Login attempt or request with invalid authentication - googleusercontent

[nima]

I keep getting error messages like the following:

Login attempt failed
Login attempt or request with invalid authentication from 242.23.83.34.bc.googleusercontent.com (34.83.23.242). See the log for details.

Looking in logs I see this:

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:136
integration: HTTP (documentation, issues)
First occurred: 6:46:53 AM (1 occurrences)
Last logged: 6:46:53 AM

Login attempt or request with invalid authentication from 242.23.83.34.bc.googleusercontent.com (34.83.23.242). Requested URL: ‘/media/system/js/core.js’. (Go-http-client/2.0)

Any idea how to troubleshoot or fix this?

[armedad]

that kinda looks like a google cloud vm hitting your login. do you have your home assistant on the internet? if so, it may be a random bot or crawler or hacker coming from a gcp vm.

[nima]

@armedad HA is exposed through cloudflare tunnel.

[holmesmj (Martin)]

I’m having the exact same problem as reported by OP, so super keen on figuring out where this is coming from.

I too have HA exposed through Cloudflare as OP does, but that’s all working as I can access HA remotely; so that can’t be the problem.

The only other thing I can think of, as all my integrations are working, is that I trialed the HA Cloud service, so maybe that’s trying to authenticate?

Is there any way of adding more verbose logging in one area?

[nima]

I never tried HA Cloud FWIW. Cloudflared is working fine for access. It’s not that. It is consistent with a bot of some kind. I’m not sure who/why or how to log better to solve it though. Hopefully someone has tips!

[borsa93]

Hi all, same issue here. I’m accessing externally with cloudflare.

Any suggestion to fix the problem?

[Yachtmed]

I used the security tab from cloudfare site, blocked anything that showed heavy traffic shown in analysis.

[nima]

Well, I saw this:

HOWTO: Secure Cloudflare Tunnels remote access

Edit Aug 2024: Just had someone point out Matterbridge (also available as a Home Assistant addon) which does what it says on the box, it bridges HA devices to Matter. This means both Google Home and Alexa (and Homekit too, but that already worked locally) can see anything in HA as a matter device, even if it’s native wifi or bluetooth or zigbee or whatever, and trigger everything locally! Secure and fast, that’s what we want. It’s still pretty early days for Matterbridge and the HASS addon aut…

I haven’t gone down that path. Frankly I’m a little overwhelmed managing things on cloudflare. Their website is simultaneously slick yet difficult for me to navigate. Especially with my limited knowledge in this arena not to mention things being split between CF and zero trust web portals

[borsa93]

Hi all, i’ve been able to manage directly with Cloudflare web site padding some rules on the firewall.

I can try to help if is needed.

For the moment I blocked all the areas out of my country.

[bl8demast3r]

Yup same here, the notifications are driving me insane.

Also, do you have the Google Assistant integration? I’m wondering if maybe that’s causing it.

[fleskefjes]

I also get this from time to time, and I am not running Cloudflare or Google Assistant, I have ngnix in front of HA.
It’s probably something running in GCP scanning wide ranges of ip addresses.

[berthome (Bert Arends)]

I am also running Cloudflare and have the same problem.
So far as I see it is caused by bots running on the internet, most likely ‘bad’ bots.
I think everyone who has enabled access to HA from the internet can run into this problem. When your internet access is secure this login attempts are I think annoying but not more.
I also think @borsa93 is right that the only way to try to avoid this login attempts messages are rules on the firewall, so in the configuration of Cloudfare. So far I did not dive into that.

[berthome (Bert Arends)]

Can you tell or give links to documentation how to do this ?

[nima]

Thanks. Do you have instructions somewhere on this?

[borsa93]

Hi all, I try to describe all the step to be followed.

First of all login to your dashboard inside Cloudflare and select the domain you want to filter, then the steps indicated bleow allow you to create your own rules.

this is the rule that I’ve created that block all the IPs coming from countries different to Italy and Ireland. (please note that I added also Ireland to continue to use Alexa with Hasska method)

in addition my suggestion is also to add the ip-ban inside the configuration of Home assistant as follow to avoid possible unfiltered attempts::

http:
  ip_ban_enabled: true
  login_attempts_threshold: 1

[berthome (Bert Arends)]

Thanks for your effort.
Have taken a look at the steps, also on Cloudflare and seems not to be to complicated. So will give it a try soon.

Ip_ban was already enabled but threshold was 5. Lowered it to 1.

[berthome (Bert Arends)]

Have implemented the rule in Cloudflare WAF and seems to work for me. In more than 24 hours I didn’t receive any ‘Login attempt’ messages. Living in the Netherlands, only nice people here
Of course it is not a quarantee that you don’t get any of this messages anymore but at least it will be less.

[hainfelder]

Well. I do have the same. Not everyday, but …

I do also have cloudflare running. Also Google Calendar integration.
And I was suspecting the Google Calender Integration to be the culprit. But Calender is showing just fine.

Does anyone of you also have the Google Calender Integration running?

[nima]

no, i do not

[nima]

@berthome

ms to work for me. In more than 24 hours I didn’t receive any ‘Login attempt’ messages. Living in the Net

I previously had WAF blocking countries like China, Iran, Russia but I will give this a shot, reversing to only allow my country. Went with more lenient ip_ban of 2 to start and will report back here for others dealing with this. If it works, I just need to remember to turn off this rule when I travel overseas!