Nextcloud asking for `sodium` although being installed

[steffen-moser]

Steps to reproduce

1. Run a PHP 7.4 instance lacking "argon2" crypto support (e.g. PHP 7.4.15 on Oracle Solaris 11.4 SRU 35)
2. Install "libsodium" in your system (if not already available) and do a "pecl install libsodium".
3. Include "sodium.so" in the list of used PHP extensions.
4. Check that "sodium" is available to PHP (e.g. by calling a PHP file which contains "phpinfo()").
5. Upgrade from Nextcloud 20.0.11 to Nextcloud 20.0.12.
6. Go to "Settings", "Overview"

Expected behavior

You should see an "all is fine" message (or, in my case, only the hint about the fact that MySQL 5.7.34 is too old for Nextcloud 21)

Actual behavior

Nextcloud shows the following message:

This instance is missing some recommended PHP modules. For improved performance and better compatibility, it is highly recommended to install them. 

     sodium

Maybe, the checks introduced by #28289 are only looking for the availability of the "PASSWORD_ARGON2I" constant, which is not provided by php-sodium. The latter provides different constants and functions, (cf. this discussion). I've not checked whether Nextcloud would actually use the functions provided by php-sodium. Earlier versions of Nextcloud have not asked for sodium support.

Server configuration

Operating system: Oracle Solaris 11.4 SRU 35

Web server: Apache 2.4.48

Database: MySQL 5.7.34

PHP version: PHP 7.4.15

Nextcloud version: 20.0.12

Updated from an older Nextcloud/ownCloud or fresh install: Upgraded from 20.0.11

Where did you install Nextcloud from: By downloading "nextcloud-20.0.12.tar.bz2", unpacking it manually, and copying back my old "config.php".

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:
  - accessibility: 1.6.0
  - activity: 2.13.4
  - admin_audit: 1.10.0
  - calendar: 2.3.1
  - checksum: 1.1.2
  - cloud_federation_api: 1.3.0
  - comments: 1.10.0
  - contacts: 4.0.1
  - contactsinteraction: 1.1.0
  - dashboard: 7.0.0
  - dav: 1.16.2
  - deck: 1.2.8
  - drawio: 1.0.1
  - external: 3.7.3
  - federatedfilesharing: 1.10.2
  - federation: 1.10.1
  - files: 1.15.0
  - files_external: 1.11.1
  - files_pdfviewer: 2.0.1
  - files_rightclick: 0.17.0
  - files_sharing: 1.12.2
  - files_trashbin: 1.10.1
  - files_versions: 1.13.0
  - files_videoplayer: 1.9.0
  - firstrunwizard: 2.9.0
  - logreader: 2.5.0
  - lookup_server_connector: 1.8.0
  - nextcloud_announcements: 1.9.0
  - notifications: 2.8.0
  - oauth2: 1.8.0
  - password_policy: 1.10.1
  - photos: 1.2.3
  - privacy: 1.4.0
  - provisioning_api: 1.10.0
  - recommendations: 0.8.0
  - richdocuments: 3.8.4
  - serverinfo: 1.10.0
  - settings: 1.2.0
  - sharebymail: 1.10.0
  - support: 1.3.0
  - survey_client: 1.8.0
  - systemtags: 1.10.0
  - text: 3.1.0
  - theming: 1.11.0
  - twofactor_backupcodes: 1.9.0
  - updatenotification: 1.10.0
  - user_ldap: 1.10.2
  - user_status: 1.0.1
  - viewer: 1.4.0
  - weather_status: 1.0.0
  - workflowengine: 2.2.0
Disabled:
  - encryption

Nextcloud configuration:

Config report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "20.0.12.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "versions": "false",
        "loglevel": 2,
        "maintenance": false,
        "theme": "",
        "trusted_domains": [
            "sirius.informatik.uni-ulm.de"
        ],
        "share_folder": "\/Shared",
        "mail_smtpmode": "smtp",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "appstore.experimental.enabled": true,
        "singleuser": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "trashbin_retention_obligation": "7,30",
        "overwrite.cli.url": "https:\/\/sirius.informatik.uni-ulm.de\/owncloud",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mysql.utf8mb4": true,
        "defaultapp": "files"
    }
}

Are you using external storage, if yes which one: No.

Are you using encryption: No, not on this instance.

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

LDAP config

+-------------------------------+-------------------------------------------------------------------------+
| Configuration                 |                                                                         |
+-------------------------------+-------------------------------------------------------------------------+
| hasMemberOfFilterSupport      |                                                                         |
| homeFolderNamingRule          |                                                                         |
| lastJpegPhotoLookup           | 0                                                                       |
| ldapAgentName                 | cn=xxxxxxxx,ou=profile,dc=sol,dc=informatik,dc=uni-ulm,dc=de            |
| ldapAgentPassword             | ***                                                                     |
| ldapAttributesForGroupSearch  |                                                                         |
| ldapAttributesForUserSearch   |                                                                         |
| ldapBackupHost                |                                                                         |
| ldapBackupPort                |                                                                         |
| ldapBase                      | dc=sol,dc=informatik,dc=uni-ulm,dc=de                                   |
| ldapBaseGroups                | ou=groups,dc=sol,dc=informatik,dc=uni-ulm,dc=de                         |
| ldapBaseUsers                 | ou=people,dc=sol,dc=informatik,dc=uni-ulm,dc=de                         |
| ldapCacheTTL                  | 60                                                                      |
| ldapConfigurationActive       | 1                                                                       |
| ldapDefaultPPolicyDN          |                                                                         |
| ldapDynamicGroupMemberURL     |                                                                         |
| ldapEmailAttribute            | mail                                                                    |
| ldapExperiencedAdmin          | 0                                                                       |
| ldapExpertUUIDGroupAttr       |                                                                         |
| ldapExpertUUIDUserAttr        |                                                                         |
| ldapExpertUsernameAttr        |                                                                         |
| ldapExtStorageHomeAttribute   |                                                                         |
| ldapGidNumber                 | gidNumber                                                               |
| ldapGroupDisplayName          | cn                                                                      |
| ldapGroupFilter               | (&(|(objectclass=posixGroup)))                                          |
| ldapGroupFilterGroups         |                                                                         |
| ldapGroupFilterMode           | 1                                                                       |
| ldapGroupFilterObjectclass    | posixGroup                                                              |
| ldapGroupMemberAssocAttr      | memberUid                                                               |
| ldapHost                      | ldap://xxxxxxxxx.informatik.uni-ulm.de/                                 |
| ldapIgnoreNamingRules         |                                                                         |
| ldapLoginFilter               | (&(objectclass=inetOrgPerson)(|(uid=%uid)(mail=%uid))(gidNumber=10000)) |
| ldapLoginFilterAttributes     |                                                                         |
| ldapLoginFilterEmail          | 0                                                                       |
| ldapLoginFilterMode           | 1                                                                       |
| ldapLoginFilterUsername       | 1                                                                       |
| ldapMatchingRuleInChainState  | unknown                                                                 |
| ldapNestedGroups              | 0                                                                       |
| ldapOverrideMainServer        | 0                                                                       |
| ldapPagingSize                | 500                                                                     |
| ldapPort                      | 389                                                                     |
| ldapQuotaAttribute            |                                                                         |
| ldapQuotaDefault              |                                                                         |
| ldapTLS                       | 0                                                                       |
| ldapUserAvatarRule            | default                                                                 |
| ldapUserDisplayName           | cn                                                                      |
| ldapUserDisplayName2          |                                                                         |
| ldapUserFilter                | (&(objectclass=inetOrgPerson)(gidNumber=10000))                         |
| ldapUserFilterGroups          |                                                                         |
| ldapUserFilterMode            | 1                                                                       |
| ldapUserFilterObjectclass     | inetOrgPerson                                                           |
| ldapUuidGroupAttribute        | auto                                                                    |
| ldapUuidUserAttribute         | auto                                                                    |
| turnOffCertCheck              | 1                                                                       |
| turnOnPasswordChange          | 0                                                                       |
| useMemberOfToDetectMembership | 1                                                                       |
+-------------------------------+-------------------------------------------------------------------------+

Client configuration

Browser: Firefox 91.0

Operating system: macOS Big Sur 11.5.2

Logs

Web server error log

Web server error log

87.175.147.61 - - [12/Aug/2021:13:46:24 +0200] "GET /owncloud/ocs/v2.php/apps/user_status/api/v1/user_status HTTP/1.1" 200 149
87.175.147.61 - - [12/Aug/2021:13:46:25 +0200] "PROPFIND /owncloud/remote.php/dav/ HTTP/1.1" 207 433
87.175.147.61 - - [12/Aug/2021:13:46:25 +0200] "PROPFIND /owncloud/remote.php/dav/ HTTP/1.1" 207 433
87.175.147.61 - - [12/Aug/2021:13:46:24 +0200] "GET /owncloud/index.php/settings/ajax/checksetup HTTP/1.1" 200 1081

Nextcloud log (data/nextcloud.log)

Details

No log entries shown when reloading "settings/admin/overview".

Browser log

Details

No errors shown.

[CarlSchwan]

Yeah, the check could be a bit better and should actually check if select 1 from oc_users where password like "3|$argon%" limit 1; returns 1 too so to be sure if the lack of argon2 hashing function is a problem or not

[ASerbinski]

I'm seeing the same problem with NC 22.1.1 on EL8

From phpinfo():

sodium support | enabled
-- | --
sodium compiled version | 2.0.23
libsodium headers version | 1.0.18
libsodium library version | 1.0.18

From NC settings/admin/overview:

There are some warnings regarding your setup.
This instance is missing some recommended PHP modules. For improved performance and better compatibility it is highly recommended to install them.
sodium

[solracsf]

Having libsodium alone doesn't grant the ability to PHP to use it for password hashing with argon2!

For anyone having this issue, check if php is REALLY compiled with argon support with this command:

php -r 'print_r(get_defined_constants());' | grep -i argon

which should output something like:

# php -r 'print_r(get_defined_constants());' | grep -i argon
    [PASSWORD_ARGON2I] => argon2i
    [PASSWORD_ARGON2ID] => argon2id
    [PASSWORD_ARGON2_DEFAULT_MEMORY_COST] => 65536
    [PASSWORD_ARGON2_DEFAULT_TIME_COST] => 4
    [PASSWORD_ARGON2_DEFAULT_THREADS] => 1
    [PASSWORD_ARGON2_PROVIDER] => standard
    [SODIUM_CRYPTO_PWHASH_ALG_ARGON2I13] => 1
    [SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13] => 2
    [SODIUM_CRYPTO_PWHASH_STRPREFIX] => $argon2id$

Nextcloud is looking for the first line [PASSWORD_ARGON2I] => argon2i so if it doesn't output, this is the reason why Nextcloud complains about it.

PHP should be compiled with ./configure --with-password-argon2 too, in adition to have libsodium installed.

[worksmarter]

Hmm, running that command (php -r 'print_r(get_defined_constants());' | grep -i argon) against my php outputs nothing. Is it possible that my sodium module is not supporting argon at all?

Could the error be made more specific and say sodium does not support argon2? I will have to get a hold of the developers that make the PHP compiler for this and see if they are building with argon support or not.

[solracsf]

Libsodium is one thing, the PHP ability to use it is another thing.
PHP should be compiled with ./configure --with-password-argon2

https://wiki.php.net/rfc/argon2_password_hash

Closing as this is a setup issue, not a nextcloud issue.