[Bug]: NC 24 Trusted domain error. "X.X.X.X tried to access using "X.X.X.X" as host. #32599
Comments
AndyXheli
added
0. Needs triage
|
Same here. Very annoying. You don’t see real errors anymore because the log is full of it. |
|
I hope they make a change or give an option to turn this option off. |
|
add IP address after "using..." into trusted_domains. |
This fixed the issue for me. Im not sure if this would still be an bug or a configuration issue? |
Why should i add an ip from north kansas to my german nextcloud instance? |
|
Do NOT add those IP's to your NC instance. I get those messages too. They try to get access. Use fail2ban to ban them and GeoIP addon to block IP's from countries outside Germany i.e. |
|
Too many different IP addresses every day. Can’t keep up. This isn’t a solution. |
|
I don't know if it is the same situation as I had. My Nextcloud instance was not on the last patch level and it was hit by this vulnerability https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0912 I got exact the same log entries like you, with a lot of IP addresses which tried to get access. I figured out that it came from my own instance. The file permissions of some directories and files have been set to 43. Furthermore, fail2ban was compromised, so that incoming IP addresses were no longer banned. In addition, another port was opened that communicated with an unknown IP. I had to reinstall everything and now the log is silent again. |
|
I have it on different instances of Nextcloud with different OS and hardware. Both were „silent“ until I upgraded them to the latest server version. |
|
There is some confusion in the comments. This is a configuration issue, your Do NOT add the different IPs that are not your public IP (the IP addresses that come right after "Trusted domain error."). You might be getting spammed by these errors as bots scan your IP (and enter the IP directly instead of the URL, which you already might have in your trusted domains). Explained by example
This can be solved by either:
|
|
Thank you for that information. |
To my knowledge this behaviour has not changed between nc23 to nc24. The errors might have started popping up after upgrade simply because it coincided with bots starting to scan your IP. It is completely fine to not add the public ip to the config, users will still be able to connect if they enter the URL (example "mynextcloud.dyndns.com") provided by your dynamic dns (assuming you have added that to your config). The only thing that happens without the IP in the config - is that whoever enters the IP address (example "1.2.3.4") directly in the address bar will not be able to connect. Since no humans will use the IP directly, especially if it changes often, no actual user will have issues. If you are getting these warnings (and a lot of them): bots are scanning your IP. This is probably nothing to worry about, but take it as a reminder to keep your machine and NC updated so no old vulnerabilities can be used. Hope this clears it up! Disclaimer:Theoretically there could be an app or something a user uses to connect to the NC that could use the IP directly, and thus have issues without the IP in the config (trusted domains), but its a weird way to do that. I have not found any that would connect in that way, nor do the official apps. If you find an app that can't connect without the public IP in the trusted domains, you could probably take that with the developer of that app (it should probably not be done that way).ps. You can try the behaviour yourself, by opening two browser windows and writing your URL in one and your current public IP in the other one. If your IP is not in the trusted domains, that one will show an "untrusted domain" page, but the one using the URL should work fine (as long as the URL is in the trusted domains). |
|
Well, I could figure it out. It was introduced in version 24. Here is the change: e6d9ef2 when it is a "normal behaviour" that bots scan it (and they will do), it should be an info and not a warning. |
|
I created a pull request to revert it back to info. Lets see what happens. |
Unfortunately nothing happened. :-( |
|
Hey all! Pull request has been merged |
|
unfortunately it didn't make it to NC 25 RC3 |
|
Yes, you're right its not in 24.0.6 also. Please see my reply #33737 (comment) |
Signed-off-by: Andy Xheli <axheli@axtsolutions.com> Since e6d9ef2 was applied logs get filled up with Trusted domain error. "X.X.X.X tried to access using "X.X.X.X" as host alot of users missed important errors do tohttps://github.com/nextcloud/server/commit/e6d9ef2e38daffcab808eaa41b18ab16c6253b97 please see #32599 This should fix. #32599 (comment) Signed-off-by: Andy Xheli <axheli@axtsolutions.com>
Signed-off-by: Andy Xheli <axheli@axtsolutions.com> Since e6d9ef2 was applied logs get filled up with Trusted domain error. "X.X.X.X tried to access using "X.X.X.X" as host alot of users missed important errors do tohttps://github.com/nextcloud/server/commit/e6d9ef2e38daffcab808eaa41b18ab16c6253b97 please see #32599 This should fix. #32599 (comment) Signed-off-by: Andy Xheli <axheli@axtsolutions.com>
|
I did the two reviews. |
|
Closing since pull request has been merged |
|
it looks like the problem has finally been solved with new update 24.0.8.2 |
Signed-off-by: Andy Xheli <axheli@axtsolutions.com> Since nextcloud/server@e6d9ef2 was applied logs get filled up with Trusted domain error. "X.X.X.X tried to access using "X.X.X.X" as host alot of users missed important errors do tohttps://github.com/nextcloud/server/commit/e6d9ef2e38daffcab808eaa41b18ab16c6253b97 please see nextcloud/server#32599 This should fix. nextcloud/server#32599 (comment) Signed-off-by: Andy Xheli <axheli@axtsolutions.com>
Bug description
Ever since NC 24 my log gets spammed with Trusted domain error. "192.241.216.39" tried to access using "X.X.X.X" as host.
Is there a way to turn these warnings off ON NC 23 and below only got the warnings if someone trys to log and it was incorrect
Steps to reproduce
Ever since NC 24 my log gets spammed with Trusted domain error. "192.241.216.39" tried to access using "X.X.X.X" as host.
Is there a way to turn these warnings off ON NC 23 and below only got the warnings if someone trys to log and it was incorrect
Expected behavior
Ever since NC 24 my log gets spammed with Trusted domain error. "192.241.216.39" tried to access using "X.X.X.X" as host.
Is there a way to turn these warnings off ON NC 23 and below only got the warnings if someone trys to log and it was incorrect
Installation method
Manual installation
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.1
Web server
No response
Database engine version
MariaDB
Is this bug present after an update or on a fresh install?
Updated to a major version (ex. 22.2.3 to 23.0.1)
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
Configuration report
{ "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "***REMOVED SENSITIVE VALUE***", "***REMOVED SENSITIVE VALUE***" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "24.0.1.1", "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***", "htaccess.RewriteBase": "\/", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "mysql.utf8mb4": true, "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "memcache.local": "\\OC\\Memcache\\APCu", "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 6379 }, "simpleSignUpLink.shown": false, "trashbin_retention_obligation": "auto,30", "skeletondirectory": "", "default_phone_region": "US", "allow_local_remote_servers": true, "preview_max_memory": 1280, "mail_smtpmode": "smtp", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_sendmailmode": "smtp", "mail_smtpport": "587", "mail_smtpauthtype": "LOGIN", "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "mail_smtpsecure": "tls", "mail_smtpauth": 1, "mail_smtpname": "***REMOVED SENSITIVE VALUE***", "mail_smtppassword": "***REMOVED SENSITIVE VALUE***", "twofactor_enforced": "true", "twofactor_enforced_groups": [], "twofactor_enforced_excluded_groups": [], "maintenance": false, "updater.release.channel": "stable", "theme": "", "loglevel": 2, "versions_retention_obligation": "auto,30", "updater.secret": "***REMOVED SENSITIVE VALUE***" } }List of activated Apps
Nextcloud Signing status
No response
Nextcloud Logs
Additional info
No response
The text was updated successfully, but these errors were encountered: