?i»?
Your IP : 3.147.193.141
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Encryption configuration — Nextcloud 13 Administration Manual 13 documentation</title>
<link rel="stylesheet" href="../_static/" type="text/css" />
<link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../_static/main.min.css" type="text/css" />
<link rel="stylesheet" href="../_static/styles.css" type="text/css" />
<script type="text/javascript">
var DOCUMENTATION_OPTIONS = {
URL_ROOT: '../',
VERSION: '13',
COLLAPSE_INDEX: false,
FILE_SUFFIX: '.html',
HAS_SOURCE: true
};
</script>
<script type="text/javascript" src="../_static/jquery.js"></script>
<script type="text/javascript" src="../_static/underscore.js"></script>
<script type="text/javascript" src="../_static/doctools.js"></script>
<script type="text/javascript" src="../_static/js/jquery-1.11.0.min.js"></script>
<script type="text/javascript" src="../_static/js/jquery-fix.js"></script>
<script type="text/javascript" src="../_static/bootstrap-3.1.0/js/bootstrap.min.js"></script>
<script type="text/javascript" src="../_static/bootstrap-sphinx.js"></script>
<link rel="top" title="Nextcloud 13 Administration Manual 13 documentation" href="../contents.html" />
<link rel="up" title="File sharing and management" href="index.html" />
<link rel="next" title="Transactional file locking" href="files_locking_transactional.html" />
<link rel="prev" title="External Storage authentication mechanisms" href="external_storage/auth_mechanisms.html" />
<meta charset='utf-8'>
<meta http-equiv='X-UA-Compatible' content='IE=edge,chrome=1'>
<meta name='viewport' content='width=device-width, initial-scale=1.0, maximum-scale=1'>
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="theme-color" content="#1d2d44">
</head>
<body role="document">
<div class="wrap container not-front">
<div class="content row">
<main class="main">
<div class="row">
<div class="col-md-3">
<div class="sidebar">
<h1>Nextcloud 13 Administration Manual</h1>
<div class="sidebar-search">
<form class="headersearch" action="../search.html" method="get">
<input type="text" value="" name="q" id="q" class="form-control" />
<button class="btn btn-default" type="submit" id="searchsubmit">Search</button>
</form>
</div>
<div class="menu-support-container">
<ul id="menu-support" class="menu">
<ul>
<li><a href="../contents.html">Table of Contents</a></li>
</ul>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../index.html">Introduction</a></li>
<li class="toctree-l1"><a class="reference internal" href="../release_notes.html">Release notes</a></li>
<li class="toctree-l1"><a class="reference internal" href="../installation/index.html">Installation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_server/index.html">Server configuration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_user/index.html">User management</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="index.html">File sharing and management</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="file_sharing_configuration.html">File Sharing</a></li>
<li class="toctree-l2"><a class="reference internal" href="federated_cloud_sharing_configuration.html">Configuring Federation Sharing</a></li>
<li class="toctree-l2"><a class="reference internal" href="big_file_upload_configuration.html">Uploading big files > 512MB</a></li>
<li class="toctree-l2"><a class="reference internal" href="default_files_configuration.html">Providing default files</a></li>
<li class="toctree-l2"><a class="reference internal" href="external_storage_configuration_gui.html">Configuring External Storage (GUI)</a></li>
<li class="toctree-l2"><a class="reference internal" href="external_storage_configuration.html">Configuring External Storage (configuration file)</a></li>
<li class="toctree-l2"><a class="reference internal" href="external_storage/auth_mechanisms.html">External Storage authentication mechanisms</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="">Encryption configuration</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#before-enabling-encryption">Before enabling encryption</a></li>
<li class="toctree-l3"><a class="reference internal" href="#enabling-encryption">Enabling encryption</a></li>
<li class="toctree-l3"><a class="reference internal" href="#sharing-encrypted-files">Sharing encrypted files</a></li>
<li class="toctree-l3"><a class="reference internal" href="#encrypting-external-mountpoints">Encrypting external mountpoints</a></li>
<li class="toctree-l3"><a class="reference internal" href="#enabling-users-file-recovery-keys">Enabling users file recovery keys</a></li>
<li class="toctree-l3"><a class="reference internal" href="#occ-encryption-commands">occ encryption commands</a></li>
<li class="toctree-l3"><a class="reference internal" href="#disabling-encryption">Disabling encryption</a></li>
<li class="toctree-l3"><a class="reference internal" href="#files-not-encrypted">Files not encrypted</a></li>
<li class="toctree-l3"><a class="reference internal" href="#ldap-and-other-external-user-back-ends">LDAP and other external user back-ends</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="files_locking_transactional.html">Transactional file locking</a></li>
<li class="toctree-l2"><a class="reference internal" href="previews_configuration.html">Previews configuration</a></li>
<li class="toctree-l2"><a class="reference internal" href="file_versioning.html">Controlling file versions and aging</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../file_workflows/index.html">File workflows</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_database/index.html">Database configuration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../configuration_mimetypes/index.html">Mimetypes management</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintenance/index.html">Maintenance</a></li>
<li class="toctree-l1"><a class="reference internal" href="../issues/index.html">Issues and troubleshooting</a></li>
</ul>
</ul>
</div>
</div>
</div>
<div class="col-md-9">
<div class="page-content">
<ul class="prevnext-title list-unstyled list-inline">
<li class="prev">
<a href="external_storage/auth_mechanisms.html" title="Previous Chapter: External Storage authentication mechanisms"><span class="glyphicon glyphicon-chevron-left visible-sm"></span><span class="hidden-sm">« External Storage authentication mechanisms</span>
</a>
</li>
<li class="next">
<a href="files_locking_transactional.html" title="Next Chapter: Transactional file locking"><span class="glyphicon glyphicon-chevron-right visible-sm"></span><span class="hidden-sm">Transactional file locking »</span>
</a>
</li>
</ul>
<div class="section" id="encryption-configuration">
<h1>Encryption configuration<a class="headerlink" href="#encryption-configuration" title="Permalink to this headline">¶</a></h1>
<p>The primary purpose of the Nextcloud server-side encryption is to protect users’
files on remote storage, such as Dropbox and Google Drive, and to do it easily
and seamlessly from within Nextcloud.</p>
<p>In Nextcloud 9.0 the server-side encryption separates encryption of local and
remote storage. This allows you to encrypt remote storage, such as Dropbox and
Google, without having to also encrypt your home storage on your Nextcloud
server.</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p>Starting with Nextcloud 9.0 we support Authenticated Encryption for all
newly encrypted files. See <a class="reference external" href="https://hackerone.com/reports/108082">https://hackerone.com/reports/108082</a> for more
technical information about the impact.</p>
<p class="last">For maximum security make sure to configure external storage with “Check for
changes: Never”. This will let Nextcloud ignore new files not added via Nextcloud,
so a malicious external storage administrator could not add new files to the
storage without your knowledge. Of course, this is not wise if your external
storage is subject to legitimate external changes.</p>
</div>
<p>Nextcloud server-side encryption encrypts files stored on the Nextcloud server,
and files on remote storage that is connected to your Nextcloud server.
Encryption and decryption are performed on the Nextcloud server. All files sent
to remote storage will be encrypted by the Nextcloud server, and upon retrieval,
decrypted before serving them to you and anyone you have shared them with.</p>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">Encrypting files increases their size by roughly 35%, so you must
take this into account when you are provisioning storage and setting
storage quotas. User’s quotas are based on the unencrypted file size, and
not the encrypted file size.</p>
</div>
<p>When files on external storage are encrypted in Nextcloud, you cannot share them
directly from the external storage services, but only through Nextcloud sharing
because the key to decrypt the data never leaves the Nextcloud server.</p>
<p>Nextcloud’s server-side encryption generates a strong encryption key, which is
unlocked by user’s passwords. Your users don’t need to track an extra
password, but simply log in as they normally do. It encrypts only the contents
of files, and not filenames and directory structures.</p>
<p>You should regularly backup all encryption keys to prevent permanent data loss.
The encryption keys are stored in the following directories:</p>
<dl class="docutils">
<dt><code class="docutils literal"><span class="pre">data/<user>/files_encryption</span></code></dt>
<dd>Users’ private keys and all other keys necessary to decrypt the users’ files</dd>
<dt><code class="docutils literal"><span class="pre">data/files_encryption</span></code></dt>
<dd>private keys and all other keys necessary to decrypt the files stored on a
system wide external storage</dd>
</dl>
<p>When encryption is enabled, all files are encrypted and decrypted by the
Nextcloud application, and stored encrypted on your remote storage.
This protects your data on externally hosted storage. The Nextcloud
admin and the storage admin will see only encrypted files when browsing backend
storage.</p>
<div class="admonition warning">
<p class="first admonition-title">Warning</p>
<p>Encryption keys are stored only on the Nextcloud server, eliminating
exposure of your data to third-party storage providers. The encryption app
does <strong>not</strong> protect your data if your Nextcloud server is compromised, and it
does not prevent Nextcloud administrators from reading user’s files. This
would require client-side encryption, which this app does not provide. If
your Nextcloud server is not connected to any external storage services then
it is better to use other encryption tools, such as file-level or
whole-disk encryption.</p>
<p class="last">Note also that SSL terminates at or before Apache on the Nextcloud server, and
all files will exist in an unencrypted state between the SSL connection
termination and the Nextcloud code that encrypts and decrypts files. This is
also potentially exploitable by anyone with administrator access to your
server. Read <a class="reference external" href="https://owncloud.org/blog/how-owncloud-uses-encryption-to-protect-your-data/">How Nextcloud uses encryption to protect your data</a> for more information.</p>
</div>
<div class="section" id="before-enabling-encryption">
<h2>Before enabling encryption<a class="headerlink" href="#before-enabling-encryption" title="Permalink to this headline">¶</a></h2>
<p>Plan very carefully before enabling encryption because it is not reversible via
the Nextcloud Web interface. If you lose your encryption keys your files are not
recoverable. Always have backups of your encryption keys stored in a safe
location, and consider enabling all recovery options.</p>
<p>You have more options via the <code class="docutils literal"><span class="pre">occ</span></code> command (see <a class="reference internal" href="#occ-encryption-label"><span>occ encryption commands</span></a>)</p>
</div>
<div class="section" id="enabling-encryption">
<span id="enable-encryption-label"></span><h2>Enabling encryption<a class="headerlink" href="#enabling-encryption" title="Permalink to this headline">¶</a></h2>
<p>Nextcloud encryption consists of two parts. The base encryption system is
enabled and disabled on your Admin page. First you must enable this, and then
select an encryption module to load. Currently the only available encryption
module is the Nextcloud Default Encryption Module.</p>
<p>First go to the <strong>Server-side encryption</strong> section of your Admin page and check
<strong>Enable server-side encryption</strong>. You have one last chance to change your mind.</p>
<div class="figure">
<img alt="../_images/encryption3.png" src="../_images/encryption3.png" />
</div>
<p>After clicking the <strong>Enable Encryption</strong> button you see the message “No
encryption module loaded, please load a encryption module in the app menu”, so
go to your Apps page to enable the Nextcloud Default Encryption Module.</p>
<div class="figure">
<img alt="../_images/encryption1.png" src="../_images/encryption1.png" />
</div>
<p>Return to your Admin page to see the Nextcloud Default Encryption
Module added to the module selector, and automatically selected. Now you must
log out and then log back in to initialize your encryption keys.</p>
<div class="figure">
<img alt="../_images/encryption14.png" src="../_images/encryption14.png" />
</div>
<p>When you log back in, there is a checkbox for enabling encryption on your home
storage. This is checked by default. Un-check to avoid encrypting your home
storage.</p>
<div class="figure">
<img alt="../_images/encryption15.png" src="../_images/encryption15.png" />
</div>
</div>
<div class="section" id="sharing-encrypted-files">
<h2>Sharing encrypted files<a class="headerlink" href="#sharing-encrypted-files" title="Permalink to this headline">¶</a></h2>
<p>After encryption is enabled your users must also log out and log back in to
generate their personal encryption keys. They will see a yellow warning banner
that says “Encryption App is enabled but your keys are not initialized, please
log-out and log-in again.”</p>
<p>Share owners may need to re-share files after encryption is enabled; users
trying to access the share will see a message advising them to ask the share
owner to re-share the file with them. For individual shares, un-share and
re-share the file. For group shares, share with any individuals who can’t access
the share. This updates the encryption, and then the share owner can remove the
individual shares.</p>
<div class="figure">
<img alt="../_images/encryption9.png" src="../_images/encryption9.png" />
</div>
</div>
<div class="section" id="encrypting-external-mountpoints">
<h2>Encrypting external mountpoints<a class="headerlink" href="#encrypting-external-mountpoints" title="Permalink to this headline">¶</a></h2>
<p>You and your users can encrypt individual external mountpoints. You must have
external storage enabled on your Admin page, and enabled for your users.</p>
<p>Encryption settings can be configured in the mount options for an external
storage mount, see <a class="reference internal" href="external_storage_configuration_gui.html#external-storage-mount-options-label"><span>Mount options</span></a>
(<a class="reference internal" href="external_storage_configuration_gui.html"><em>Configuring External Storage (GUI)</em></a>)</p>
</div>
<div class="section" id="enabling-users-file-recovery-keys">
<span id="enable-file-recovery-key"></span><h2>Enabling users file recovery keys<a class="headerlink" href="#enabling-users-file-recovery-keys" title="Permalink to this headline">¶</a></h2>
<p>If you lose your Nextcloud password, then you lose access to your encrypted
files. If one of your users loses their Nextcloud password their files are
unrecoverable. You cannot reset their password in the normal way; you’ll see a
yellow banner warning “Please provide an admin recovery password, otherwise all
user data will be lost”.</p>
<p>To avoid all this, create a Recovery Key. Go to the Encryption section of your
Admin page and set a recovery key password.</p>
<div class="figure">
<img alt="../_images/encryption10.png" src="../_images/encryption10.png" />
</div>
<p>Then your users have the option of enabling password recovery on their Personal
pages. If they do not do this, then the Recovery Key won’t work for them.</p>
<div class="figure">
<img alt="../_images/encryption7.png" src="../_images/encryption7.png" />
</div>
<p>For users who have enabled password recovery, give them a new password and
recover access to their encrypted files by supplying the Recovery Key on the
Users page.</p>
<div class="figure">
<img alt="../_images/encryption8.png" src="../_images/encryption8.png" />
</div>
<p>You may change your Recovery Key password.</p>
<div class="figure">
<img alt="../_images/encryption12.png" src="../_images/encryption12.png" />
</div>
</div>
<div class="section" id="occ-encryption-commands">
<span id="occ-encryption-label"></span><h2>occ encryption commands<a class="headerlink" href="#occ-encryption-commands" title="Permalink to this headline">¶</a></h2>
<p>If you have shell access you may use the <code class="docutils literal"><span class="pre">occ</span></code> command to perform encryption
operations, and you have additional options such as decryption and creating a
single master encryption key. See <a class="reference internal" href="../configuration_server/occ_command.html#encryption-label"><span>Encryption</span></a> for detailed
instructions on using <code class="docutils literal"><span class="pre">occ</span></code>.</p>
<p>Get the current status of encryption and the loaded encryption module:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:status
- enabled: false
- defaultModule: OC_DEFAULT_MODULE
</pre></div>
</div>
<p>This is equivalent to checking <strong>Enable server-side encryption</strong> on your Admin
page:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:enable
Encryption enabled
Default module: OC_DEFAULT_MODULE
</pre></div>
</div>
<p>List the available encryption modules:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:list-modules
- OC_DEFAULT_MODULE: Default encryption module [default*]
</pre></div>
</div>
<p>Select a different default Encryption module (currently the only available
module is OC_DEFAULT_MODULE):</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:set-default-module [Module ID].
</pre></div>
</div>
<p>The [module ID] is taken from the <code class="docutils literal"><span class="pre">encryption:list-modules</span></code> command.</p>
<p>Encrypt all data files for all users. For performance reasons, when you enable
encryption on an Nextcloud server only new and changed files are encrypted. This
command gives you the option to encrypt all files. You must first put your
Nextcloud server into maintenance mode to prevent any user activity until
encryption is completed:</p>
<div class="highlight-python"><div class="highlight"><pre>occ maintenance:mode --on
Maintenance mode is currently enabled
</pre></div>
</div>
<p>Then run <code class="docutils literal"><span class="pre">occ</span></code>:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:encrypt-all
You are about to start to encrypt all files stored in your Nextcloud.
It will depend on the encryption module you use which files get encrypted.
Depending on the number and size of your files this can take some time.
Please make sure that no users access their files during this process!
Do you really want to continue? (y/n)
</pre></div>
</div>
<p>When you type <code class="docutils literal"><span class="pre">y</span></code> it creates a key pair for each of your users, and then
encrypts their files, displaying progress until all user files are encrypted.</p>
<p>Decrypt all user data files, or optionally a single user:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:decrypt-all [username]
</pre></div>
</div>
<p>View current location of keys:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:show-key-storage-root
Current key storage root: default storage location (data/)
</pre></div>
</div>
<p>Move keys to a different folder, either locally or on a different server.
The folder must already exist, be owned by root and your HTTP group, and be
restricted to root and your HTTP group. Further the folder needs to be located
somewhere in your Nextcloud data folder, either physically, or as a mount.
This example is for Ubuntu Linux. Note that the new folder is relative to your <code class="docutils literal"><span class="pre">occ</span></code> directory:</p>
<div class="highlight-python"><div class="highlight"><pre>cd /your/nextcloud/data
mkdir keys
chown -R root:www-data keys
chmod -R 0770 keys
occ encryption:change-key-storage-root keys
Start to move keys:
4 [============================]
Key storage root successfully changed to keys
</pre></div>
</div>
<p>Create a new master key. Use this when you have a single-sign on
infrastructure. Use this only on fresh installations with no existing data, or
on systems where encryption has not already been enabled. It is not possible to
disable it:</p>
<div class="highlight-python"><div class="highlight"><pre>occ encryption:enable-master-key
</pre></div>
</div>
</div>
<div class="section" id="disabling-encryption">
<h2>Disabling encryption<a class="headerlink" href="#disabling-encryption" title="Permalink to this headline">¶</a></h2>
<p>You may disable encryption only with <code class="docutils literal"><span class="pre">occ</span></code>. Make sure you have backups of all
encryption keys, including users’. Put your Nextcloud server into
maintenance mode, and then disable your encryption module with this command:</p>
<div class="highlight-python"><div class="highlight"><pre>occ maintenance:mode --on
occ encryption:disable
</pre></div>
</div>
<p>Take it out of maintenance mode when you are finished:</p>
<div class="highlight-python"><div class="highlight"><pre>occ maintenance:mode --off
</pre></div>
</div>
</div>
<div class="section" id="files-not-encrypted">
<h2>Files not encrypted<a class="headerlink" href="#files-not-encrypted" title="Permalink to this headline">¶</a></h2>
<p>Only the data in the files in <code class="docutils literal"><span class="pre">data/user/files</span></code> are encrypted, and not the
filenames or folder structures. These files are never encrypted:</p>
<ul class="simple">
<li>Existing files in the trash bin & Versions. Only new and changed files after
encryption is enabled are encrypted.</li>
<li>Existing files in Versions</li>
<li>Image thumbnails from the Gallery app</li>
<li>Previews from the Files app</li>
<li>The search index from the full text search app</li>
<li>Third-party app data</li>
</ul>
<p>There may be other files that are not encrypted; only files that are exposed to
third-party storage providers are guaranteed to be encrypted.</p>
</div>
<div class="section" id="ldap-and-other-external-user-back-ends">
<h2>LDAP and other external user back-ends<a class="headerlink" href="#ldap-and-other-external-user-back-ends" title="Permalink to this headline">¶</a></h2>
<p>If you use an external user back-end, such as an LDAP or Samba server, and you
change a user’s password on the back-end, the user will be prompted to change
their Nextcloud login to match on their next Nextcloud login. The user will need
both their old and new passwords to do this. If you have enabled the Recovery
Key then you can change a user’s password in the Nextcloud Users panel to match
their back-end password, and then, of course, notify the user and give them
their new password.</p>
</div>
</div>
<ul class="prevnext-title list-unstyled list-inline">
<li class="prev">
<a href="external_storage/auth_mechanisms.html" title="Previous Chapter: External Storage authentication mechanisms"><span class="glyphicon glyphicon-chevron-left visible-sm"></span><span class="hidden-sm">« External Storage authentication mechanisms</span>
</a>
</li>
<li class="next">
<a href="files_locking_transactional.html" title="Next Chapter: Transactional file locking"><span class="glyphicon glyphicon-chevron-right visible-sm"></span><span class="hidden-sm">Transactional file locking »</span>
</a>
</li>
</ul>
</div>
</div>
</div>
</main>
</div>
</div>
</body>
</html>