Presence of the php sodium module not tested

[tuxmaster]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

The presence of the PHP sodium module is not tested on start up.

Steps to reproduce

1. migrate NC from one server to anther (all files + database)

Expected behavior

That all works like before, because the needed PHP modules are tested on start up.

Installation method

Community Manual installation with Archive

Nextcloud Server version

25

Operating system

RHEL/CentOS

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

PHP Deprecated:  Optional parameter $userId declared before required parameter $filter is implicitly treated as a required parameter in /var/www/nextcloud/apps/sharelisting/lib/Service/SharesList.php on line 193
{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "XXXX"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "25.0.10.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "forcessl": true,
        "maxZipInputSize": 83886080,
        "allowZipDownload": true,
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "log_type": "syslog",
        "loglevel": 0,
        "logtimezone": "Europe\/Berlin",
        "log_authfailip": true,
        "theme": "",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "forceSSLforSubdomains": true,
        "maintenance": false,
        "asset-pipeline.enabled": true,
        "updatechecker": true,
        "htaccess.RewriteBase": "\/",
        "filelocking.enabled": true,
        "mysql.utf8mb4": true,
        "overwrite.cli.url": "https:\/\/XXXXXX",
        "updater.release.channel": "stable",
        "app_install_overwrite": [
            "dicomviewer",
            "socialsharing_email"
        ],
        "default_phone_region": "DE",
        "memcache.local": "\\OC\\Memcache\\APCu"
    }
}

List of activated Apps

PHP Deprecated:  Optional parameter $userId declared before required parameter $filter is implicitly treated as a required parameter in /var/www/nextcloud/apps/sharelisting/lib/Service/SharesList.php on line 193
Enabled:
  - activity: 2.17.0
  - admin_audit: 1.15.0
  - bruteforcesettings: 2.5.0
  - calendar: 4.4.4
  - camerarawpreviews: 0.8.2
  - checksum: 1.2.2
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contacts: 5.3.2
  - contactsinteraction: 1.6.0
  - dav: 1.24.0
  - deck: 1.8.5
  - dicomviewer: 1.2.4
  - drawio: 2.1.2
  - federatedfilesharing: 1.15.0
  - files: 1.20.1
  - files_pdfviewer: 2.6.0
  - files_retention: 1.14.1
  - files_rightclick: 1.4.0
  - files_sharing: 1.17.0
  - guests: 2.5.0
  - lookup_server_connector: 1.13.0
  - metadata: 0.19.0
  - nextcloud_announcements: 1.14.0
  - notifications: 2.13.1
  - oauth2: 1.13.1
  - password_policy: 1.15.0
  - photos: 2.0.1
  - piwik: 0.12.0
  - privacy: 1.9.0
  - provisioning_api: 1.15.0
  - quota_warning: 1.17.0
  - recommendations: 1.4.0
  - related_resources: 1.0.4
  - serverinfo: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - sharelisting: 1.1.1
  - socialsharing_email: 2.6.0
  - survey_client: 1.13.0
  - systemtags: 1.15.0
  - tasks: 0.15.0
  - text: 3.6.0
  - theming: 2.0.1
  - twofactor_backupcodes: 1.14.0
  - twofactor_totp: 7.0.0
  - twofactor_webauthn: 1.2.0
  - updatenotification: 1.15.0
  - viewer: 1.9.0
  - workflowengine: 2.7.0
Disabled:
  - dashboard: 7.0.0
  - encryption
  - federation: 1.6.0
  - files_external: 1.7.0
  - files_trashbin: 1.10.1
  - files_versions: 1.0.3
  - firstrunwizard: 1.0
  - logreader: 2.10.0
  - support: 1.5.0
  - suspicious_login
  - user_ldap
  - user_status: 1.2.0
  - weather_status: 1.1.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"ZN-A4xCq-aEackAvN4v8rgAAlQA","level":2,"time":"2023-08-18T16:32:04+02:00","remoteAddr":"XXX","user":"--","app":"no app in context","method":"POST","url":"/login","message":"Login failed: XXXX (Remote IP: XXXXX)","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0","version":"25.0.10.1","data":[]}

Additional info

In the log you find only the error's that the users's can't log in.
But in real in fails because the password hash can't be verified because of the missing PHP module.
And no message in the log about unsupported password hash algorithm.
The module is also not listed in the needed modules of the documentation:
https://docs.nextcloud.com/server/latest/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

Required:

PHP (see [System requirements](https://docs.nextcloud.com/server/latest/admin_manual/installation/system_requirements.html) for a list of supported versions)

PHP module ctype

PHP module curl

PHP module dom

PHP module fileinfo (included with PHP)

PHP module filter (only on Mageia and FreeBSD)

PHP module GD

PHP module hash (only on FreeBSD)

PHP module JSON (included with PHP >= 8.0)

PHP module libxml (Linux package libxml2 must be >=2.7.0)

PHP module mbstring

PHP module openssl (included with PHP >= 8.0)

PHP module posix

PHP module session

PHP module SimpleXML

PHP module XMLReader

PHP module XMLWriter

PHP module zip

PHP module zlib

Database connectors (pick the one for your database:)

PHP module pdo_sqlite (>= 3, usually not recommended for performance reasons)

PHP module pdo_mysql (MySQL/MariaDB)

PHP module pdo_pgsql (PostgreSQL)

Recommended packages:

PHP module bz2 (recommended, required for extraction of apps)

PHP module intl (increases language translation performance and fixes sorting of non-ASCII characters)

Required for specific apps:

PHP module ldap (for LDAP integration)

PHP module smbclient ([SMB/CIFS](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/external_storage/smb.html) integration, see SMB/CIFS)

PHP module ftp (for FTP storage / external user authentication)

PHP module imap (for external user authentication)

PHP module bcmath (for passwordless login)

PHP module gmp (for passwordless login)

Recommended for specific apps (optional):

PHP module gmp (for SFTP storage)

PHP module exif (for image rotation in pictures app)

For enhanced server performance (optional) select one of the following memcaches:

PHP module apcu (>= 4.0.6)

PHP module memcached

PHP module redis (>= 2.2.6, required for Transactional File Locking)

See Memory caching to learn how to select and configure a memcache.

For preview generation (optional):

PHP module imagick

avconv or ffmpeg

OpenOffice or LibreOffice

Nothing about the sodium module.

[solracsf]

server/apps/settings/lib/Controller/CheckSetupController.php

Lines 773 to 779 in f3a3ece

	if (!defined('PASSWORD_ARGON2I')) {
	// Installing php-sodium on >=php7.4 will provide PASSWORD_ARGON2I
	// on previous version argon2 wasn't part of the "standard" extension
	// and RedHat disabled it so even installing php-sodium won't provide argon2i
	// support in password_hash/password_verify.
	$recommendedPHPModules[] = 'sodium';
	}

Any output at /settings/admin/overview?

[tuxmaster]

As I understand the code, it will not really helps, because it looks like the chicken egg problem.
You can see the warning about the missing module only after login, but the login fails because of the missing module.

[kesselb]

php-sodium is not a hard requirement.
If the module is available, we use it to hash passwords.
Is at least one password hashed with argon2, it's a hard requirement.

Adding sodium to our docs sounds good.

[solracsf]

This is not a bug; as @kesselb states, you've migrated between servers; if you had passwords already hashed with argon2, then yes, you must have it on the new server too otherwise it fails.

[kesselb]

That said, I'm not against a check, but I don't know how to implement it properly.

This query could help to figure out if there are passwords hashed with argon2i or argon2id: select count(*) from oc_authtoken where password_hash like '3|%' or password_hash like '2|%';

Maybe that's something for our troubleshooting docs.

It looks also okay to make sodium a require module. They were some weird packaging issues in the past around the argon2 support in PHP for RHEL/CentOS with the Remi packages, as discussed at #28398.

Is that solved today? ;)

[tuxmaster]

I use the sodium module of the remi repo. And it works for RHEL7 and RHEL9. (And all clones) I don't have tested on RHEL8.

[kesselb]

The packaging issue back then:

• enable support of Argon2 hashes in PHP 7.4 remicollet/remirepo#137
• Unable to login after Fedora 31>32 upgrade  #21100
• Check that php was compiled with argon2 support or that the php-sodium extensions is installed #28259