File Manager - BorneoXploit

Editing: security_setup_warnings.html

<!DOCTYPE html>
<html class="writer-html5" lang="en" data-content_root="../">
<head>
  <meta charset="utf-8" />
  <meta name="readthedocs-addons-api-version" content="1"><meta name="viewport" content="width=device-width, initial-scale=1" />

<a href="../contents.html">
            
              <img src="../_static/logo-white.png" class="logo" alt="Logo"/>
          </a>
              <div class="switch-menus">
                <div class="version-switch"></div>
                <div class="language-switch"></div>
              </div>
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>
        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
              <p class="caption" role="heading"><span class="caption-text">Getting Started</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../index.html">Introduction</a></li>
<li class="toctree-l1"><a class="reference internal" href="../release_schedule.html">Maintenance and release schedule</a></li>
<li class="toctree-l1"><a class="reference internal" href="../gdpr/index.html">GDPR-compliance</a></li>
<li class="toctree-l1"><a class="reference internal" href="../declarations/index.html">Declarations</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Release notes</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../release_notes/index.html">Critical changes</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../installation/index.html">Installation and server configuration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_database/index.html">Database configuration</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Configuration</span></p>
<ul class="current">
<li class="toctree-l1 current"><a class="reference internal" href="index.html">Nextcloud configuration</a><ul class="current">
<li class="toctree-l2 current"><a class="current reference internal" href="#">Warnings on admin page</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#cache-warnings">Cache warnings</a></li>
<li class="toctree-l3"><a class="reference internal" href="#transactional-file-locking-is-disabled">Transactional file locking is disabled</a></li>
<li class="toctree-l3"><a class="reference internal" href="#you-are-accessing-this-site-via-http">You are accessing this site via HTTP</a></li>
<li class="toctree-l3"><a class="reference internal" href="#the-test-with-getenv-path-only-returns-an-empty-response">The test with getenv(&quot;PATH&quot;) only returns an empty response</a></li>
<li class="toctree-l3"><a class="reference internal" href="#the-strict-transport-security-http-header-is-not-configured">The “Strict-Transport-Security” HTTP header is not configured</a></li>
<li class="toctree-l3"><a class="reference internal" href="#dev-urandom-is-not-readable-by-php">/dev/urandom is not readable by PHP</a></li>
<li class="toctree-l3"><a class="reference internal" href="#your-web-server-is-not-yet-set-up-properly-to-allow-file-synchronization">Your Web server is not yet set up properly to allow file synchronization</a></li>
<li class="toctree-l3"><a class="reference internal" href="#outdated-nss-openssl-version">Outdated NSS / OpenSSL version</a></li>
<li class="toctree-l3"><a class="reference internal" href="#your-web-server-is-not-set-up-properly-to-resolve-well-known-caldav-or-well-known-carddav">Your Web server is not set up properly to resolve /.well-known/caldav/ or /.well-known/carddav/</a></li>
<li class="toctree-l3"><a class="reference internal" href="#some-files-have-not-passed-the-integrity-check">Some files have not passed the integrity check</a></li>
<li class="toctree-l3"><a class="reference internal" href="#your-database-does-not-run-with-read-committed-transaction-isolation-level">Your database does not run with “READ COMMITTED” transaction isolation level</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="config_sample_php_parameters.html">Configuration Parameters</a></li>
<li class="toctree-l2"><a class="reference internal" href="activity_configuration.html">Activity app</a></li>
<li class="toctree-l2"><a class="reference internal" href="admin_delegation_configuration.html">Administration privileges (Delegation)</a></li>
<li class="toctree-l2"><a class="reference internal" href="android_deep_link_handling.html">Android Deep Link Handling</a></li>
<li class="toctree-l2"><a class="reference internal" href="antivirus_configuration.html">Antivirus scanner</a></li>
<li class="toctree-l2"><a class="reference internal" href="automatic_configuration.html">Automatic setup</a></li>
<li class="toctree-l2"><a class="reference internal" href="background_jobs_configuration.html">Background jobs</a></li>
<li class="toctree-l2"><a class="reference internal" href="bruteforce_configuration.html">Brute force protection</a></li>
<li class="toctree-l2"><a class="reference internal" href="caching_configuration.html">Memory caching</a></li>
<li class="toctree-l2"><a class="reference internal" href="dashboard_configuration.html">Dashboard app</a></li>
<li class="toctree-l2"><a class="reference internal" href="domain_change.html">Domain Change</a></li>
<li class="toctree-l2"><a class="reference internal" href="email_configuration.html">Email</a></li>
<li class="toctree-l2"><a class="reference internal" href="external_sites.html">Linking external sites</a></li>
<li class="toctree-l2"><a class="reference internal" href="language_configuration.html">Language &amp; Locale</a></li>
<li class="toctree-l2"><a class="reference internal" href="logging_configuration.html">Logging</a></li>
<li class="toctree-l2"><a class="reference internal" href="oauth2.html">OAuth2</a></li>
<li class="toctree-l2"><a class="reference internal" href="reverse_proxy_configuration.html">Reverse proxy</a></li>
<li class="toctree-l2"><a class="reference internal" href="text_configuration.html">Text app</a></li>
<li class="toctree-l2"><a class="reference internal" href="theming.html">Theming</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../occ_command.html">Using the occ command</a></li>
<li class="toctree-l1"><a class="reference internal" href="../reference/index.html">Reference management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../webhook_listeners/index.html">Webhook Listeners</a></li>
<li class="toctree-l1"><a class="reference internal" href="../windmill_workflows/index.html">Windmill Workflows</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Files</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_files/index.html">File sharing and management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../file_workflows/index.html">Flow</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_mimetypes/index.html">Mimetypes management</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Apps</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../apps_management.html">Apps management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../exapps_management/index.html">ExApps management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../ai/index.html">Artificial Intelligence</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Users</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_user/index.html">User management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../desktop/index.html">Desktop Clients</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Groupware</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../groupware/index.html">Groupware</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Office</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../office/index.html">Office</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Maintenance</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_monitoring/index.html">Monitoring</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintenance/index.html">Maintenance</a></li>
<li class="toctree-l1"><a class="reference internal" href="../issues/index.html">Issues and troubleshooting</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Links</span></p>
<ul>
<li class="toctree-l1"><a class="reference external" href="https://help.nextcloud.com/">Community Help Forum</a></li>
<li class="toctree-l1"><a class="reference external" href="https://docs.nextcloud.com/">User Manuals</a></li>
<li class="toctree-l1"><a class="reference external" href="https://docs.nextcloud.com/">Developer Manuals</a></li>
<li class="toctree-l1"><a class="reference external" href="https://nextcloud.com/install/">Download</a></li>
<li class="toctree-l1"><a class="reference external" href="https://apps.nextcloud.com">App Store</a></li>
<li class="toctree-l1"><a class="reference external" href="https://help.nextcloud.com/t/translation-knowledge-valid-for-the-entire-nextcloud-project-wiki/51550">Translations</a></li>
<li class="toctree-l1"><a class="reference external" href="https://github.com/nextcloud/">GitHub</a></li>
<li class="toctree-l1"><a class="reference external" href="https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule">Supported versions</a></li>
<li class="toctree-l1"><a class="reference external" href="https://nextcloud.com/enterprise/">Nextcloud Enterprise</a></li>
<li class="toctree-l1"><a class="reference external" href="https://github.com/nextcloud/server/blob/master/COPYING-README">License</a></li>
<li class="toctree-l1"><a class="reference external" href="https://nextcloud.com/">Nextcloud GmbH</a></li>
</ul>

</div>
      </div>
    </nav>

<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../contents.html">Nextcloud latest Administration Manual</a>
      </nav>

<div class="wy-nav-content">
        <div class="rst-content style-external-links">
          <div role="navigation" aria-label="Page navigation">
  <ul class="wy-breadcrumbs">
      <li><a href="../contents.html" class="icon icon-home" aria-label="Home"></a></li>
          <li class="breadcrumb-item"><a href="index.html">Nextcloud configuration</a></li>
      <li class="breadcrumb-item active">Warnings on admin page</li>
      <li class="wy-breadcrumbs-aside">
              <a href="https://github.com/nextcloud/documentation/edit/master/admin_manual/configuration_server/security_setup_warnings.rst" class="fa fa-github"> Edit on GitHub</a>
      </li>
  </ul>
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
             
  <section id="warnings-on-admin-page">
<h1>Warnings on admin page<a class="headerlink" href="#warnings-on-admin-page" title="Link to this heading"></a></h1>
<p>Your Nextcloud server has a built-in configuration checker, and it reports its
findings at the top of your Admin page. These are some of the warnings you
might see, and what to do about them.</p>
<figure class="align-default">
<img alt="../_images/security-setup-warning-1.png" src="../_images/security-setup-warning-1.png" />
</figure>
<p>You can use the  <a class="reference external" href="https://scan.nextcloud.com">Nextcloud Security Scan</a> to see
if your system is up to date and well secured. We have ran this scan over public
IP addresses in the past to try and reach out to <a class="reference external" href="https://nextcloud.com/blog/nextcloud-releases-security-scanner-to-help-protect-private-clouds/">extremely outdated systems</a>
and might again in the future. Please, protect your privacy and keep your server
up to date! Privacy means little without security.</p>
<section id="cache-warnings">
<h2>Cache warnings<a class="headerlink" href="#cache-warnings" title="Link to this heading"></a></h2>
<p>“No memory cache has been configured. To enhance your performance please
configure a memcache if available.” Nextcloud supports multiple php caching
extensions:</p>
<ul class="simple">
<li><p>APCu (minimum required PHP extension version 4.0.6)</p></li>
<li><p>Memcached</p></li>
<li><p>Redis (minimum required PHP extension version: 2.2.6)</p></li>
</ul>
<p>You will see this warning if you have no caches installed and enabled, or if
your cache does not have the required minimum version installed; older versions
are disabled because of performance problems.</p>
<p>If you see “<em>{Cache}</em> below version <em>{Version}</em> is installed. for stability and
performance reasons we recommend to update to a newer <em>{Cache}</em> version” then
you need to upgrade, or, if you’re not using it, remove it.</p>
<p>You are not required to use any caches, but caches improve server performance.
See <a class="reference internal" href="caching_configuration.html"><span class="doc">Memory caching</span></a>.</p>
</section>
<section id="transactional-file-locking-is-disabled">
<h2>Transactional file locking is disabled<a class="headerlink" href="#transactional-file-locking-is-disabled" title="Link to this heading"></a></h2>
<p>“Transactional file locking is disabled, this might lead to issues with race
conditions.”</p>
<p>Please see <a class="reference internal" href="../configuration_files/files_locking_transactional.html"><span class="doc">Transactional file locking</span></a> on how
to correctly configure your environment for transactional file locking.</p>
</section>
<section id="you-are-accessing-this-site-via-http">
<h2>You are accessing this site via HTTP<a class="headerlink" href="#you-are-accessing-this-site-via-http" title="Link to this heading"></a></h2>
<p>“You are accessing this site via HTTP. We strongly suggest you configure your
server to require using HTTPS instead.” Please take this warning seriously;
using HTTPS is a fundamental security measure. You must configure your Web
server to support it, and then there are some settings in the <strong>Security</strong>
section of your Nextcloud Admin page to enable. The following pages
describe how to enable HTTPS on the Apache and Nginx Web servers.</p>
<p><a class="reference internal" href="../installation/source_installation.html#enabling-ssl-label"><span class="std std-ref">Enabling SSL</span></a> (on Apache)</p>
<p><a class="reference internal" href="../installation/harden_server.html#use-https-label"><span class="std std-ref">Use HTTPS</span></a></p>
<p><a class="reference internal" href="../installation/nginx.html"><span class="doc">NGINX configuration</span></a></p>
</section>
<section id="the-test-with-getenv-path-only-returns-an-empty-response">
<h2>The test with getenv(&quot;PATH&quot;) only returns an empty response<a class="headerlink" href="#the-test-with-getenv-path-only-returns-an-empty-response" title="Link to this heading"></a></h2>
<p>Some environments are not passing a valid PATH variable to Nextcloud. The
<a class="reference internal" href="../installation/source_installation.html#php-fpm-tips-label"><span class="std std-ref">PHP-FPM configuration</span></a> provides the information about how to configure your
environment.</p>
</section>
<section id="the-strict-transport-security-http-header-is-not-configured">
<h2>The “Strict-Transport-Security” HTTP header is not configured<a class="headerlink" href="#the-strict-transport-security-http-header-is-not-configured" title="Link to this heading"></a></h2>
<p>“The “Strict-Transport-Security” HTTP header is not configured to least “15552000” seconds.
For enhanced security we recommend enabling HSTS as described in our security tips.”</p>
<p>The HSTS header needs to be configured within your Web server by following the
<a class="reference internal" href="../installation/harden_server.html#enable-hsts-label"><span class="std std-ref">Enable HTTP Strict Transport Security</span></a> documentation</p>
<p>You can see if the header is appearing in requests by using your browser inspector
or using a tool such as cURL: <code class="docutils literal notranslate"><span class="pre">curl</span> <span class="pre">--head</span> <span class="pre">https://cloud.domain.tld</span></code>.</p>
</section>
<section id="dev-urandom-is-not-readable-by-php">
<h2>/dev/urandom is not readable by PHP<a class="headerlink" href="#dev-urandom-is-not-readable-by-php" title="Link to this heading"></a></h2>
<p>“/dev/urandom is not readable by PHP which is highly discouraged for security reasons.
Further information can be found in our documentation.”</p>
<p>This message is another one which needs to be taken seriously. Please have a look
at the <a class="reference internal" href="../installation/harden_server.html#dev-urandom-label"><span class="std std-ref">Give PHP read access to /dev/urandom</span></a> documentation.</p>
</section>
<section id="your-web-server-is-not-yet-set-up-properly-to-allow-file-synchronization">
<h2>Your Web server is not yet set up properly to allow file synchronization<a class="headerlink" href="#your-web-server-is-not-yet-set-up-properly-to-allow-file-synchronization" title="Link to this heading"></a></h2>
<p>“Your web server is not yet set up properly to allow file synchronization because
the WebDAV interface seems to be broken.”</p>
<p>At the ownCloud community forums a larger <a class="reference external" href="https://forum.owncloud.org/viewtopic.php?f=17&amp;t=7536">FAQ</a>
is maintained containing various information and debugging hints.</p>
</section>
<section id="outdated-nss-openssl-version">
<h2>Outdated NSS / OpenSSL version<a class="headerlink" href="#outdated-nss-openssl-version" title="Link to this heading"></a></h2>
<p>“cURL is using an outdated OpenSSL version (OpenSSL/$version). Please update your
operating system or features such as installing and updating apps via the app store
or Federated Cloud Sharing will not work reliably.”</p>
<p>“cURL is using an outdated NSS version (NSS/$version). Please update your operating
system or features such as installing and updating apps via the app store or Federated
Cloud Sharing will not work reliably.”</p>
<p>There are known bugs in older OpenSSL and NSS versions leading to misbehavior in
combination with remote hosts using SNI. A technology used by most of the HTTPS
websites. To ensure that Nextcloud will work properly you need to update OpenSSL
to at least 1.0.2b or 1.0.1d. For NSS the patch version depends on your distribution
and an heuristic is running the test which actually reproduces the bug.</p>
</section>
<section id="your-web-server-is-not-set-up-properly-to-resolve-well-known-caldav-or-well-known-carddav">
<h2>Your Web server is not set up properly to resolve /.well-known/caldav/ or /.well-known/carddav/<a class="headerlink" href="#your-web-server-is-not-set-up-properly-to-resolve-well-known-caldav-or-well-known-carddav" title="Link to this heading"></a></h2>
<p>Both URLs need to be correctly redirected to the DAV endpoint of Nextcloud. Please
refer to <a class="reference internal" href="../issues/general_troubleshooting.html#service-discovery-label"><span class="std std-ref">Service discovery</span></a> for more info.</p>
</section>
<section id="some-files-have-not-passed-the-integrity-check">
<h2>Some files have not passed the integrity check<a class="headerlink" href="#some-files-have-not-passed-the-integrity-check" title="Link to this heading"></a></h2>
<p>Please refer to the <a class="reference internal" href="../issues/code_signing.html#code-signing-fix-warning-label"><span class="std std-ref">Fixing invalid code integrity messages</span></a> documentation how to debug this issue.</p>
</section>
<section id="your-database-does-not-run-with-read-committed-transaction-isolation-level">
<h2>Your database does not run with “READ COMMITTED” transaction isolation level<a class="headerlink" href="#your-database-does-not-run-with-read-committed-transaction-isolation-level" title="Link to this heading"></a></h2>
<p>“Your database does not run with “READ COMMITTED” transaction isolation level.
This can cause problems when multiple actions are executed in parallel.”</p>
<p>Please refer to <a class="reference internal" href="../configuration_database/linux_database_configuration.html#db-transaction-label"><span class="std std-ref">Database “READ COMMITTED” transaction isolation level</span></a> how to configure your database for this requirement.</p>
</section>
</section>

</div>
          </div>
          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
        <a href="index.html" class="btn btn-neutral float-left" title="Nextcloud configuration" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
        <a href="config_sample_php_parameters.html" class="btn btn-neutral float-right" title="Configuration Parameters" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
    </div>

<hr/>

<div role="contentinfo">
    <p>&#169; Copyright 2016-2026 Nextcloud GmbH and Nextcloud contributors.</p>
  </div>

</footer>
        </div>
      </div>
    </section>
  </div>

<div class="rst-versions" data-toggle="rst-versions" role="note" aria-label="versions">
    <span class="rst-current-version" data-toggle="rst-current-version">
      ☁️ latest
      <span class="fa fa-caret-down"></span>
    </span>
    <div class="rst-other-versions">
      <dl>
        <dt>☁️ Versions</dt>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/latest/admin_manual"
             
             style="color: var(--dark-link-color);"
             
          >
            latest
          </a>
        </dd>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/stable/admin_manual"
             
          >
            stable
          </a>
        </dd>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/32/admin_manual"
             
          >
            32
          </a>
        </dd>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/31/admin_manual"
             
          >
            31
          </a>
        </dd>
        
      </dl>
    </div>
  </div>
<script>
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

</body>
</html>

Cancel