Nextcloud zero day security

Submitted ⁨⁨10⁩ ⁨months⁩ ago⁩ by ⁨thisisawayoflife@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

What is everyone doing? SELinux? AppArmor? Something else?

I currently leave my nextcloud exposed to the Internet. It runs in a VM behind an nginx reverse proxy on the VM itself, and then my OPNSense router runs nginx with WAF rules. I enforce 2fa and don’t allow sign-ups.

My goal is protecting against ransomware and zerodays (as much as possible). I don’t do random clicking on links in emails or anything like that, but I’m not sure how people get hit with ransomware. I keep nextcloud updated (subscribed to RSS update feed) frequently and the VM updates everyday and reboots when necessary. I’m running the latest php-fpm and that just comes from repos so it gets updated too. HTTPS on the lan with certificates maintained by my router, and LE certs for the Internet side.

Beside hiding this thing behind a VPN (which I’m not prepared to do currently), is there anything else I’m overlooking?

source

Comments

Sort:hotnew top

bjoern_tantau@swg-empire.de ⁨10⁩ ⁨months⁩ ago
For protection against ransomware you need backups. Ideally ones that are append-only where the history is preserved.

source
- thisisawayoflife@lemmy.world ⁨10⁩ ⁨months⁩ ago
  Good call. I do some backups now but I should formalize that process. Any recommendations on selfhost packages that can handle the append only functionality?
  
  source
  - Rootiest@lemmy.world ⁨10⁩ ⁨months⁩ ago
    I use and love Kopia for all my backups: local, LAN, and cloud.
    
    source
  - patchexempt@lemmy.zip ⁨10⁩ ⁨months⁩ ago
    I’ve used rclone with backblaze B2 very successfully. rclone is easy to configure and can encrypt everything locally before uploading, and B2 is dirt cheap and has retention policies so I can easily manage (per storage pool) how long deleted/changed files should be retained. works well.
    
    also once you get something set up. make sure to test run a restore! a backup solution is only good if you make sure it works :)
    
    source
    -> View More Comments
  - baccaratrevivify@lemmy.world ⁨10⁩ ⁨months⁩ ago
    Borg backup has append only
    
    source
  - tuhriel@infosec.pub ⁨10⁩ ⁨months⁩ ago
    Restic can do append-only when you use their rest server (easily deployed in a docker container)
    
    source
  - bjoern_tantau@swg-empire.de ⁨10⁩ ⁨months⁩ ago
    No, I’d actually be interested in that myself. I currently just rsync to another server.
    
    source
thatsnothowyoudoit@lemmy.ca ⁨10⁩ ⁨months⁩ ago
Nextcloud isn’t exposed, only a WireGuard connection allows for remote access to Nextcloud.

The whole family has WireGuard on their laptops and phones.

They love it, because using WireGuard also means they get a by-default ad-free/tracker-free browsing experience.

Yes, this means I can’t share files securely with outsiders. It’s not a huge problem.

source
- BearOfaTime@lemm.ee ⁨10⁩ ⁨months⁩ ago
  Tailscale has a feature called Funnel that enables you to share a resource over Tailscale to users who don’t have Tailscale.
  
  Wonder if Wireguard has something similar (Tailscale uses Wireguard)
  
  source
  - thatsnothowyoudoit@lemmy.ca ⁨10⁩ ⁨months⁩ ago
    Neat, I’ll have to look it up. Thanks for sharing!
    
    source
- Chewy7324@discuss.tchncs.de ⁨10⁩ ⁨months⁩ ago
  Wireguard is awesome and doesn’t even show up on the battery usage statistics of my phone.
  
  With such a small attack surface I don’t have to worry about zero days for vaultwarden and immich.
  
  source
beerclue@lemmy.world ⁨10⁩ ⁨months⁩ ago
Not only for Nextcloud, but I recommend setting up crowdsec for any publicly facing service. You’d be surprised by the amount of bots and script kiddies out there trying their luck…

source
- thisisawayoflife@lemmy.world ⁨10⁩ ⁨months⁩ ago
  One of my next steps was hardening my OPNSense router as it handles all the edge network reverse proxy duties, so IDS was in the list. I’m digging into Crowdsec now, it looks like there’s an implementation for OPNsense. Thanks for the tip!
  
  source
- False@lemmy.world ⁨10⁩ ⁨months⁩ ago
  How is this different from Fail2Ban?
  
  source
  - johntash@eviltoast.org ⁨10⁩ ⁨months⁩ ago
    Iirc crowdsec is like fail2ban but blocks ips reported by other servers, not just ones attacking your server. Kinda like a distributed fail2ban I guess?
    
    source
    -> View More Comments
  - TwinHaelix@reddthat.com ⁨10⁩ ⁨months⁩ ago
    My recollection is that Fail2Ban has some default settings, but is mostly reactionary in terms of blacklisting things that it observes trying to get in. Crowdsec behaves in a similar vein but, as the name implies, includes a lot of crowdsourced rules and preventative measures.
    
    source
  - Comptero@feddit.ch ⁨10⁩ ⁨months⁩ ago
    In my understanding fail2ban will block ips if they are detected to do brutforce or use known exploits.
    
    Crowdsec will share this IP via a blocklist to all subscribte systems. You will benefit form the detection of other systems and not only your own.
    
    source
johntash@eviltoast.org ⁨10⁩ ⁨months⁩ ago
Make sure your backups are solid and can’t be deleted or altered.

In addition to normal backups, something like zfs snapshots also help and make it easier to restore if needed.

I think I remember seeing a nextcloud plugin that detects mass changes to a lot of files (like ransomware would cause). Maybe something like that would help?

Also enforce good passwords.

Do you have anything exposed to the internet that also has access to either nextcloud or the server it’s running on? If so, lock that down as much as possible too.

Fail2ban or similar would help against brute force attacks.

The VM you’re running nextcloud on should be as isolated as you can comfortably make it. E.g. if you have a camera/iot vlan, don’t let the VM talk to it. Don’t let it initiate outbound connections to any of your devices, etc

You can’t entirely protect against zero day vulnerabilities, but you can do a lot to limit the risk and blast radius.

source
lemmyvore@feddit.nl ⁨10⁩ ⁨months⁩ ago
All the measures you listed amount to nothing against a zero day remote exploit. They bypass the normal authentication process.

If you’re not able to use a VPN then use a IAM layer, which requires you to login through another method. You can use a dedicated app like Authelia/Authentik in front of the reverse proxy, or if you use nginx as reverse proxy you also have to option of using the vouch-proxy plugin.

source
JustinAngel@lemmy.world ⁨10⁩ ⁨months⁩ ago
Yikes! I’d avoid leaving any services externally exposed unless they’re absolutely necessary…

Tailscale+Headscale are pretty easy to implement these days. Since it’s effectively zero trust, the tunnels become the encrypted channel so there’s an argument that HTTPS isn’t really required unless some endpoints won’t be accessing services over the Tailnet. SmallStep and Caddy can be used to automatically manage certs if it’s needed though.

You can even configure a PiHole (or derivative) to be your DNS server on the VPN, giving you ad blocking on the go.

source
- TechLich@lemmy.world ⁨10⁩ ⁨months⁩ ago
  
  there’s an argument that HTTPS isn’t really required…
  
  Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.
  
  The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.
  
  If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.
  
  source
  - JustinAngel@lemmy.world ⁨10⁩ ⁨months⁩ ago
    
    Tailscale is one of those services…
    
    Tailscale isn’t an exposed service. Headscale is, and it isn’t connected to the Tailnet. It’s a control server used to communicate public keys and connectivity information between nodes. Sure, a threat actor can join nodes to the Tailnet should it become compromised. But have you looked at Headscale’s codebase? The attack surface is significantly smaller than anything like OpenVPN.
    
    A cert tells you that you are actually…
    
    I’m all for ssl/tls, but it’s more work and may not always be worth the effort depending upon the application, which is exactly why I recommended SmallStep+Caddy. Let’s not pretend that introducing things like a CA don’t introduce complexity and overhead, even if it’s just distributing the root cert to devices.
    
    MITM/DNS Hijack/ARP Poisoning…
    
    Are you suggesting that these attack techniques are effective against zero trust tunnels? Given that the encryption values are sent out of band, via the control channel, how would one intercept and replay the traffic?
    
    source
    -> View More Comments
Decronym@lemmy.decronym.xyz ⁨10⁩ ⁨months⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

HTTP Hypertext Transfer Protocol, the Web

VPN Virtual Private Network

nginx Popular HTTP server

[Thread #394 for this sub, first seen 1st Jan 2024, 18:55] [FAQ] [Full list] [Contact] [Source code]

source
possiblylinux127@lemmy.zip ⁨10⁩ ⁨months⁩ ago
I would move it into docker as that will give you a extra layer of security and simplify updates.

From there make sure you have backups that aren’t easily deleted. Additionally make sure your reverse proxy is setup correctly and implements proper security.

source
tagginator@utter.online [bot] ⁨10⁩ ⁨months⁩ ago
New Lemmy Post: Nextcloud zero day security (https://lemmy.world/post/10188042)
Tagging: #SelfHosted
(Replying in the OP of this thread (NOT THIS BOT!) will appear as a comment in the lemmy discussion.)
I am a FOSS bot. Check my README: https://github.com/db0/lemmy-tagginator/blob/main/README.md
source

Fewer Letters	More Letters
HTTP	Hypertext Transfer Protocol, the Web
VPN	Virtual Private Network
nginx	Popular HTTP server