Nextcloud Snap - how to check for login attempts?

[YamiYukiSenpai]

I’m curious to know if anyone else has been trying to log into my Nextcloud

[jtr]

Well, there’s your Nextcloud logs.

Admin → Logging

[ernolf]

@jtr

Admin → Logging

Afaik, login attempts are not logged in nextcloud server log.

@YamiYukiSenpai

if anyone else has been trying to log into my Nextcloud

you must activate the audit logfile (as a file, not in syslog). Then you can monitor all login attempts with a jq-filter:

tail -F /path/to/audit.log | jq -r 'select(.message | test("Login|Logout")) | [.time, .remoteAddr, .user, .method, .url, .message, .userAgent] | join(" - ")'

Here I explained it more in deep:

Is there any admin_audit parameter to filter or limit events to be logged?

The audit.log is, as the nextcloud.log in json format. The great thing about json is its filterability. The command-line JSON processor jq is needed for this. Here some examples: Follow the audit.log in a compact format, beginning with the last 100 lines: tail -Fn 100 /path/to/audit.log | jq -r '[.time, .remoteAddr, .user, .method, .url, .message, .userAgent] | join(" - ")'" tail -F /path/to/audit.log | jq -r 'select(.message | test("Login|Logout")) | [.time, .remoteAddr, .user, .method, …

Much luck,
ernolf

[YamiYukiSenpai]

strange thing.

My Snap autoupdated today to 29.0.4snap2. I’m currently at my work, and don’t have access to the server.

I’m seeing “We have detected multiple invalid login attempts” on the login page. Right now, I can’t login via web browser, but I can still access the app from my iPhone just fine.

I tried to use VPN on my Steam Deck and disable my WiFi on my phone to make sure that I’m using 5G (and get different public IP), but I’m still seeing that error.

29.0.2snap2 was fine and I didn’t experience any issues.

Did something happened?

[scubamuc]

@YamiYukiSenpai

29.0.2snap2 was fine and I didn’t experience any issues.

Did something happened?

the issue you are describing is certainly not an autoupdate issue. depending on which apps are enabled… I’m guessing ‘suspicious login app’ you may want to double check on that and whitelist your “work” IP.

you may want to try disabling the app

but without information about your system, we’re all poking around in the dark. please consider raising an issue here and run the debugging script before raising an issue

[YamiYukiSenpai]

weird thing is that it wasn’t tied to my work IP

It happened on 5G, Proton VPN, Private Internet Access VPN and home network.

It did disappear after 24h so I didn’t revert anything