NextCloud Installation Q & A

Judibet · 30. Mai 2017

Thank you, it's working :-).

And for some errors, I don't understand.

Zitat von Nextcloud

The PHP Opcache is not properly configured. For better performance we recommend ↗ to use following settings in the php.ini:opcache.enable=1opcache.enable_cli=1opcache.interned_strings_buffer=8opcache.max_accelerated_files=10000opcache.memory_consumption=128opcache.save_comments=1opcache.revalidate_freq=1

Enabling these values in the file /etc/php5/fpm/php.ini or vi /etc/openmediavault/php.ini don't correct some errors (nginx was reloaded):

Bash: php.ini

always_populate_raw_post_data = -1


opcache.enable=1opcache.enable_cli=1
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

Where is the good php.ini file to edit it?

happyreacer · 30. Mai 2017

@Judibet
i have do it so:
NextCloud Installation Q & A

Judibet · 30. Mai 2017

Zitat von happyreacer

@Judibet
i have do it so:
NextCloud Installation Q & A

Maybe you will laugh.
This morning, after waked up, I thinked maybe relaunching php will be a good issue.

Your reply confirm it's the good issue.

I restarted php.
I will check when I return to home ;-).

Then yesterday, I had two more problems:

Impossible to send mail (in OMV and in Nextcloud)
Impossible to connect with new users created

I will check tonight to check if I have somethin in logs etc.

Judibet · 30. Mai 2017

Zitat von Judibet

Maybe you will laugh.This morning, after waked up, I thinked maybe relaunching php will be a good issue.

Your reply confirm it's the good issue.

I restarted php.
I will check when I return to home ;-).

Then yesterday, I had two more problems:
Impossible to send mail (in OMV and in Nextcloud)
Impossible to connect with new users created
I will check tonight to check if I have somethin in logs etc.

Alles anzeigen

OK, I found for this error:
Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set 'always_populate_raw_post_data' to '-1' in php.ini and use the php://input stream instead. at Unknown#0
We need to enable always_populate_raw_post_data = -1 in more files: /etc/php5/cgi/php.ini and /etc/php5/cli/php.ini

Source

anthology · 2. Juni 2017

So i've set everything up and dont have anny errors including ssl and the opcache error.

To fix the opcache error:

Code

sudo nano /etc/php5/fpm/php.ini

(scroll to the bottom with "page-down button")\
Paste the follow content

Code

opcache.enable=On
opcache.enable_cli=1
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.memory_consumption=128
opcache.save_comments=1
opcache.revalidate_freq=1

Save the file with CTRL+X

restart the PHP

Code

sudo service php5-fpm restart

TADAAAAA opcache error gone

tinh_x7 · 3. Juni 2017

The above solution already posted on page 6.

anthology · 3. Juni 2017

Zitat von tinh_x7

The above solution already posted on page 6.

lol sorry, didn't saw you're post

riff-raff · 5. Juni 2017

Updated to Nextcloud 12.0.0.29 and did an Security-Scan and got an "A"

The following Headers are not set:

X-Content-Type-Options

X-XSS-Protection

X-Download-Options

X-Permitted-Cross-Domain-Policies

I use the initial Nginx configuration, but removed the

add_header X-Frame-Options "SAMEORIGIN";

Which looks like this now:

Code

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
location = /robots.txt {
log_not_found off;
allow all;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
# last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
# set max upload size
client_max_body_size 50G;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass $socket;
fastcgi_intercept_errors on;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~* \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=7200";
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
# Optional: Don't log access to other assets
access_log off;
}

Alles anzeigen

How can I set the missing headers?

Edit: My Fail2Ban does not work, logging-level is set to 1, was there a change in logfile-creation?

my Fail2Ban filter looks like this:

Code

[Definition]
failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}
ignoreregex =

Edit2: Solved my Fail2Ban with this definition:

Code

[Definition]
failregex = ^.*Login failed: '.*' \(Remote IP: '<HOST>'.*$
ignoreregex =

For Nextcloud 11 there was a strong permissiongs guide in the official docs, but for 12 there isn't. Is there a recomendation which permissions should be set?

tinh_x7 · 7. Juni 2017

Zitat von riff-raff

For Nextcloud 11 there was a strong permissiongs guide in the official docs, but for 12 there isn't. Is there a recomendation which permissions should be set?

It should be the same strong permission guide.

riff-raff · 7. Juni 2017

Okay, thx, I'll apply them right away ...

What about the Nginx headers?

tinh_x7 · 8. Juni 2017

You did it right.

riff-raff · 8. Juni 2017

I meant how to set the additional headers for those options:

X-Content-Type-Options
X-XSS-Protection
X-Download-Options
X-Permitted-Cross-Domain-Policies

those which the Nextcloud Security Scan criticized on my Nextcloud 12 installation.

tinh_x7 · 11. Juni 2017

Those header already included in my vhost config on the setup page.
There are 12 headers total.

A side note regarding strong permission security, it's the same for v12.0 as this moment.
Source: https://github.com/nextcloud/v…_permissions_nextcloud.sh

Code

add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;


location = /robots.txt {
log_not_found off;
allow all;
access_log off;
}
# The following 2 rules are only needed for the user_webfinger app.
# Uncomment it if you're planning to use this app.
#rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
#rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json
# last;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
# set max upload size
client_max_body_size 50G;
fastcgi_buffers 64 4K;
# Disable gzip to avoid the removal of the ETag header
gzip off;
# Uncomment if your server is build with the ngx_pagespeed module
# This module is currently not supported.
#pagespeed off;
error_page 403 /core/templates/403.php;
error_page 404 /core/templates/404.php;
location / {
rewrite ^ /index.php$uri;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
#Avoid sending the security headers twice
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true;
fastcgi_pass $socket;
fastcgi_intercept_errors on;
}
location ~ ^/(?:updater|ocs-provider)(?:$|/) {
try_files $uri/ =404;
index index.php;
}
# Adding the cache control header for js and css files
# Make sure it is BELOW the PHP block
location ~* \.(?:css|js|woff|svg|gif)$ {
try_files $uri /index.php$uri$is_args$args;
add_header Cache-Control "public, max-age=7200";
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~* \.(?:png|html|ttf|ico|jpg|jpeg)$ {
try_files $uri /index.php$uri$is_args$args;
# Optional: Don't log access to other assets
access_log off;
}

Alles anzeigen

riff-raff · 11. Juni 2017

I double checked ... you are right, I have those headers already in my config-file; so why is this critizised by Nextcloud Security Check?

tinh_x7 · 11. Juni 2017

I don't know your setup, so it's hard to give you the solution.
I'm using the same vhost config that I posted here for everybody.
Check your config again.
Maybe a space or character in the code lines that may interfere with the codes.
If all fail, you can post your issue on NC forum for help.

riff-raff · 11. Juni 2017

I use the exact same config you posted above ....

daschizzle · 18. Juni 2017

I just create my frist omv system and installed nextcloud 12 yesterday following this tutorial.
Performance is quite good but i read that i could improve this further switching from AJAX to cron for background updates.

i configured a new cronjob using the omv interface with the following command executed every 15 mins by www-data:

Code

php5 -f /srv/dev-disk-by-label-SSD-DATA/www-nextcloud/cron.php

In the nextcloud log i now get this INFO when the job is executed:

Code

Info	cli	Memcache \OC\Memcache\APCu not available for distributed cache
Info	cli	Memcache \OC\Memcache\APCu not available for local cache

I have " 'memcache.local' => '\OC\Memcache\APCu', " in my config.php and the improvements infos from the administration page disappeared after i added those.
Of course php5-apcu is installed.

Any idea why this is info appears?

krutojmax · 21. Juni 2017

Hab das mal nach der Anleitung installiert. Bekomme komischerweise diese Fehler.
Hat schon jemand den Fehler behoben gehabt?

Und wenn ich dann auf die Liste klicke...

happyreacer · 21. Juni 2017

Zitat von krutojmax

Hab das mal nach der Anleitung installiert. Bekomme komischerweise diese Fehler.
Hat schon jemand den Fehler behoben gehabt?

Und wenn ich dann auf die Liste klicke...

it is stange can you install it again?

krutojmax · 21. Juni 2017

Zitat von happyreacer

it is stange can you install it again?

It's very strange. I installed it again and it works... thanks

Jetzt mitmachen!