Hi All,
I have Nextcloud running on a vserver with centOS. My log shows a warning from App Core every minute:
Warning core Login failed: ‘someuserid’ (Remote IP: ‘some ip’)
The user ID is an old mysql DB user but I have no idea, where this user is still configured…
Any Idea what I can check?
Hi elChupete, do you know the “remoteIP” and the “someuserid”. They are still active. If you know them go to “remoteip” and kill the process, and if you don´t know firewall the “remoteip” with your local firewall tools like fail2ban or iptables.
I Hope this helps
Thanks,
the remote IP is the vserver nextcloud is running on. How can I identify the process?
ps -aux | less doesnt show a running process for user someuserid
You should look for the proscess of a application which command “someruserid” to connect the other server I guess. Check also which applications used the database?
Thanks for trying to help. Unfortunately I do not understand, what you are saying.
I log in to my server via ssh. When I list running processes using command
ps -aux | less
I do not see any process for the user that is shown in Nextcloud log. Furthermore, the user named in the nextcloud log is no existing user on the server itself (i.e. the username does not show up in /etc/passwd
Anyone else? The user ID is a DB user that was creates by Plesk for the first mysql DB I used when initially installation of nextcloud was done. Meanwhile I have changed the DB Schema in use and also a different DB user is in charge. The config.php has been changes accordingly. However, there is still some process with the old user trying to connect.
Normally if you wait it out even a stubborn process eventually stops. If it’s a bad time to reboot try restarting anything used for caching such as memcached or Redis.
OK I know, whats causing the issue.
I am managing my server with Plesk and nextcloud had been installed via Plesk.
It looks as if I have meanwhile deleted the User in nextcloud that was used in Plesk when I created the Nextcloud Instance. Plesk has created a cron, that runs every 10 minutes to do a refresh of the instances in Plesk. As the Plesk user is not available anymore, the user can not connect.
Unfortunately I do not know the password anymore of that user. And I do not find any instruction on how to change the user / password for the nextcloud user in Plesk. So perhaps I will just leave every thing as is or might delete the cron.
Sorry, this is what I meant 
I guess the support responsible for Plesk can solve this problem without any problem. Copy and paste your fine information to them. Good Luck.
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.