How to revoke Thousands of Security (device/sessions) lines from months back

[eggithub]

Steps to reproduce

1. Just look in the personal settings

Expected behaviour

Would expect for old sessions to disappear after a while and new sessions showing up

Actual behaviour

only old sessions from 7-10 month ago are visible (by number a 1000+), no new sessions visible for browsers etc...

I have seen this issue dating back from 7 months ago I guess so a lot of pervious versions had the same issue.

Config

for server config check: #4535

related perhaps?

Sample sesssion log:

CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
Sync client - Windows 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
CardDAV-Sync/0.4.20 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.carddav.Sync/142) 7 months ago
CardDAV-Sync/0.4.20 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.carddav.Sync/142) 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
Sync client - Windows 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
Firefox 49 - Windows 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
Sync client - Windows 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
Firefox 49 - Windows 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
CardDAV-Sync/0.4.20 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.carddav.Sync/142) 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago
Sync client - Windows 7 months ago
CalDAV-Sync/0.4.28 (samsung; s5neoltexx; Android 5.1.1; en_GB; org.dmfs.caldav.lib/741; like iOS/5.0.1 (9A405) dataaccessd/1.0) 7 months ago

Is there a way to completely clean the sessions log? Revoking them one-by-one is not really an option ;-)

[simonspa]

I have the same issue, also lots of old sessions but no new ones showing up. I am adding this comment only, because @eggithub has the issue with nextcloud 11, while for me it's nextcloud 12.

Here is my server config:

Server configuration

Operating system:
Linux raspberrypi 4.4.50-v7+ #970 SMP Mon Feb 20 19:18:29 GMT 2017 armv7l GNU/Linux

Web server:
nginx version: nginx/1.6.2

Database:
mysql Ver 15.1 Distrib 10.0.30-MariaDB, for debian-linux-gnueabihf (armv7l) using readline 5.2

PHP version:
PHP 5.6.30-0+deb8u1 (fpm-fcgi) (built: Apr 14 2017 17:09:11)

Nextcloud version: (see Nextcloud admin page)
12.0.0

Updated from an older Nextcloud/ownCloud or fresh install:
Updated since years from a very early owncloud instance...

Nextcloud configuration:

Config report

{
    "system": {
        "instanceid": "oc0e7rzi20xo",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "192.168.2.130",
            "***REMOVED***"
        ],
        "datadirectory": "\/media\/data\/ocdata",
        "overwrite.cli.url": "https:\/\/192.168.2.130\/owncloud",
        "dbtype": "mysql",
        "version": "12.0.0.29",
        "dbname": "owncloud",
        "dbhost": "localhost",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "maintenance": false,
        "memcache.local": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "127.0.0.1",
            "port": 6379,
            "timeout": 0
        },
        "log_rotate_size": "100MiB",
        "theme": "",
        "loglevel": 2,
        "mail_from_address": "notifications",
        "mail_smtpmode": "smtp",
        "mail_domain": "***REMOVED***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED***",
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "htaccess.RewriteBase": "\/owncloud",
        "updater.release.channel": "stable"
    }
}

[eggithub]

I have it with 12.0.0 as well

@simonspa did you used to be by any chance a long term owncloud user?

[eggithub]

Issue still persists with 12.0.1 and 12.0.2
When I try to revoke certain lines "newer" old sessions appear in the list. Only a certain number are displayed (1000?) but thousands are probably in my database somewhere?

Is there are way to revoke all sessions / security lines add once, or maybe add this options to the next NC version?

[MorrisJobke]

Let's continue this in #6203 and close this as duplicate of it.

Thanks