dedicated or virtual server, you can change this:
/etc/aliases:

postmaster: root
webmaster: root
clamav: root
root: mail@example.com

So you can add your mail address easily. Depending on an error, this can generate quite a few mails.
Other option is that Nextcloud can send out notification mails for users. This will be triggered by the cronjob. By default, the system itself tries to deliver mails, if you have a mail server installed, this is great. But in Nextcloud you can define a relay, or you can as well put such a thing on the system level such as ssmtp (which might be easier to dump or control.

Why do you send mails to iinet.net.au, do you use this or a sudomain as your hostname?

tflidd · July 5, 2020, 1:05pm

It ends up being the same problem like the one you described in: Cron job attemtping to send email every 5 minutes

Closing here.