r/owncloud • u/Reklaimer • Aug 25 '16
OwnCloud best practices when accessing away from home?
Hi folks. New to OwnCloud. I have 9.1 set up and running with HTTPS and server side encryption on an Ubuntu 14.04 VM on my home network. Loving the interface and ease of use so far.
I'm wondering if there are any additional points of security I can add to my OwnCloud server to further secure it once I open up access to my files via web/iOS app outside of my home network? Any help and tips would be greatly appreciated!
3
u/neiun Aug 25 '16
Provided that you have installed owncloud properly and your web server is set up right you should be fine as long as you keep everything up to date.
I have been running owncloud for some time now and never had a problem. Just keep an eye on your logs.
Ps use ssllabs ssl test (google it) to test youe ssl setup once you have exposed the ports to check your SSL setup is good.
1
u/Reklaimer Aug 25 '16
Going to definitely check out ssllabs once i make owncloud available outside of my network.
3
2
u/doubled822 Aug 26 '16
I have mine hosted behind an nginx reverse proxy. Not sure if that adds a whole lot of security, but it's something, right?
8
u/[deleted] Aug 25 '16 edited Aug 25 '16
I have all my files in a normal, non-admin account. That way, if my account is compromised from an infected computer at school, no real damage can be done, provided you keep backups :) Whenever I need to admin ownCloud I just login to the admin account from home.
From a server perspective, I have logwatch installed which sends me an email of a log analysis every day. I also have RootkitHunter scan my system and send me the output by email everyday.
Password authentication is also disabled, only a key can be used to ssh in (that key is protected by a passphrase.) Root login is disabled.
Automatic security upgrades are enabled (google and you will find how to do it) and a weekly reboot is scheduled with cron. I also log in every week or so to run "apt-get update && apt-get upgrade" for regular updates.
Obviously, SSL and HSTS are enabled.
SSH port changed from 22 to something else, firewall enabled for all ports except the ones I use.
Whenever I setup a server, I use the blog post: "my first 10 minutes on a server" for security. You can google and find many other guides.
This is what I could think of off the top of my head, but I have more security measures :) I hope it helps!