Disable bruteforce protection
MiGrandjean opened this issue · 4 comments
While the bruteforce protection is a really nice feature, it's counterproductive in the case of the Univention Nextcloud App, unfortunately. The Univention Nextcloud App is running inside a Docker container and all the network traffic from and to Nextcloud is handled via the Docker bridge interface. This means all logins appear to come from 172.17.42.1 (the IP of the Docker bridge docker0).
This easily leads to situations where everyone is blocked and their logins get delayed.
See also: https://help.univention.com/t/5803 (german)
As discussed on IRC, there is some config missing on Nextcloud side. Most importantly, we need to specify the IP address(es) of the Proxy server. Is there a reliable way to determine this on UCS?
Another requirement is that the Proxy sends the Forwarded-For Header, to my understanding Apache, which is in use, does this by default.
@MiGrandjean ping?
The IP address of the docker bridge is configured via the UCR variable docker/daemon/default/opts/bip
The IP address(es) of the UCS host is configured via the UCR variables interfaces/<devicename>/address, e.g. interfaces/eth0/address