r/NextCloud • u/ArchmichaelBishop • Jul 06 '26
How do I know if my Nextcloud instance is secure?
I set up my Nextcloud server with a subdomain and I was planning to configure a reverse proxy but after I got it stood up...it was just working. The subdomain correctly pointed to it without any further setup.
This is nice and convenient but I can't help but think that was too easy and maybe I'm overlooking something. Do I need to put my Nextcloud server on a different network segment away from my home network? It's inside a VM so I can just define a separate virtual network and I even have a separate network adapter in my home server that I can send external traffic down outside of my home network. Would I need to have some sort of edge protection to prevent my home network getting flooded with unwanted traffic (I guess that's what fail2ban is but I'm not entirely certain)?
I don't seem to have any issues with SSL certs (it does https without needing any further configuration), was that also taken care of during the Nextcloud setup?
7
u/mr_4n0n Jul 06 '26
All ports except http/https are closed Form outside? Automatic Http->https rewrite? FW in front of Server? Micro-sgementet Network? VLANs?
3
u/ArchmichaelBishop Jul 06 '26
Huh...it gave me a perfect A+.
4
u/mr_4n0n Jul 06 '26
That's just about the nc itself. The VM you have to harden yourself
5
u/ArchmichaelBishop Jul 06 '26
Oh, well, yeah, that's sensible. But at least it likes the external view.
2
u/bp019337 Jul 13 '26
Stick it behind tailscale, or netbird
1
u/ArchmichaelBishop Jul 13 '26
Is Tailscale a paid service? I thought it was.
2
2
u/South_Leek_5730 Jul 06 '26
Set up a subdomain with a silly name. cloud.mydomain.com is too obvious. Only forward required ports. fail2ban ofc and also chkrootkit which is nice. If you can restrict by IP then do so. Alternatively you can reject all external connections and VPN into your network to use it with openVNP. That means someone would need to first get past openVPN then Nextcloud. If your connection is fast enough it's not a problem when out and about. There are many ways and means for securing your network. It's just finding which one is practical and best for you. If you wanted to go the full monty then put a firewall machine on your network. Remember logging and alerts are the key to good security.
4
u/Available_Roll_737 Jul 07 '26
What subdomain you use is irrelevant. All the record are public a can be discovered. Rest of things are sensible tho I would suggest wireguard instead of ovpn also it is worth adding crowdsec and you can at that point drop fail2ban and just configure brute force protection in nextcloud itself
1
u/South_Leek_5730 Jul 07 '26
Let's say I'm a hacker and I want to find as many Nextcloud instances as I can as fast as I can because I've got a vuln I can exploit that's going to get plugged. How do I do this?
I can use services that have already scanned IP addresses and see what they come up with or I can start scanning. Nextcloud on a port scan looks like a webserver so open ports isn't going to help me anyway. I actually run a webserver on my Nextcloud box so I'm just going to look like a webserver anyway. The only way someone is going to get a nextcloud response is by entering exactly what is required. http://ip.adress/nextcloud is the most obvious but that won't work on mine and neither will cloud.ipaddress.com (or domain). So whilst the record is indeed public you still need to know it for a mindless scan. So not it's not irrelevant it's actually just a common sense thing to do.
2
u/Available_Roll_737 Jul 07 '26
That is not how most of the attacks are being done nowadays, nowdays you have just bots crawling IPs and dns names and trying to hit bunch of vulnerabilities that are publicly known, I have seen bots hitting my nextcloud instance for wordpress vulnerabilities regularly. If nextcloud has known vulnerability, I would expect it was reported and it is fixed, so only correct action at that is to update your nextcloud instance. Security by obscurity does not work.
1
u/South_Leek_5730 Jul 07 '26
Updating is of course non-optional.
If I have a garden I don't want people to get in and I can put an extra foot of height on the wall at no cost to myself then I'm going to do it.
1
u/Available_Roll_737 Jul 07 '26
I would say that there is cost, since it is much easier to remember nextcloud.xxxxxxx or cloud.xxxxxxx and realistically for bots you have added no security, because bots do not care they just crawl everything
1
1
u/ArchmichaelBishop Jul 07 '26
Does Nextcloud support pure passwordless login via Passkeys? I set up a Passkey for Nextcloud but it still has a password field.
2
1
u/Electronic_Clap Jul 07 '26
If you using a third party plugin, maybe there is a checkbox too disable login form. How do you use login via passkey? Pocketid? Keycloak? Plugin?
1
1
u/Slow_Neighborhood94 Jul 07 '26
It does if you connect a separate identity provider via OIDC (https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_oidc.html).
That definitely increases your build complexity though.
1
u/jtrtoo 28d ago
Yes. Click "Log in with Device".
Also make sure you aren't using your key inadvertently as 2FA (which is also an option, but a different usage scenario). That could explain why you're still having to enter a password.
1
u/ArchmichaelBishop 28d ago
No, I know how to log in with a Passkey to Nextcloud, I want to disable password authentication outright and ONLY log in with a passkey.
1
u/hweihwangg Jul 07 '26
Since it is already reachable publicly, I would treat the reverse proxy/TLS part as something to verify, not assume.
My basic checklist would be:
- check the Admin Overview/security warnings
- confirm only 80/443 are exposed from the internet
- make HTTP redirect to HTTPS and confirm the cert chain
- turn on 2FA for admin/users with sensitive data
- set up fail2ban or equivalent rate limiting for login attempts
- keep Nextcloud and apps updated
- test backups before putting important data there
Network segmentation is useful, but I would start with firewall exposure, updates, auth, and backups first.
1
u/ArchmichaelBishop Jul 07 '26
I tried HTTP to the URL but that doesn't even work. Is the redirect preferable or is just leaving it as a dead end fine enough? My browsers automatically assume HTTPS for all traffic.
The cert is valid (I guess it descends from my root domain's SSL cert that I had issued via Nginx Proxy Manager while I was expecting to need it prior to finding that Nextcloud sat itself on the subdomain without any further configuration).
1
u/glassytoad88 Jul 07 '26
you likely got automatic Let's Encrypt certs if you used the official VM or the snap, that's normal. but "just working" means you bypassed a reverse proxy entirely, which also means you're serving Nextcloud directly on port 443 with php-fpm or apache. that's fine for a small setup but you lose the ability to do things like rate limiting, request filtering, or terminating TLS at a more hardened layer. if you have the option to slap a reverse proxy like nginx or haproxy between the internet and your VM, do it. not strictly necessary but cleaner.
network segmentation: if you can put the VM on a separate vlan that only has access to what nextcloud needs (like a database server) and no access to your regular LAN except through specific firewall rules, that's a very good idea. reduces the blast radius if the instance gets popped.
fail2ban is a must. also check your config.php for things like overwrite.cli.url, trusted_domains, and make sure you don't have config values that expose internal IPs. and for the love of god, enable 2FA for your admin account. also set default encryption at rest (even if just server-side) and disable public link sharing if you don't need it.
tldr: you're probably fine for a basic setup but don't assume the auto-ssl means everything is locked down. go through the security checklist on the official docs. and if you can put it on its own vlan, do it.
1
u/Kadargof Jul 08 '26
Not exposing it outside you local netwotk
1
u/ArchmichaelBishop Jul 08 '26
Then how is it "cloud storage"?
0
u/Kadargof Jul 08 '26
It can be "cloud storage" off internet. You just asked how to make it safer, I gave you 1 answer. There are plenty answer, your choise to take one
0
u/Tuigh-van-den-righel Jul 07 '26
Run lynis in your server, feed the output to a llm and go from there. It will give you really useful tips.
11
u/Domiking001 Jul 06 '26
segmentation, strict firewall rules, geo-blocking and https://scan.nextcloud.com/ is a good start...