nextcloud/suspicious_login

Email Notification: New login location detected

vandman opened this issue · 2 comments

Hi,

I use Nextcloud in docker. All the technical info are at the bottom of this message.

I receive email notification on the admin email of my Nextcloud instance.
When I receive the email notification about "New login location detected", it gives me only an IP. This is not sufficient as information. I need to know to witch user this connection belongs to. If not I can not do anything.

I have checked in my email as user, I receive no notification about "New login location detected". This is strange as the user should receive this message to take action (change password if necessary) , not only the admin.

In the picture under, I have checked, I as admin did not log in Italia, It was a user who used a VPN. The user did not received any email notification and only me as admin received it. It was hard to see who this message was for as there is no other information other than the IP.

image

So the improvement asked is:

1: The user should receive this message too
2: For the admin, the full name and email should be added to the message to be able to take action.

Thanks
Pierre

docker exec --user www-data nc php occ status
  - installed: true
  - version: 27.1.6.2
  - versionstring: 27.1.6
  - edition: 
  - maintenance: false
  - needsDbUpgrade: false
  - productname: Nextcloud
  - extendedSupport: false

docker exec --user www-data nc php occ app:list
Enabled:
  - activity: 2.19.0
  - admin_audit: 1.17.0
  - analytics: 4.12.0
  - announcementcenter: 6.7.0
  - auto_groups: 1.5.2
  - bruteforcesettings: 2.7.0
  - calendar: 4.6.4
  - circles: 27.0.1
  - cloud_federation_api: 1.10.0
  - comments: 1.17.0
  - contacts: 5.5.1
  - contactsinteraction: 1.8.0
  - dashboard: 7.7.0
  - dav: 1.27.0
  - deck: 1.11.4
  - dicomviewer: 1.2.5
  - event_update_notification: 2.3.0
  - federatedfilesharing: 1.17.0
  - files: 1.22.0
  - files_accesscontrol: 1.17.1
  - files_antivirus: 5.4.1
  - files_external: 1.19.0
  - files_mindmap: 0.0.30
  - files_pdfviewer: 2.8.0
  - files_reminders: 1.0.0
  - files_retention: 1.16.0
  - files_rightclick: 1.6.0
  - files_sharing: 1.19.0
  - files_trashbin: 1.17.0
  - files_versions: 1.20.0
  - firstrunwizard: 2.16.0
  - forms: 3.4.5
  - groupfolders: 15.3.4
  - integration_openproject: 2.6.0
  - limit_login_to_ip: 4.0.0
  - logreader: 2.12.0
  - lookup_server_connector: 1.15.0
  - mail: 3.5.6
  - maps: 1.2.0
  - music: 1.10.0
  - nextcloud_announcements: 1.16.0
  - notifications: 2.15.0
  - oauth2: 1.15.2
  - onlyoffice: 8.2.4
  - password_policy: 1.17.0
  - photos: 2.3.0
  - piwik: 0.12.0
  - polls: 5.4.3
  - previewgenerator: 5.4.0
  - privacy: 1.11.0
  - provisioning_api: 1.17.0
  - recognize: 5.0.3
  - recommendations: 1.6.0
  - related_resources: 1.2.0
  - serverinfo: 1.17.0
  - settings: 1.9.0
  - sharebymail: 1.17.0
  - sharepoint: 1.15.0
  - socialsharing_email: 3.0.1
  - survey_client: 1.15.0
  - suspicious_login: 5.0.0
  - systemtags: 1.17.0
  - tasks: 0.15.0
  - text: 3.8.0
  - theming: 2.2.0
  - translate: 1.2.0
  - twofactor_backupcodes: 1.16.0
  - unsplash: 2.2.1
  - updatenotification: 1.17.0
  - user_status: 1.7.0
  - viewer: 2.1.0
  - weather_status: 1.7.0
  - workflow_pdf_converter: 1.12.0
  - workflowengine: 2.9.0
Disabled:
  - encryption: 2.15.0
  - federation: 1.17.0 (installed 1.10.1)
  - support: 1.10.0 (installed 1.3.0)
  - twofactor_totp: 9.0.0
  - user_ldap: 1.17.0

The notifications are only sent to the account holder. The target email address used is whatever is configured within their account. Can you verify the email address(es) configured in the Nextcloud account of the VPN user?

Closing due to needing further information that was never received.