Directory Security
During install, you should have set the user/group ownership to match your web server (www-data for Apache on Ubuntu).
These are the default permissions for your NextCloud directories and files:
- All files should be read-write for the file owner, read-only for the group owner, and zero for the world (640)
- All directories should be executable (because directories always need the executable bit set), read-write for the directory owner, and read-only for the group owner (750)
- The .htaccess files are read-write for the file owner, read-only group and world (644)
- The .htaccess files should be owned by root:www-data
Let's create the script that will enforce the recommended permissions/ownership.
Code: Select all
sudo mkdir -p /var/scripts/prod
sudo touch /var/scripts/prod/secure-nextcloud.sh
sudo chown root:root /var/scripts/prod/secure-nextcloud.sh
sudo chmod 0755 /var/scripts/prod/secure-nextcloud.sh
sudo vi /var/scripts/prod/secure-nextcloud.sh
Code: Select all
#!/bin/bash
#############################################################
## Name : secure-nextcloud.sh
## Version : 1.1
## Date : 2018-03-29
## Author : LHammonds
## Compatibility : Ubuntu Server 16.04 - 20.04 LTS, NextCloud 13.0.1 - 18.04
## Purpose : Ensures ownership and permissions are set correctly.
## Run Frequency : Manual as needed or via crontab schedule.
## NOTE: These settings will prevent the updater from working.
## The only thing needed to change in order for the updater to
## work is to change the rootuser to be the same as webuser.
######################## CHANGE LOG #########################
## DATE VER WHO WHAT WAS CHANGED
## ---------- --- --- ---------------------------------------
## 2018-01-11 1.0 LTH Created script.
## 2018-03-29 1.1 LTH Improvements.
#############################################################
wwwdir='/var/www/nextcloud'
datadir='/var/www/nextcloud-data'
webuser='www-data'
webgrp='www-data'
rootuser='root'
if [ ! -f ${wwwdir}/.htaccess ]; then
echo "ERROR: Missing critical file: ${wwwdir}/.htaccess"
echo "This file should have been included in the app archive"
fi
if [ ! -f ${wwwdir}/config/.htaccess ]; then
echo "ERROR: Missing critical file: ${wwwdir}/config/.htaccess"
echo "This file should have been included in the app archive"
fi
if [ ! -f ${datadir}/.htaccess ]; then
echo "WARNING: Missing potentially critical file: ${datadir}/.htaccess"
echo "If the data folder is not directly inside the"
echo "www folder, then it is not an issue."
fi
echo "Making folders if they are missing..."
if [ ! -d ${wwwdir}/apps ]; then
mkdir -p ${wwwdir}/apps
fi
if [ ! -d ${wwwdir}/config ]; then
mkdir -p ${wwwdir}/config
fi
if [ ! -d ${wwwdir}/themes ]; then
mkdir -p ${wwwdir}/themes
fi
if [ ! -d ${datadir} ]; then
mkdir -p ${datadir}
fi
echo "Setting Ownership..."
chown -R ${webuser}:${webgrp} ${wwwdir}/
chown -R ${webuser}:${webgrp} ${wwwdir}/apps/
chown -R ${webuser}:${webgrp} ${wwwdir}/config/
chown -R ${webuser}:${webgrp} ${wwwdir}/themes/
chown ${rootuser}:${webgrp} ${wwwdir}/.htaccess
chown ${rootuser}:${webgrp} ${wwwdir}/config/.htaccess
chown ${rootuser}:${webgrp} ${datadir}/.htaccess
echo "Setting Folder Permissions..."
find ${wwwdir}/ -type d -print0 | xargs -0 chmod 0750
find ${datadir}/ -type d -print0 | xargs -0 chmod 0750
echo "Setting File Permissions..."
find ${wwwdir}/ -type f -print0 | xargs -0 chmod 0640
find ${datadir}/ -type f -print0 | xargs -0 chmod 0640
chmod 0644 ${wwwdir}/.htaccess
chmod 0644 ${wwwdir}/config/.htaccess
chmod 0644 ${datadir}/.htaccess
echo "Permission change complete."
Now run the script as the root user:
Code: Select all
sudo /var/scripts/prod/secure-nextcloud.sh
You can also schedule the script via crontab to run on a regular basis to make sure the permissions never stay out of whack for long.
If you want to enable the updater to work, simply change the value of "rootuser" from "root" to "www-data"
Configure for secure (SSL) access
NEED TO CHANGE THIS TO LETS ENCRYPT
This will create a self-signed certificate that will expire 1,095 days (3 years) from the date it was created. Web browsers will balk about it being untrusted. It will still work but end-users will have to allow this exception unless you pay > $200 for an official SSL certificate issued by a trusted/known authority.
Code: Select all
a2enmod ssl
mkdir -p /etc/apache2/ssl/certs
mkdir -p /etc/apache2/ssl/private
openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -keyout /etc/apache2/ssl/private/nextcloud.key -out /etc/apache2/ssl/certs/nextcloud.crt
Country Name: US
State: MyState
Locality Name: MyCity
Organication Name: MyCompany
Organizational Unit Name: MyDepartment
Common Name: nextcloud.mycompany.com
Email Address: webmaster@mycompany.com
To verify the certificate:
Code: Select all
openssl x509 -in /etc/apache2/ssl/certs/nextcloud.crt -text -noout
To verify the private key:
Code: Select all
openssl rsa -in /etc/apache2/ssl/private/nextcloud.key -check
Create the SSL web config
Code: Select all
vi /etc/apache2/sites-available/nextcloud-ssl.conf
Set these values:
Code: Select all
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerName nextcloud.mydomain.com:443
ServerAdmin webmaster@localhost
DocumentRoot /var/www/nextcloud
ErrorLog ${APACHE_LOG_DIR}/nc-error.log
CustomLog ${APACHE_LOG_DIR}/nc-access.log combined
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/certs/nextcloud.crt
SSLCertificateKeyFile /etc/apache2/ssl/private/nextcloud.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
</IfModule>
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
</IfModule>
Now we need to enable the SSL site configuration:
Code: Select all
a2ensite nextcloud-ssl
sudo systemctl reload apache2
Code: Select all
vi /etc/apache2/sites-available/nextcloud.conf
Code: Select all
<VirtualHost *:80>
#### Redirect to port 443 ###
RewriteEngine on
ReWriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
#### End of Redirection configuration ###
ServerAdmin webmaster@localhost
ServerName nextcloud.mydomain.com
DocumentRoot /var/www/nextcloud
ErrorLog ${APACHE_LOG_DIR}/nc-error.log
CustomLog ${APACHE_LOG_DIR}/nc-access.log combined
<Directory /var/www/nextcloud/>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
<IfModule mod_dav.c>
Dav off
</IfModule>
SetEnv HOME /var/www/nextcloud
SetEnv HTTP_HOME /var/www/nextcloud
</Directory>
</VirtualHost>
Reload the updated configuration for Apache:
Configure NextCloud Settings
Now, go to your IP address or domain name in your browser:
Example:
http://192.168.107.9/ or
http://nextcloud.mydomain.com/
It should automatically re-direct to https:// for secured SSL connection.
Login with your admin account and click the gear icon on top-right side, then click Admin
When the configuration check is complete, it should say "No problems found" if you did everything right (e.g. using SSL, .htaccess, etc.)
Email Server - Setup your mail sending capability here (choices vary depending on your mail server):
Send mode: smtp
Encryption: SSL
From address:
nextcloud@mydomain.com
Authentication method: Login
Check: Authentication required
Server address:
mail.mydomain.com : 25
Credentials:
smtpuser
Password:
smtppassword
On top-right side, click on the gear icon, then +Apps and then find and enable the following:
- Office and Text -> Calendar
- Office and Text -> Contacts
Add Users
While logged in with your admin user, click gear icon on top-right side and then Users
Click the "gear" icon on the lower-left corner to display settings.
Note the default space quota is set to Unlimited. You can configure the default here.
It would also be a good idea to place checkmarks beside "Send email to new user" and "Show email address"
In the empty "Username" "Password" and "Email" fields, add a user account and click "Create"
Repeat for each user you want added.
NextCloud comes with one default group: admin. When you create users, they will not belong to any group. If you need to create other groups, click the "+ Add group" link on the top-left and type in a name.
You can assign space limitations by setting the quota for each individual or just let it use the system-wide default quota.
Configure New User Folder Skeleton
When a new user is created, the following folder/files are copied to the new user's folder:
/var/www/nextcloud/core/skeleton/*
You can remove the example files and/or create new folders/files so it looks a certain way when a new person logs in.
Install New Apps
You can install other apps not listed with the default installation.
Visit this site:
https://apps.nextcloud.com/?xsortmode=high
