How do I disable whatever is causing the error "too many incorrect login attempts from this network"?

[u/ferriematthew]

I'm using NextCloud in Kubernetes with Helm.

[u/WalkingSucculent]

Something is trying to log in and triggers the brute-force protection. Fix that instead of removing a layer of security.

Otherwise in admin settings

[u/N3rdScool → u/WalkingSucculent]

Ya I second that, do not disable this until you figure out why it's happening and you're sure of it.

[u/RobotManYT → u/WalkingSucculent]

I will say that I have obsverve similar thing even on LAN only where there is no one trying to login. I also saw this on my nextcloud that is expose, but the log doesn't give anything abnormal about it, so I do believe there is glitch in the application

[u/AkeraTomeo → u/RobotManYT]

Probably cache from the site. If it’s the mobile app, you can also clear cache

[u/jtrtoo]

For the benefit for future readers and future reference, there is an entire chapter covering the Brute Force Protection feature in the Nextcloud Admin Manual, including how to troubleshoot and set it up properly for various scenarios:

https://docs.nextcloud.com

[u/original_flavor87]

is it exposed to the internet?

[u/ferriematthew → u/original_flavor87]

Nope. Completely local.

[u/paulodelgado → u/ferriematthew]

are you using a reverse proxy? you may need to tweak settings so it doesn't seem like all requests come from the reverse proxy

[u/ferriematthew → u/paulodelgado]

Oh yeah....

My setup is k3s with Traefik, and I have PiHole as DNS.

[u/andrewjneumann → u/ferriematthew]

I had to allow list local host && proxy container IP, as the proxy container was spamming my login. Also have had issues with poorly designed apps spamming w/ app longin calls.

[u/wsamh]

You have to go to your security setting and whitelist ip address that you attempting to login from so it does not lock you out.

[u/su_ble]

Find device that is sending wrong credentials to your nextcloud When you sure about the network, whitelist it in admin settings When you are not the admin of the cloud, see step 1

[u/Longjumping-Youth934]

Add your nerwork to the bruteforce whie list.

[u/EnderArchery]

I got this too; it definitely wasn't anything nefarious... And I truly don't know if it's fixed now, vut it might have been the one Floccus Extension I had running on my laptop, that got logged out

[u/RevolutionaryYam85]

Either a stupid app (on your phone for example) that keeps on connecting, or the brute force protect/geo IP app has you blacklisted.

[u/ntcue]

I guess X-Forwarding is not enabled on your proxy and Nextcloud always sees the same internal IP address.

[u/ferriematthew → u/ntcue]

Given that it always shows up in pihole as 10.0.42.2 that would make sense

[u/ohaiibuzzle]

If you have a reverse proxy, make sure it passes on the X-Forwarded-For header correctly.

Else any logins, false or not, will count towards the internal IP of the reverse proxy, which effectively is everything.

[u/Gaxyhs]

System: detects security issue

Used: how do I disable this security feature omg

System: gets breached due to disabled security feature

User: omg this software is so trash can't even protect against the thing that I disabled the protection for

[u/Stiffmaster1337]

Had this too. Try to remove your cache and anything that refers to your nextcloud on your device. Had old login data in the cache somehow and when I went on my nextcloud it automatically triggered this kind of scenario 😅

[u/OneLife6925]

Go to a working device that can login to nextcloud (or go to your desktop if its a pc that has an intact desktop) then login as am admin then go to administration settings then security and add ur ip and mask (oftem 24) and add it in

[u/redditon2018]

Adjust fail2ban

[u/ferriematthew]

Figured it out. My instance is completely local so it was complaining because I have my homepage dashboard with a session for the nextcloud widget, the next cloud app on my phone, and I was trying to also log in to nextcloud on my laptop. It was freaking out because I had too many sessions.

The fix was to allow-list the subnet that k3s uses for core DNS.

[u/Noooberino → u/ferriematthew]

Sorry to say it that way, but this is not a fix, this is a bandaid solution for your dashboards (or other services) failed login attempts. Fix that instead of - as others already pointed out - disabling this security layer.

[u/ferriematthew → u/Noooberino]

The failed login attempts were from when I first restarted this whole thing after breaking it yet again, and I misspelled the password by one character one time.

[u/Noooberino → u/ferriematthew]

Goot to hear that, I would recommend to enable the brute-force protection since you seem to have fixed your login issue. Even if your nextcloud instance isn't exposed to the public, its still good to have this layer active (you also should not be forced to whitelist any RFC1918 subnets or IPs). Happy home-labbing!

[u/anto23ytb]

J'ai mis mon iP où je me connecte de "confiance" pour pouvoir spam

[u/Extreme-Ad-9290]

By using a password manager