Fail2Ban prevents the login to Nextcloud

Support
, ,
1

Nethserver: Latest
Fail2Ban: Latest

Hello friends,

If I want to log in to my server from the mobile network with the Nextcloud Client on my iPhone or iPad, Fail2Ban has been blocking access for a few days.

"The IP 80.187.xxx.xxx has just been banned by Fail2Ban after
3 attempts against nextcloud-auth. "

2FA is activated for Nextcloud. The login details on my iPhone are correct. If I deselect Nextcloud monitoring in Fail2ban’s settings, access works with iPhone and iPad.
How can I solve the problem without having to disable Nextcloud monitoring in Fail2Ban’s settings?
An entry of the IP address in the exceptions of the monitored IPs is not successful.

Regards

Uwe

3

Hum, it will be really interesting to use fail2ban-regex and find what has triggered fail2ban

4

fail2ban-regex /var/log/fail2ban.log /etc/fail2ban/filter.d/nextcloud-auth.conf --print-all-matched

please could test your log files, think to test your other fail2ban.log

1 Like
5

[root@server ~]# fail2ban-regex /var/log/fail2ban.log /etc/fail2ban/filter.d /nextcloud-auth.conf --print-all-matched

Running tests

Use failregex filter file : nextcloud-auth, basedir: /etc/fail2ban
Use log file : /var/log/fail2ban.log
Use encoding : UTF-8

Results

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [1012] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute: Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-

Lines: 1012 lines, 0 ignored, 0 matched, 1012 missed
[processed in 0.05 sec]

Missed line(s): too many to print. Use --print-all-missed to print all 1012 li

6

0 matched, could you test other fail2ban log, the name include the date

7

[root@server ~]# fail2ban-regex /var/log/fail2ban.log-20200202 /etc/fail2ban/filter.d/nextcloud-auth.conf --print-all-matched

Running tests

Use failregex filter file : nextcloud-auth, basedir: /etc/fail2ban
Use log file : /var/log/fail2ban.log-20200202
Use encoding : UTF-8

Results

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [9768] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-

Lines: 9768 lines, 0 ignored, 0 matched, 9768 missed
[processed in 0.47 sec]

Missed line(s): too many to print. Use --print-all-missed to print all 9768 lines

8

Anmerkung%202020-02-02%20153605
Anmerkung 2020-02-02 153605.jpg840×130 58.6 KB

9

Curious, you cannot have match but you do have a ban

10

The problem started five days ago.

11

My bad, it is the nextcloud log you must test, not the fail2ban one

12

[root@server ~]# fail2ban-regex /var/log/nextcloud.log /etc/fail2ban/filter.d/nextcloud-auth.conf --print-all-matched

Running tests

Use failregex filter file : nextcloud-auth, basedir: /etc/fail2ban
Use single line : /var/log/nextcloud.log

Results

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:

Lines: 1 lines, 0 ignored, 0 matched, 1 missed
[processed in 0.03 sec]

|- Missed line(s):
| /var/log/nextcloud.log
`-
[root@server ~]#

13

you are not looking in the good file, check other logs for different time

fail2ban-regex /var/lib/nethserver/nextcloud/nextcloud.log-20200202 /etc/fail2ban/filter.d/nextcloud-auth.conf --print-all-matched

looking the regex, it is simple, I cannot understand why false login could occur

[root@prometheus ~]# cat /etc/fail2ban/filter.d/nextcloud-auth.conf
[Definition]
#this filter is made against brute force attack to nextcloud
# Author Stephane de Labrusse <stephdl@de-labrusse.fr>

#Rule order 1-NC10

failregex = ^.*\"remoteAddr\":\"<HOST>\".*Login failed:.*$

ignoreregex =
14

it seems that nextcloud has changed something in the manner to write in logs, but our regex is still workable…

I do not know why but it seems that you have had bad login, maybe you can increase the Nextcloud_MaxRetry, the default is 3, think to increase the value and trigger the event nethserver-fail2ban-save

How much is the value FindTime ?

15

[root@server ~]# fail2ban-regex /var/lib/nethserver/nextcloud/nextcloud.log-20200202 /etc/fail2ban/filter.d/nextcloud-auth.conf --print-all-matched

Running tests

Use failregex filter file : nextcloud-auth, basedir: /etc/fail2ban
Use log file : /var/lib/nethserver/nextcloud/nextcloud.log-20200202
Use encoding : UTF-8

Results

Failregex: 250 total
|- #) [# of hits] regular expression
| 1) [250] ^.*“remoteAddr”:"".Login failed:.$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [740] ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-

Lines: 740 lines, 0 ignored, 250 matched, 490 missed
[processed in 0.09 sec]

|- Matched line(s):
| {“reqId”:“Xi8c4BL6Aa-Zuy9dLMJRTwAAAAA”,“level”:2,“time”:“2020-01-27T17:24:48+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“Xi8c4MyvbR1Xppcqn8NIRAAAAAE”,“level”:2,“time”:“2020-01-27T17:24:48+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“Xi8c4GdRY5Q4l7OI7a3eygAAAAc”,“level”:2,“time”:“2020-01-27T17:24:48+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“Xi8c4JkKop96Ah0mrtmuMAAAAAs”,“level”:2,“time”:“2020-01-27T17:24:48+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/apps/theming/image/background?v=3",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“Xi8dBruaj2AwTX@NMMD@GwAAAAI”,“level”:2,“time”:“2020-01-27T17:25:26+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“Xi8dBh2ceukTpNfa0E9Z1AAAAAM”,“level”:2,“time”:“2020-01-27T17:25:26+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“Xi8dBj-VVwenWEIUEm67LwAAAAw”,“level”:2,“time”:“2020-01-27T17:25:26+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“17.0.2.1”}
| {“reqId”:“XjAQlYl6ii6g7mbExVvg2wAAAAQ”,“level”:2,“time”:“2020-01-28T10:44:45+00:00”,“remoteAddr”:“80.187.85.106”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.85.106’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAQj0-W935zRacjdTkI1AAAAAI”,“level”:2,“time”:“2020-01-28T10:44:45+00:00”,“remoteAddr”:“80.187.85.106”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.85.106’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAQlBO6cyJJEP1mjw@OLQAAAAM”,“level”:2,“time”:“2020-01-28T10:44:45+00:00”,“remoteAddr”:“80.187.85.106”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.85.106’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjASwBiAe@PFwXuLBMgX6AAAAAk”,“level”:2,“time”:“2020-01-28T10:53:52+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjASwAKIOwRxnylXT6uQkQAAAAg”,“level”:2,“time”:“2020-01-28T10:53:53+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjASwU-W935zRacjdTkI1QAAAAI”,“level”:2,“time”:“2020-01-28T10:53:53+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjASwk-W935zRacjdTkI1gAAAAI”,“level”:2,“time”:“2020-01-28T10:53:55+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjATBU-W935zRacjdTkI2AAAAAI”,“level”:2,“time”:“2020-01-28T10:55:02+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjATBgKIOwRxnylXT6uQlQAAAAg”,“level”:2,“time”:“2020-01-28T10:55:02+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjATBhO6cyJJEP1mjw@OMAAAAAM”,“level”:2,“time”:“2020-01-28T10:55:02+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjATBkriUn49HLBj7gNsegAAAAE”,“level”:2,“time”:“2020-01-28T10:55:03+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjATDRiAe@PFwXuLBMgX7AAAAAk”,“level”:2,“time”:“2020-01-28T10:55:09+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjATDU-W935zRacjdTkI2QAAAAI”,“level”:2,“time”:“2020-01-28T10:55:10+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAT-QKIOwRxnylXT6uQlgAAAAg”,“level”:2,“time”:“2020-01-28T10:59:09+00:00”,“remoteAddr”:“80.187.121.185”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.121.185’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAT-jN@I5Zvic7zmQ1KmQAAAAU”,“level”:2,“time”:“2020-01-28T10:59:10+00:00”,“remoteAddr”:“80.187.121.185”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.121.185’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAT-mp1lJKtfc7r5LFuUgAAAAc”,“level”:2,“time”:“2020-01-28T10:59:10+00:00”,“remoteAddr”:“80.187.121.185”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.121.185’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAUphnoQ0XJ-oRRbl48jgAAAAo”,“level”:2,“time”:“2020-01-28T11:01:59+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAUpmp1lJKtfc7r5LFuVQAAAAc”,“level”:2,“time”:“2020-01-28T11:01:59+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAUp0-W935zRacjdTkI4wAAAAI”,“level”:2,“time”:“2020-01-28T11:01:59+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAUpyadJlcCVv12i0XM5QAAAAY”,“level”:2,“time”:“2020-01-28T11:02:00+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVHIl6ii6g7mbExVvg6wAAAAQ”,“level”:2,“time”:“2020-01-28T11:03:56+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVHBO6cyJJEP1mjw@ONQAAAAM”,“level”:2,“time”:“2020-01-28T11:03:57+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVXRnoQ0XJ-oRRbl48jwAAAAo”,“level”:2,“time”:“2020-01-28T11:05:01+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVXpK9OhyqUxWV89-K-gAAAAE”,“level”:2,“time”:“2020-01-28T11:05:04+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVak-W935zRacjdTkI5AAAAAI”,“level”:2,“time”:“2020-01-28T11:05:17+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVbSadJlcCVv12i0XM5gAAAAY”,“level”:2,“time”:“2020-01-28T11:05:18+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVbhO6cyJJEP1mjw@ONgAAAAM”,“level”:2,“time”:“2020-01-28T11:05:18+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVbpK9OhyqUxWV89-K-wAAAAE”,“level”:2,“time”:“2020-01-28T11:05:18+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVbyadJlcCVv12i0XM6AAAAAY”,“level”:2,“time”:“2020-01-28T11:05:19+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAVb5K9OhyqUxWV89-LAAAAAAE”,“level”:2,“time”:“2020-01-28T11:05:20+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3Gp1lJKtfc7r5LFuWgAAAAc”,“level”:2,“time”:“2020-01-28T11:32:44+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3E-W935zRacjdTkI6AAAAAI”,“level”:2,“time”:“2020-01-28T11:32:45+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/u.tiedt/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3AKIOwRxnylXT6uQoAAAAAg”,“level”:2,“time”:“2020-01-28T11:32:45+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3CadJlcCVv12i0XM6wAAAAY”,“level”:2,“time”:“2020-01-28T11:32:45+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3iadJlcCVv12i0XM7AAAAAY”,“level”:2,“time”:“2020-01-28T11:32:46+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/apps/theming/image/background?v=3",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3gKIOwRxnylXT6uQoQAAAAg”,“level”:2,“time”:“2020-01-28T11:32:46+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb3Yl6ii6g7mbExVvg8gAAAAQ”,“level”:2,“time”:“2020-01-28T11:32:46+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb4DL2guExx0DHLr4y8gAAAAA”,“level”:2,“time”:“2020-01-28T11:32:49+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb4qXc2lcc8mWSzon3YAAAAAw”,“level”:2,“time”:“2020-01-28T11:32:52+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb5xiAe@PFwXuLBMgX9wAAAAk”,“level”:2,“time”:“2020-01-28T11:32:58+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb6CNH1IwYGZZzBLxXgAAAAAU”,“level”:2,“time”:“2020-01-28T11:33:02+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb7k-W935zRacjdTkI6QAAAAI”,“level”:2,“time”:“2020-01-28T11:33:02+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb6xO6cyJJEP1mjw@OOwAAAAM”,“level”:2,“time”:“2020-01-28T11:33:05+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Dokumente",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb8QKIOwRxnylXT6uQogAAAAg”,“level”:2,“time”:“2020-01-28T11:33:06+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb8hO6cyJJEP1mjw@OPAAAAAM”,“level”:2,“time”:“2020-01-28T11:33:08+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb@SadJlcCVv12i0XM7QAAAAY”,“level”:2,“time”:“2020-01-28T11:33:16+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAb-Il6ii6g7mbExVvg8wAAAAQ”,“level”:2,“time”:“2020-01-28T11:33:23+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcCDL2guExx0DHLr4y8wAAAAA”,“level”:2,“time”:“2020-01-28T11:33:41+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcEaXc2lcc8mWSzon3YQAAAAw”,“level”:2,“time”:“2020-01-28T11:33:53+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcFRiAe@PFwXuLBMgX@AAAAAk”,“level”:2,“time”:“2020-01-28T11:34:06+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcGxnoQ0XJ-oRRbl48lgAAAAo”,“level”:2,“time”:“2020-01-28T11:34:12+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder/Bilder%20aus%20Hamburg",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcNCadJlcCVv12i0XM7gAAAAY”,“level”:2,“time”:“2020-01-28T11:34:13+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder/Bilder%20aus%20Hamburg",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcNzL2guExx0DHLr4y9AAAAAA”,“level”:2,“time”:“2020-01-28T11:34:15+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder/Bilder%20aus%20Hamburg",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcNyadJlcCVv12i0XM8AAAAAY”,“level”:2,“time”:“2020-01-28T11:34:16+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcN6Xc2lcc8mWSzon3YgAAAAw”,“level”:2,“time”:“2020-01-28T11:34:16+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder/Bilder%20aus%20Hamburg",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcOKXc2lcc8mWSzon3YwAAAAw”,“level”:2,“time”:“2020-01-28T11:34:16+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcOiadJlcCVv12i0XM8gAAAAY”,“level”:2,“time”:“2020-01-28T11:34:18+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcIk-W935zRacjdTkI6gAAAAI”,“level”:2,“time”:“2020-01-28T11:34:19+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcOxO6cyJJEP1mjw@OPgAAAAM”,“level”:2,“time”:“2020-01-28T11:34:19+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcKAKIOwRxnylXT6uQowAAAAg”,“level”:2,“time”:“2020-01-28T11:34:19+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder/Bilder%20aus%20Hamburg",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcOxnoQ0XJ-oRRbl48lwAAAAo”,“level”:2,“time”:“2020-01-28T11:34:21+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcPE-W935zRacjdTkI6wAAAAI”,“level”:2,“time”:“2020-01-28T11:34:23+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav/Bilder/Bilder%20aus%20Hamburg",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjAcPYMQRJBH8tQBSIP5AgAAAAE”,“level”:2,“time”:“2020-01-28T11:34:28+00:00”,“remoteAddr”:“192.168.134.254”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.134.254’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjBuzFK-JoreH7SVvcmblQAAAAc”,“level”:2,“time”:“2020-01-28T17:26:36+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjBuzM9iN9C-uTtxOu1gCAAAAAY”,“level”:2,“time”:“2020-01-28T17:26:36+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/index.php/avatar/xxx/128",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjBuzMWPBmFVSIpY5bNIIgAAAAM”,“level”:2,“time”:“2020-01-28T17:26:36+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjBuzLX-B4kz@cOv3Hwf2AAAAAQ”,“level”:2,“time”:“2020-01-28T17:26:37+00:00”,“remoteAddr”:“192.168.2.33”,“user”:"–",“app”:“core”,“method”:“GET”,“url”:"/nextcloud/ocs/v2.php/apps/files/api/v1/directEditing?format=json",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘192.168.2.33’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjCKl7xQZx1zq3gOb8w1wAAAAA0”,“level”:2,“time”:“2020-01-28T19:25:11+00:00”,“remoteAddr”:“80.187.121.185”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.121.185’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}
| {“reqId”:“XjCKmGx@zW4DHUUxHBXoPAAAAAo”,“level”:2,“time”:“2020-01-28T19:25:12+00:00”,“remoteAddr”:“80.187.121.185”,“user”:"–",“app”:“core”,“method”:“PROPFIND”,“url”:"/nextcloud/remote.php/webdav",“message”:“Login failed: ‘9babf9a8-8543-1039-8b01-7f7742a6f6c2’ (Remote IP: ‘80.187.121.185’)”,“userAgent”:“Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.5”,“version”:“18.0.0.10”}

|

Missed line(s): too many to print. Use --print-all-missed to print all 490 lines

16

Can the update to Nextcloud 18 be the cause of the trouble?

17

Maybe, see by yourself, the webdav triggers bad login with the user ‘-’

Fail2ban does simply its job

18

I’ve checked on our production machine and I can confirm that fail2ban regexp is still working, so I do not think it’s something related to the upgrade.

@transocean make sure there is no nextcloud with bad credentials, it will quickly fill up the log with bad credentials requests that will cause ban.

1 Like
19

I am sorry I cannot provide the exact log files right now but some of my observations with fail2ban and Nextcloud. I have both deployed on a single VM. When I associate new devices (nextcloud windows client on a Win 10 Pro device and Android phone) with my NC account or if I for instance trigger a remote wipe I too have had fail2ban act up and prompt a temp ban on my IP address. I can get this to reproduce semi-consistently by either adding/removing/wiping the external devices. I also enable fail2ban enforcement on my internal lan.

20

Hi giacomo,

i use my normal login credentials on iPhone and iPad, what i am use also on the Clients within my LAN. Fail2Ban prohibits only the access from outside via Mobil Net (Telekom).

Regards

Uwe

21

you know what to do, show us the fail2ban-regex traces please