Nextcloud won't accept passwords

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 12.0.2): 17.0.1
Operating system and version (eg, Ubuntu 17.04): Arch Linux
Apache or nginx version (eg, Apache 2.4.25): 2.4.41
PHP version (eg, 7.1): 7.2

The issue you are facing:

I upgraded from Nextcloud production 16.0.6 (I think) to Nextcloud stable 17.0.1 as provided by my package manager. I want to get updates together with my system updates and so on.

Everything works fine, but, however, no login password works anymore. I have tried this for several user accounts, some passwords I had even saved in keepass. But all passwords are rejected.

How is that happening? Is there a way to restore the old passwords, as I guess their hashes are still in the database, just invalidated somehow. Is there a way to check that? It would be a pity if I had to assign new passwords to each user.

In the nextcloud log, I get a warning about a bruteforce attempt, even if I cleared the oc_bruteforce_attempt table before.

Any ideas are very appreciated. Thanks in advance!

Is this the first time you’ve seen this error? (Y/N): Y

Steps to replicate it:

I can’t state replicatability, as I can’t downgrade and then do the upgrade again

output of your Nextcloud log in Admin > Logging:

{"reqId":"M7h3HIG2jC6ueUJUXrhK","level":2,"time":"2019-12-16T21:05:59+00:00","remoteAddr":"217.83.83.199","user":"--","app":"no app in context","method":"POST","url":"\/nextcloud\/index.php\/login","message":"Login failed: ipad (Remote IP: 217.83.83.199)","userAgent":"Mozilla\/5.0 (X11; Linux x86_64; rv:71.0) Gecko\/20100101 Firefox\/71.0","version":"17.0.1.1"}
{"reqId":"M7h3HIG2jC6ueUJUXrhK","level":1,"time":"2019-12-16T21:05:59+00:00","remoteAddr":"217.83.83.199","user":"--","app":"core","method":"POST","url":"\/nextcloud\/index.php\/login","message":"Bruteforce attempt from \"217.83.83.199\" detected for action \"login\".","userAgent":"Mozilla\/5.0 (X11; Linux x86_64; rv:71.0) Gecko\/20100101 Firefox\/71.0","version":"17.0.1.1"}

{"reqId":"oa58MLBrujRsxUTvaSlT","level":2,"time":"2019-12-16T21:08:11+00:00","remoteAddr":"134.99.174.1","user":"--","app":"no app in context","method":"POST","url":"\/nextcloud\/index.php\/login","message":"Login failed: ipad (Remote IP: 134.99.174.1)","userAgent":"Mozilla\/5.0 (X11; Linux x86_64; rv:71.0) Gecko\/20100101 Firefox\/71.0","version":"17.0.1.1"}
{"reqId":"oa58MLBrujRsxUTvaSlT","level":1,"time":"2019-12-16T21:08:11+00:00","remoteAddr":"134.99.174.1","user":"--","app":"core","method":"POST","url":"\/nextcloud\/index.php\/login","message":"Bruteforce attempt from \"134.99.174.1\" detected for action \"login\".","userAgent":"Mozilla\/5.0 (X11; Linux x86_64; rv:71.0) Gecko\/20100101 Firefox\/71.0","version":"17.0.1.1"}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'instanceid' => 'xxxxx',
  'passwordsalt' => 'xxxxx',
  'secret' => 'xxxxx',
  'trusted_domains' => 
  array (
    0 => '192.168.2.101',
    1 => 'xxxxx',
  ),
  'datadirectory' => '/usr/share/webapps/nextcloud/data',
  'overwrite.cli.url' => 'xxxxx',
  'dbtype' => 'mysql',
  'version' => '17.0.1.1',
  'dbname' => 'nextcloud',
  'dbhost' => 'xxxxx',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'nextcloud',
  'dbpassword' => 'xxxxx',
  'installed' => true,
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'mail_smtpmode' => 'smtp',
  'mail_smtpauthtype' => 'LOGIN',
  'mail_from_address' => 'xxxxx',
  'mail_domain' => 'xxxxx',
  'mail_smtpsecure' => 'tls',
  'mail_smtpauth' => 1,
  'mail_smtphost' => 'xxxxx',
  'mail_smtpport' => '587',
  'mail_smtpname' => 'xxxxx',
  'mail_smtppassword' => 'xxxxx',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/usr/share/webapps/nextcloud/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/usr/share/webapps/nextcloud/apps2',
      'url' => '/apps2',
      'writable' => true,
    ),
  ),
  'loglevel' => 0,
  'maintenance' => false,
  'updater.release.channel' => 'stable',
  'theme' => '',
);

The output of your Apache/nginx/system log in /var/log/____:

134.99.174.1 - - [16/Dec/2019:22:17:43 +0100] "POST /nextcloud/index.php/login HTTP/1.1" 303 -
134.99.174.1 - - [16/Dec/2019:22:17:43 +0100] "GET /nextcloud/index.php/login?user=ipad HTTP/1.1" 200 12541
134.99.174.1 - - [16/Dec/2019:22:17:44 +0100] "GET /nextcloud/apps/files_pdfviewer/css/style.css?v=ca9f0d77-0 HTTP/1.1" 200 346
134.99.174.1 - - [16/Dec/2019:22:17:44 +0100] "GET /nextcloud/core/css/guest.css?v=9b96d7f1-0 HTTP/1.1" 200 19902
134.99.174.1 - - [16/Dec/2019:22:17:44 +0100] "GET /nextcloud/index.php/apps/theming/styles?v=0 HTTP/1.1" 200 987
134.99.174.1 - - [16/Dec/2019:22:17:44 +0100] "GET /nextcloud/core/img/favicon.ico HTTP/1.1" 200 3262
134.99.174.1 - - [16/Dec/2019:22:17:44 +0100] "GET /nextcloud/core/img/favicon-touch.png HTTP/1.1" 200 2918
134.99.174.1 - - [16/Dec/2019:22:17:44 +0100] "GET /nextcloud/index.php/svg/core/logo/logo?color=fff&v=1 HTTP/1.1" 200 321

Can you disable the bruteforce app? It is blocking you.

I disabled (and removed) the “Brutefoce settings” app, although I already cleared the oc_bruteforce_attempts table before, and added my IP to the bruteforce whitelist. Still, the log messages are the same. Is there any other way to disable the bruteforce app?

Any other ideas?

Hi
I have the exact same problem.
After I update from 16.X to 17.0.1-1, I couldn’t log in anymore.

I disabled the “Brutefoce settings” app and cleared the oc_bruteforce_attempts table. But without a success.

Arch Linux is now on Nextcloud 17.0.2-1. But without any luck for me.

I also want to mention, that during the update procedure from nextcloud, there was a problem wit the files_rightclick app.

inside the folder von files_rightclick ther was a folder files_rightclick.
I hade to move the contetnt of …/files_rightclick/files_rightclick to
files_rightclick manualy.

And what now? Have you lost your data? Where are the Nextcloud developers? Be ashamed. What is the security and general sense of keeping data in such a cloud?