Skip to content

Latest commit

 

History

History
76 lines (59 loc) · 4.39 KB

ENCRYPTION.md

File metadata and controls

76 lines (59 loc) · 4.39 KB

Description

NextCloud supports server-side encryption which is covers both local files and remote files stored on service like Dropbox or Google Drive.

Details

There are four types of encryption available using four types of keys:

  • Master key - Default with one central key which can decrypto files of all users.
  • User key - Deprecated scheme. Could cause data loss if user los their password.
  • Recovery key - Recovery mechanism for user key scheme if password is lost.
  • Public sharing key - Used to secure files shared publicly, independent from master.

In our case we use the simplest and default scheme of using a single master key.

This key is defined in config.php as secret, and works together with instanceid. If instanceid field is changed NextCloud will fail to decrypto files with Bad Signature error.

For more details see the official documentation

Other notable facts:

  • Nextcloud generates a strong encryption key, which is unlocked by user’s passwords
  • Encrypting files increases their size by roughly 35%
  • Encryption keys are stored in data/<user>/files_encryption and data/files_encryption
  • Encryption does not help in case of the server being compromised

Tools

NextCloud provides a set of occ commands for managing the encryption setup:

 > docker exec -u 33 nextcloud-app php occ list encryption
Status 23.0.0

Usage:
  command [options] [arguments]

Options:
  -h, --help            Display this help message
  -q, --quiet           Do not output any message
  -V, --version         Display this application version
      --ansi            Force ANSI output
      --no-ansi         Disable ANSI output
  -n, --no-interaction  Do not ask any interactive question
      --no-warnings     Skip global warnings, show command output only
  -v|vv|vvv, --verbose  Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug

Available commands for the "encryption" namespace:
  encryption:change-key-storage-root     Change key storage root
  encryption:decrypt-all                 Disable server-side encryption and decrypt all files
  encryption:disable                     Disable encryption
  encryption:disable-master-key          Disable the master key and use per-user keys instead. Only available for fresh installations with no existing encrypted data! There is no way to enable it again.
  encryption:enable                      Enable encryption
  encryption:enable-master-key           Enable the master key. Only available for fresh installations with no existing encrypted data! There is also no way to disable it again.
  encryption:encrypt-all                 Encrypt all files for all users
  encryption:fix-encrypted-version       Fix the encrypted version if the encrypted file(s) are not downloadable.
  encryption:list-modules                List all available encryption modules
  encryption:migrate-key-storage-format  Migrate the format of the keystorage to a newer format
  encryption:recover-user                Recover user data in case of password lost. This only works if the user enabled the recovery key.
  encryption:scan:legacy-format          Scan the files for the legacy format
  encryption:set-default-module          Set the encryption default module
  encryption:show-key-storage-root       Show current key storage root
  encryption:status                      Lists the current status of encryption

There is also a separate decryption tool available.

Links