File Manager - BorneoXploit

Editing: harden_server.html

<!DOCTYPE html>
<html class="writer-html5" lang="en" data-content_root="../">
<head>
  <meta charset="utf-8" />
  <meta name="readthedocs-addons-api-version" content="1"><meta name="viewport" content="width=device-width, initial-scale=1" />

<a href="../contents.html">
            
              <img src="../_static/logo-white.png" class="logo" alt="Logo"/>
          </a>
              <div class="switch-menus">
                <div class="version-switch"></div>
                <div class="language-switch"></div>
              </div>
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>
        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
              <p class="caption" role="heading"><span class="caption-text">Getting Started</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../index.html">Introduction</a></li>
<li class="toctree-l1"><a class="reference internal" href="../release_schedule.html">Maintenance and release schedule</a></li>
<li class="toctree-l1"><a class="reference internal" href="../gdpr/index.html">GDPR-compliance</a></li>
<li class="toctree-l1"><a class="reference internal" href="../declarations/index.html">Declarations</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Release notes</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../release_notes/index.html">Critical changes</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Installation</span></p>
<ul class="current">
<li class="toctree-l1 current"><a class="reference internal" href="index.html">Installation and server configuration</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="system_requirements.html">System requirements</a></li>
<li class="toctree-l2"><a class="reference internal" href="deployment_recommendations.html">Deployment recommendations</a></li>
<li class="toctree-l2"><a class="reference internal" href="php_configuration.html">Preparing PHP</a></li>
<li class="toctree-l2"><a class="reference internal" href="source_installation.html">Installation on Linux</a></li>
<li class="toctree-l2"><a class="reference internal" href="installation_wizard.html">Installation wizard</a></li>
<li class="toctree-l2"><a class="reference internal" href="command_line_installation.html">Installing from command line</a></li>
<li class="toctree-l2"><a class="reference internal" href="selinux_configuration.html">SELinux configuration</a></li>
<li class="toctree-l2"><a class="reference internal" href="nginx.html">NGINX configuration</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="#">Hardening and security guidance</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#passwords">Passwords</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#storage-of-access-tokens">Storage of access tokens</a></li>
<li class="toctree-l4"><a class="reference internal" href="#limit-on-password-length">Limit on password length</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#operating-system">Operating system</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#give-php-read-access-to-dev-urandom">Give PHP read access to <code class="docutils literal notranslate"><span class="pre">/dev/urandom</span></code></a></li>
<li class="toctree-l4"><a class="reference internal" href="#enable-hardening-modules-such-as-selinux">Enable hardening modules such as SELinux</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#deployment">Deployment</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#place-data-directory-outside-of-the-web-root">Place data directory outside of the web root</a></li>
<li class="toctree-l4"><a class="reference internal" href="#disable-preview-image-generation">Disable preview image generation</a></li>
<li class="toctree-l4"><a class="reference internal" href="#disable-debug-mode">Disable Debug Mode</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#use-https">Use HTTPS</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#redirect-all-unencrypted-traffic-to-https">Redirect all unencrypted traffic to HTTPS</a></li>
<li class="toctree-l4"><a class="reference internal" href="#enable-http-strict-transport-security">Enable HTTP Strict Transport Security</a></li>
<li class="toctree-l4"><a class="reference internal" href="#proper-ssl-configuration">Proper SSL configuration</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#restrict-admin-actions-to-a-specific-range-of-ip-addresses">Restrict admin actions to a specific range of IP addresses</a></li>
<li class="toctree-l3"><a class="reference internal" href="#use-a-dedicated-domain-for-nextcloud">Use a dedicated domain for Nextcloud</a></li>
<li class="toctree-l3"><a class="reference internal" href="#ensure-that-your-nextcloud-instance-is-installed-in-a-dmz">Ensure that your Nextcloud instance is installed in a DMZ</a></li>
<li class="toctree-l3"><a class="reference internal" href="#serve-security-related-headers-by-the-web-server">Serve security related headers by the Web server</a></li>
<li class="toctree-l3"><a class="reference internal" href="#connections-to-remote-servers">Connections to remote servers</a></li>
<li class="toctree-l3"><a class="reference internal" href="#setup-fail2ban">Setup fail2ban</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#nextcloud-prerequisites">Nextcloud prerequisites</a></li>
<li class="toctree-l4"><a class="reference internal" href="#fail2ban-introduction">Fail2ban introduction</a></li>
<li class="toctree-l4"><a class="reference internal" href="#setup-a-filter-and-a-jail-for-nextcloud">Setup a filter and a jail for Nextcloud</a></li>
</ul>
</li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="server_tuning.html">Server tuning</a></li>
<li class="toctree-l2"><a class="reference internal" href="example_ubuntu.html">Example installation on Ubuntu 22.04 LTS</a></li>
<li class="toctree-l2"><a class="reference internal" href="example_centos.html">Example installation on CentOS 8</a></li>
<li class="toctree-l2"><a class="reference internal" href="example_openbsd.html">Example installation on OpenBSD</a></li>
<li class="toctree-l2"><a class="reference internal" href="uninstallation.html">Uninstallation</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_database/index.html">Database configuration</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Configuration</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_server/index.html">Nextcloud configuration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../occ_command.html">Using the occ command</a></li>
<li class="toctree-l1"><a class="reference internal" href="../reference/index.html">Reference management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../webhook_listeners/index.html">Webhook Listeners</a></li>
<li class="toctree-l1"><a class="reference internal" href="../windmill_workflows/index.html">Windmill Workflows</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Files</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_files/index.html">File sharing and management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../file_workflows/index.html">Flow</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_mimetypes/index.html">Mimetypes management</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Apps</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../apps_management.html">Apps management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../exapps_management/index.html">ExApps management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../ai/index.html">Artificial Intelligence</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Users</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_user/index.html">User management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../desktop/index.html">Desktop Clients</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Groupware</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../groupware/index.html">Groupware</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Office</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../office/index.html">Office</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Maintenance</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../configuration_monitoring/index.html">Monitoring</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintenance/index.html">Maintenance</a></li>
<li class="toctree-l1"><a class="reference internal" href="../issues/index.html">Issues and troubleshooting</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Links</span></p>
<ul>
<li class="toctree-l1"><a class="reference external" href="https://help.nextcloud.com/">Community Help Forum</a></li>
<li class="toctree-l1"><a class="reference external" href="https://docs.nextcloud.com/">User Manuals</a></li>
<li class="toctree-l1"><a class="reference external" href="https://docs.nextcloud.com/">Developer Manuals</a></li>
<li class="toctree-l1"><a class="reference external" href="https://nextcloud.com/install/">Download</a></li>
<li class="toctree-l1"><a class="reference external" href="https://apps.nextcloud.com">App Store</a></li>
<li class="toctree-l1"><a class="reference external" href="https://help.nextcloud.com/t/translation-knowledge-valid-for-the-entire-nextcloud-project-wiki/51550">Translations</a></li>
<li class="toctree-l1"><a class="reference external" href="https://github.com/nextcloud/">GitHub</a></li>
<li class="toctree-l1"><a class="reference external" href="https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule">Supported versions</a></li>
<li class="toctree-l1"><a class="reference external" href="https://nextcloud.com/enterprise/">Nextcloud Enterprise</a></li>
<li class="toctree-l1"><a class="reference external" href="https://github.com/nextcloud/server/blob/master/COPYING-README">License</a></li>
<li class="toctree-l1"><a class="reference external" href="https://nextcloud.com/">Nextcloud GmbH</a></li>
</ul>

</div>
      </div>
    </nav>

<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../contents.html">Nextcloud latest Administration Manual</a>
      </nav>

<div class="wy-nav-content">
        <div class="rst-content style-external-links">
          <div role="navigation" aria-label="Page navigation">
  <ul class="wy-breadcrumbs">
      <li><a href="../contents.html" class="icon icon-home" aria-label="Home"></a></li>
          <li class="breadcrumb-item"><a href="index.html">Installation and server configuration</a></li>
      <li class="breadcrumb-item active">Hardening and security guidance</li>
      <li class="wy-breadcrumbs-aside">
              <a href="https://github.com/nextcloud/documentation/edit/master/admin_manual/installation/harden_server.rst" class="fa fa-github"> Edit on GitHub</a>
      </li>
  </ul>
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
             
  <section id="hardening-and-security-guidance">
<h1>Hardening and security guidance<a class="headerlink" href="#hardening-and-security-guidance" title="Link to this heading"></a></h1>
<p>Nextcloud aims to ship with secure defaults that do not need to get modified by
administrators. However, in some cases some additional security hardening can be
applied in scenarios were the administrator has complete control over
the Nextcloud instance. This page assumes that you run Nextcloud Server on Apache2
in a Linux environment.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Nextcloud will warn you in the administration interface if some
critical security-relevant options are missing. However, it is still up to
the server administrator to review and maintain system security.</p>
</div>
<section id="passwords">
<h2>Passwords<a class="headerlink" href="#passwords" title="Link to this heading"></a></h2>
<section id="storage-of-access-tokens">
<h3>Storage of access tokens<a class="headerlink" href="#storage-of-access-tokens" title="Link to this heading"></a></h3>
<p>Upon successful authentication, Nextcloud issues an access token that clients will use for all future HTTP requests. This access token uniquely identifies a user and should not be stored on any system other than the client requesting it. The user password is also stored encrypted in the Nextcloud database. For encryption of the password, the token and an instance-specific secret is used.</p>
<p>Leakage of the access token can have negative security consequences. Depending on the data access by the actor, the risk here is different:</p>
<ul class="simple">
<li><p>An actor with access to only the access token can impersonate users and login as them.</p></li>
<li><p>An actor with access to the access token, the Nextcloud config file, and the Nextcloud database can decrypt user passwords stored in the database.</p></li>
</ul>
</section>
<section id="limit-on-password-length">
<h3>Limit on password length<a class="headerlink" href="#limit-on-password-length" title="Link to this heading"></a></h3>
<p>Nextcloud uses the bcrypt algorithm, and thus for security and performance
reasons, e.g. Denial of Service as CPU demand increases exponentially, it only
verifies the first 72 characters of passwords. This applies to all passwords
that you use in Nextcloud: user passwords, passwords on link shares, and
passwords on external shares.</p>
</section>
</section>
<section id="operating-system">
<h2>Operating system<a class="headerlink" href="#operating-system" title="Link to this heading"></a></h2>
<section id="give-php-read-access-to-dev-urandom">
<span id="dev-urandom-label"></span><h3>Give PHP read access to <code class="docutils literal notranslate"><span class="pre">/dev/urandom</span></code><a class="headerlink" href="#give-php-read-access-to-dev-urandom" title="Link to this heading"></a></h3>
<p>Nextcloud uses a <a class="reference external" href="https://tools.ietf.org/html/rfc4086#section-5.2">RFC 4086 (“Randomness Requirements for Security”)</a> compliant
mixer to generate cryptographically secure pseudo-random numbers. This means
that when generating a random number Nextcloud will request multiple random
numbers from different sources and derive from these the final random number.</p>
<p>The random number generation also tries to request random numbers from
<code class="docutils literal notranslate"><span class="pre">/dev/urandom</span></code>, thus it is highly recommended to configure your setup in such
a way that PHP is able to read random data from it.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>When having an <code class="docutils literal notranslate"><span class="pre">open_basedir</span></code> configured within your <code class="docutils literal notranslate"><span class="pre">php.ini</span></code> file,
make sure to include <code class="docutils literal notranslate"><span class="pre">/dev/urandom</span></code>.</p>
</div>
</section>
<section id="enable-hardening-modules-such-as-selinux">
<h3>Enable hardening modules such as SELinux<a class="headerlink" href="#enable-hardening-modules-such-as-selinux" title="Link to this heading"></a></h3>
<p>It is highly recommended to enable hardening modules such as SELinux where
possible. See <a class="reference internal" href="selinux_configuration.html"><span class="doc">SELinux configuration</span></a> to learn more about
SELinux.</p>
</section>
</section>
<section id="deployment">
<h2>Deployment<a class="headerlink" href="#deployment" title="Link to this heading"></a></h2>
<section id="place-data-directory-outside-of-the-web-root">
<h3>Place data directory outside of the web root<a class="headerlink" href="#place-data-directory-outside-of-the-web-root" title="Link to this heading"></a></h3>
<p>It is highly recommended to place your data directory outside of the Web root
(i.e. outside of <code class="docutils literal notranslate"><span class="pre">/var/www</span></code>). It is easiest to do this on a new
installation.</p>
</section>
<section id="disable-preview-image-generation">
<h3>Disable preview image generation<a class="headerlink" href="#disable-preview-image-generation" title="Link to this heading"></a></h3>
<p>Nextcloud is able to generate preview images of common filetypes such as images
or text files. By default the preview generation for some file types that we
consider secure enough for deployment is enabled. However,
administrators should be aware that these previews are generated using PHP
libraries written in C which might be vulnerable to attack vectors.</p>
<p>For high security deployments we recommend disabling the preview generation by
setting the <code class="docutils literal notranslate"><span class="pre">enable_previews</span></code> switch to <code class="docutils literal notranslate"><span class="pre">false</span></code> in <code class="docutils literal notranslate"><span class="pre">config.php</span></code>. As an
administrator you are also able to manage which preview providers are enabled by
modifying the <code class="docutils literal notranslate"><span class="pre">enabledPreviewProviders</span></code> option switch.</p>
</section>
<section id="disable-debug-mode">
<h3>Disable Debug Mode<a class="headerlink" href="#disable-debug-mode" title="Link to this heading"></a></h3>
<p>Verify that <code class="docutils literal notranslate"><span class="pre">debug</span></code> is <code class="docutils literal notranslate"><span class="pre">false</span></code> in your <code class="docutils literal notranslate"><span class="pre">config.php</span></code>. The default is <code class="docutils literal notranslate"><span class="pre">false</span></code>
in new installations (or when not specified). It should not be enabled in production
environments or outside of targeted troubleshooting situations. When enabled, things
like server-wide WebDAV collection listings are permitted. It is intended for local
development and usage in controlled environments only.</p>
</section>
</section>
<section id="use-https">
<span id="use-https-label"></span><h2>Use HTTPS<a class="headerlink" href="#use-https" title="Link to this heading"></a></h2>
<p>Using Nextcloud without using an encrypted HTTPS connection opens up your server
to a man-in-the-middle (MITM) attack, and risks the interception of user data
and passwords. It is a best practice, and highly recommended, to always use
HTTPS on production servers, and to never allow unencrypted HTTP.</p>
<p>How to setup HTTPS on your Web server depends on your setup; please consult the
documentation for your HTTP server. The following examples are for Apache.</p>
<section id="redirect-all-unencrypted-traffic-to-https">
<h3>Redirect all unencrypted traffic to HTTPS<a class="headerlink" href="#redirect-all-unencrypted-traffic-to-https" title="Link to this heading"></a></h3>
<p>To redirect all HTTP traffic to HTTPS administrators are encouraged to issue a
permanent redirect using the 301 status code. When using Apache this can be
achieved by a setting such as the following in the Apache VirtualHosts
configuration:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="o">&lt;</span><span class="n">VirtualHost</span> <span class="o">*</span><span class="p">:</span><span class="mi">80</span><span class="o">&gt;</span>
   <span class="n">ServerName</span> <span class="n">cloud</span><span class="o">.</span><span class="n">nextcloud</span><span class="o">.</span><span class="n">com</span>
   <span class="n">Redirect</span> <span class="n">permanent</span> <span class="o">/</span> <span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="n">cloud</span><span class="o">.</span><span class="n">nextcloud</span><span class="o">.</span><span class="n">com</span><span class="o">/</span>
<span class="o">&lt;/</span><span class="n">VirtualHost</span><span class="o">&gt;</span>
</pre></div>
</div>
</section>
<section id="enable-http-strict-transport-security">
<span id="enable-hsts-label"></span><h3>Enable HTTP Strict Transport Security<a class="headerlink" href="#enable-http-strict-transport-security" title="Link to this heading"></a></h3>
<p>While redirecting all traffic to HTTPS is good, it may not completely prevent
man-in-the-middle attacks. Thus administrators are encouraged to set the HTTP
Strict Transport Security header, which instructs browsers to not allow any
connection to the Nextcloud instance using HTTP, and it attempts to prevent site
visitors from bypassing invalid certificate warnings.</p>
<p>This can be achieved by setting the following settings within the Apache
VirtualHost file:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="o">&lt;</span><span class="n">VirtualHost</span> <span class="o">*</span><span class="p">:</span><span class="mi">443</span><span class="o">&gt;</span>
  <span class="n">ServerName</span> <span class="n">cloud</span><span class="o">.</span><span class="n">nextcloud</span><span class="o">.</span><span class="n">com</span>
    <span class="o">&lt;</span><span class="n">IfModule</span> <span class="n">mod_headers</span><span class="o">.</span><span class="n">c</span><span class="o">&gt;</span>
      <span class="n">Header</span> <span class="n">always</span> <span class="nb">set</span> <span class="n">Strict</span><span class="o">-</span><span class="n">Transport</span><span class="o">-</span><span class="n">Security</span> <span class="s2">&quot;max-age=15552000; includeSubDomains&quot;</span>
    <span class="o">&lt;/</span><span class="n">IfModule</span><span class="o">&gt;</span>
 <span class="o">&lt;/</span><span class="n">VirtualHost</span><span class="o">&gt;</span>
</pre></div>
</div>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>We recommend the additional setting <code class="docutils literal notranslate"><span class="pre">;</span> <span class="pre">preload</span></code> to be added to that header.
Then the domain will be added to a hardcoded list that is shipped with all
major browsers and enforce HTTPS upon those domains. See the <a class="reference external" href="https://hstspreload.org/">HSTS preload
website for more information</a>. Due to the policy
of this list you need to add it to the above example for yourself once you
are sure that this is what you want. <a class="reference external" href="https://hstspreload.org/#removal">Removing the domain from this list</a> could take some months until it reaches
all installed browsers.</p>
</div>
<p>This example configuration will make all subdomains only accessible via HTTPS.
If you have subdomains not accessible via HTTPS, remove <code class="docutils literal notranslate"><span class="pre">includeSubDomains</span></code>.</p>
<p>This requires the <code class="docutils literal notranslate"><span class="pre">mod_headers</span></code> extension in Apache.</p>
</section>
<section id="proper-ssl-configuration">
<h3>Proper SSL configuration<a class="headerlink" href="#proper-ssl-configuration" title="Link to this heading"></a></h3>
<p>Default SSL configurations by Web servers are often not state-of-the-art, and
require fine-tuning for an optimal performance and security experience. The
available SSL ciphers and options depend completely on your environment and
thus giving a generic recommendation is not really possible.</p>
<p>We recommend using the <a class="reference external" href="https://mozilla.github.io/server-side-tls/ssl-config-generator/">Mozilla SSL Configuration Generator</a> to generate a
suitable configuration suited for your environment. To verify your
configuration you can use the free <a class="reference external" href="https://tlsprofiler.danielfett.de/">Web TLS Profiler</a> service.
This service gives detailed error messages, if your server’s TLS settings deviate
from the Mozilla Configuration. Another useful tool to check your server’s
TLS configuration is the free <a class="reference external" href="https://www.ssllabs.com/ssltest/">Qualys SSL Labs Test</a> which provides general
information about the TLS settings.</p>
<p>Also ensure that HTTP compression is disabled to mitigate the BREACH attack.</p>
</section>
</section>
<section id="restrict-admin-actions-to-a-specific-range-of-ip-addresses">
<h2>Restrict admin actions to a specific range of IP addresses<a class="headerlink" href="#restrict-admin-actions-to-a-specific-range-of-ip-addresses" title="Link to this heading"></a></h2>
<p>Configure <code class="docutils literal notranslate"><span class="pre">allowed_admin_ranges</span></code> in <code class="docutils literal notranslate"><span class="pre">config.php</span></code> to restrict the admin actions to trusted IP ranges.</p>
<p>This can be achieved with this kind of setting, usually using private IP ranges:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="s1">&#39;allowed_admin_ranges&#39;</span> <span class="o">=&gt;</span> <span class="p">[</span>
  <span class="s1">&#39;127.0.0.1/8&#39;</span><span class="p">,</span>
  <span class="s1">&#39;192.168.0.0/16&#39;</span><span class="p">,</span>
  <span class="s1">&#39;fd00::/8&#39;</span><span class="p">,</span>
<span class="p">],</span>
</pre></div>
</div>
<p>All requests originating from IP addresses outside of these ranges will not be able to execute admin actions.</p>
<p>Administrators connected from untrusted IP addresses will be able to use Nextcloud, but all admin specific actions will be hidden.</p>
</section>
<section id="use-a-dedicated-domain-for-nextcloud">
<h2>Use a dedicated domain for Nextcloud<a class="headerlink" href="#use-a-dedicated-domain-for-nextcloud" title="Link to this heading"></a></h2>
<p>Administrators are encouraged to install Nextcloud on a dedicated domain such as
cloud.domain.tld instead of domain.tld to gain all the benefits offered by the
Same-Origin-Policy.</p>
</section>
<section id="ensure-that-your-nextcloud-instance-is-installed-in-a-dmz">
<h2>Ensure that your Nextcloud instance is installed in a DMZ<a class="headerlink" href="#ensure-that-your-nextcloud-instance-is-installed-in-a-dmz" title="Link to this heading"></a></h2>
<p>As Nextcloud supports features such as Federated File Sharing we do not consider
Server Side Request Forgery (SSRF) part of our threat model. In fact, given all our
external storage adapters this can be considered a feature and not a vulnerability.</p>
<p>This means that a user on your Nextcloud instance could probe whether other hosts
are accessible from the Nextcloud network. If you do not want this you need to
ensure that your Nextcloud is properly installed in a segregated network and proper
firewall rules are in place.</p>
</section>
<section id="serve-security-related-headers-by-the-web-server">
<h2>Serve security related headers by the Web server<a class="headerlink" href="#serve-security-related-headers-by-the-web-server" title="Link to this heading"></a></h2>
<p>Basic security headers are served by Nextcloud already in a default environment.
These include:</p>
<ul class="simple">
<li><dl class="simple">
<dt><code class="docutils literal notranslate"><span class="pre">X-Content-Type-Options:</span> <span class="pre">nosniff</span></code></dt><dd><ul>
<li><p>Instructs some browsers to not sniff the mimetype of files. This is used for example to prevent browsers from interpreting text files as JavaScript.</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt><code class="docutils literal notranslate"><span class="pre">X-Robots-Tag:</span> <span class="pre">noindex,</span> <span class="pre">nofollow</span></code></dt><dd><ul>
<li><p>Instructs search machines to not index these pages and not follow any links there.</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt><code class="docutils literal notranslate"><span class="pre">X-Frame-Options:</span> <span class="pre">SAMEORIGIN</span></code></dt><dd><ul>
<li><p>Prevents embedding of the Nextcloud instance within an iframe from other domains to prevent Clickjacking and other similar attacks.</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt><code class="docutils literal notranslate"><span class="pre">Referrer-Policy:</span> <span class="pre">no-referrer</span></code></dt><dd><ul>
<li><p>The default <cite>no-referrer</cite> policy instructs the browser not to send referrer information along with requests to any origin.</p></li>
</ul>
</dd>
</dl>
</li>
</ul>
<p>These headers are hard-coded into the Nextcloud server, and need no intervention
by the server administrator.</p>
<p>For optimal security, administrators are encouraged to serve these basic HTTP
headers by the Web server to enforce them on response. To do this Apache has to
be configured to use the <code class="docutils literal notranslate"><span class="pre">.htaccess</span></code> file and the following Apache
modules need to be enabled:</p>
<ul class="simple">
<li><p>mod_headers</p></li>
<li><p>mod_env</p></li>
</ul>
<p>Administrators can verify whether this security change is active by accessing a
static resource served by the Web server and verify that the above mentioned
security headers are shipped.</p>
</section>
<section id="connections-to-remote-servers">
<span id="id1"></span><h2>Connections to remote servers<a class="headerlink" href="#connections-to-remote-servers" title="Link to this heading"></a></h2>
<p>Some functionalities require the Nextcloud server to be able to connect remote systems via https/443.
This paragraph also includes the data which is being transmitted to the Nextcloud GmbH.
Depending on your server setup, these are the possible connections:</p>
<ul class="simple">
<li><dl class="simple">
<dt>connectivity.nextcloud.com, www.eff.org, edri.org</dt><dd><ul>
<li><p><a class="reference external" href="https://docs.nextcloud.com/server/33/admin_manual/configuration_server/config_sample_php_parameters.html#has-internet-connection">optional (config)</a></p></li>
<li><p>for checking the internet connection</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>cloud.nextcloud.com</dt><dd><ul>
<li><p>used for enterprise license monitoring</p></li>
<li><p>submitted data: subscription key, user count</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>updates.nextcloud.com</dt><dd><ul>
<li><p>to check for available Nextcloud server updates</p></li>
<li><p>submitted data: server version, subscription key, install time, instance id, instance size</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>apps.nextcloud.com, ltd[1-3].nextcloud.com, garm[1-5].nextcloud.com</dt><dd><ul>
<li><p>to check for available apps and their updates</p></li>
<li><p>source is apps.nextcloud.com the ltd and garm servers are just mirroring the apps.json file</p></li>
<li><p>submitted data: subscription key</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>github.com, objects.githubusercontent.com, release-assets.githubusercontent.com</dt><dd><ul>
<li><p>to download Nextcloud standard apps</p></li>
<li><p>to download Nextcloud server releases</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>push-notifications.nextcloud.com</dt><dd><ul>
<li><p>sending push notifications to mobile clients</p></li>
<li><p>submitted data: unique device identifier, public key, push token</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>pushfeed.nextcloud.com</dt><dd><ul>
<li><p>optional</p></li>
<li><p>checking for updates to be shown in the Nextcloud Announcements app</p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>lookup.nextcloud.com</dt><dd><ul>
<li><p>optional</p></li>
<li><p>for updating and lookups to the federated sharing addressbook</p></li>
<li><p>submitted data: <em>pending</em></p></li>
</ul>
</dd>
</dl>
</li>
<li><dl class="simple">
<dt>surveyserver.nextcloud.com</dt><dd><ul>
<li><p>optional</p></li>
<li><p>if the admin has agreed to share anonymized server data</p></li>
<li><p>submitted data: statistical data. see here for the <a class="reference external" href="https://github.com/nextcloud/survey_client">detailed field list</a></p></li>
</ul>
</dd>
</dl>
</li>
<li><p>Any remote Nextcloud server that is connected with federated sharing</p></li>
<li><p>When downloading apps from the App store other domains might be accessed, based on the choice of the app developers where they host the releases. For all official Nextcloud apps this is not the case though, because they are hosted on Github.</p></li>
</ul>
</section>
<section id="setup-fail2ban">
<h2>Setup fail2ban<a class="headerlink" href="#setup-fail2ban" title="Link to this heading"></a></h2>
<p>Exposing your server to the internet will inevitably lead to the exposure of the
services running on the internet-exposed ports to brute force login attempts.</p>
<p>This guide will enable blocking of the originating IP addresses at an operating
system level, so the webserver, PHP and the database do not need to handle this
unnecessary traffic at all.</p>
<section id="nextcloud-prerequisites">
<h3>Nextcloud prerequisites<a class="headerlink" href="#nextcloud-prerequisites" title="Link to this heading"></a></h3>
<p>Nextcloud logs failed login attempts in <code class="docutils literal notranslate"><span class="pre">nextcloud.log</span></code> with log level <code class="docutils literal notranslate"><span class="pre">2</span></code>,
so you need to define a <code class="docutils literal notranslate"><span class="pre">loglevel</span></code> of <code class="docutils literal notranslate"><span class="pre">2</span></code> or less in <code class="docutils literal notranslate"><span class="pre">config.php</span></code>.</p>
<p>Make sure your <code class="docutils literal notranslate"><span class="pre">nextcloud.log</span></code> is writeable by your webserver user, possibly by
defining a correct <code class="docutils literal notranslate"><span class="pre">logfilemode</span></code> in <code class="docutils literal notranslate"><span class="pre">config.php</span></code>.</p>
<p>Perform a bad login attempt and check whether it does get logged to <code class="docutils literal notranslate"><span class="pre">nextcloud.log</span></code>.</p>
<p>Note that <code class="docutils literal notranslate"><span class="pre">audit.log</span></code> (if enabled) currently only logs successful logins and cannot be used.</p>
</section>
<section id="fail2ban-introduction">
<h3>Fail2ban introduction<a class="headerlink" href="#fail2ban-introduction" title="Link to this heading"></a></h3>
<p>Fail2ban is a service that uses iptables to automatically drop connections for a
pre-defined amount of time from IPs that continuously failed to authenticate to
the configured services.</p>
<p>In order to setup fail2ban, you first need to download and install it on your
server. Downloads for several distributions can be found on <a class="reference external" href="https://www.fail2ban.org/wiki/index.php/Downloads">fail2ban download
page</a>. It is often available from most distributions’ package managers (e.g.
<code class="docutils literal notranslate"><span class="pre">apt-get</span></code>).</p>
<p>The standard path for fail2ban’s configuration is <code class="docutils literal notranslate"><span class="pre">/etc/fail2ban</span></code>.</p>
</section>
<section id="setup-a-filter-and-a-jail-for-nextcloud">
<h3>Setup a filter and a jail for Nextcloud<a class="headerlink" href="#setup-a-filter-and-a-jail-for-nextcloud" title="Link to this heading"></a></h3>
<p>A filter defines regex rules to identify when users fail to authenticate on
Nextcloud’s user interface, WebDAV, or use an untrusted domain to access the
server.</p>
<p>Create a file in <code class="docutils literal notranslate"><span class="pre">/etc/fail2ban/filter.d</span></code> named <code class="docutils literal notranslate"><span class="pre">nextcloud.conf</span></code> with the
following contents:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[Definition]
_groupsre = (?:(?:,?\s*&quot;\w+&quot;:(?:&quot;[^&quot;]+&quot;|\w+))*)
failregex = ^\{%(_groupsre)s,?\s*&quot;remoteAddr&quot;:&quot;&lt;HOST&gt;&quot;%(_groupsre)s,?\s*&quot;message&quot;:&quot;Login failed:
            ^\{%(_groupsre)s,?\s*&quot;remoteAddr&quot;:&quot;&lt;HOST&gt;&quot;%(_groupsre)s,?\s*&quot;message&quot;:&quot;Two-factor challenge failed:
            ^\{%(_groupsre)s,?\s*&quot;remoteAddr&quot;:&quot;&lt;HOST&gt;&quot;%(_groupsre)s,?\s*&quot;message&quot;:&quot;Trusted domain error.
datepattern = ,?\s*&quot;time&quot;\s*:\s*&quot;%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?&quot;
</pre></div>
</div>
<p>The jail file defines how to handle the failed authentication attempts found by
the Nextcloud filter.</p>
<p>Create a file in <code class="docutils literal notranslate"><span class="pre">/etc/fail2ban/jail.d</span></code> named <code class="docutils literal notranslate"><span class="pre">nextcloud.local</span></code> with the
following contents:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[</span><span class="n">nextcloud</span><span class="p">]</span>
<span class="n">backend</span> <span class="o">=</span> <span class="n">auto</span>
<span class="n">enabled</span> <span class="o">=</span> <span class="n">true</span>
<span class="n">port</span> <span class="o">=</span> <span class="mi">80</span><span class="p">,</span><span class="mi">443</span>
<span class="n">protocol</span> <span class="o">=</span> <span class="n">tcp</span>
<span class="nb">filter</span> <span class="o">=</span> <span class="n">nextcloud</span>
<span class="n">maxretry</span> <span class="o">=</span> <span class="mi">3</span>
<span class="n">bantime</span> <span class="o">=</span> <span class="mi">86400</span>
<span class="n">findtime</span> <span class="o">=</span> <span class="mi">43200</span>
<span class="n">logpath</span> <span class="o">=</span> <span class="o">/</span><span class="n">path</span><span class="o">/</span><span class="n">to</span><span class="o">/</span><span class="n">data</span><span class="o">/</span><span class="n">directory</span><span class="o">/</span><span class="n">nextcloud</span><span class="o">.</span><span class="n">log</span>
</pre></div>
</div>
<p>Ensure to replace <code class="docutils literal notranslate"><span class="pre">logpath</span></code> with your installation’s <code class="docutils literal notranslate"><span class="pre">nextcloud.log</span></code>
location. If you are using ports other than <code class="docutils literal notranslate"><span class="pre">80</span></code> and <code class="docutils literal notranslate"><span class="pre">443</span></code> for your
Web server you should replace those too. The <code class="docutils literal notranslate"><span class="pre">bantime</span></code> and <code class="docutils literal notranslate"><span class="pre">findtime</span></code> are
defined in seconds.</p>
<p>Restart the fail2ban service. You can check the status of your Nextcloud jail by
running:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">fail2ban</span><span class="o">-</span><span class="n">client</span> <span class="n">status</span> <span class="n">nextcloud</span>
</pre></div>
</div>
<p>If you need to unban certain IP addresses (<code class="docutils literal notranslate"><span class="pre">1.2.3.4</span></code> in this example),
you may do so by issuing:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">fail2ban</span><span class="o">-</span><span class="n">client</span> <span class="n">unban</span> <span class="mf">1.2.3.4</span>
</pre></div>
</div>
<p>There may be scenarios where you want to more permantently ban certain IP
addresses that repeatedly generate bad login attempts (or other attacks) by
using fail2ban’s <code class="docutils literal notranslate"><span class="pre">recidive</span></code> feature.</p>
</section>
</section>
</section>

</div>
          </div>
          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
        <a href="nginx.html" class="btn btn-neutral float-left" title="NGINX configuration" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
        <a href="server_tuning.html" class="btn btn-neutral float-right" title="Server tuning" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
    </div>

<hr/>

<div role="contentinfo">
    <p>&#169; Copyright 2016-2026 Nextcloud GmbH and Nextcloud contributors.</p>
  </div>

</footer>
        </div>
      </div>
    </section>
  </div>

<div class="rst-versions" data-toggle="rst-versions" role="note" aria-label="versions">
    <span class="rst-current-version" data-toggle="rst-current-version">
      ☁️ latest
      <span class="fa fa-caret-down"></span>
    </span>
    <div class="rst-other-versions">
      <dl>
        <dt>☁️ Versions</dt>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/latest/admin_manual"
             
             style="color: var(--dark-link-color);"
             
          >
            latest
          </a>
        </dd>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/stable/admin_manual"
             
          >
            stable
          </a>
        </dd>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/32/admin_manual"
             
          >
            32
          </a>
        </dd>
        
        <dd style="width: 32%">
          <a href="https://docs.nextcloud.com/server/31/admin_manual"
             
          >
            31
          </a>
        </dd>
        
      </dl>
    </div>
  </div>
<script>
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

</body>
</html>

Cancel