Security & setup warnings Nextcloud app

ymd

I installed a Nexctloud app using the installer and after a fresh install Nextcloud is reporting several warnings. How can this be fixed?


1. The reverse proxy header configuration is incorrect. This is a security issue and can allow an attacker to spoof their IP address as visible to the Nextcloud. For more details see the documentation ↗.
2. The PHP memory limit is below the recommended value of 512 MB.
3. The PHP OPcache module is not properly configured. The OPcache buffer is nearly full. To assure that all scripts can be hold in cache, it is recommended to apply "opcache.memory_consumption" to your PHP configuration with a value higher than "128". The OPcache interned strings buffer is nearly full. To assure that repeating strings can be effectively cached, it is recommended to apply "opcache.interned_strings_buffer" to your PHP configuration with a value higher than "8".. For more details see the documentation ↗.
4. The "Strict-Transport-Security" HTTP header is not set to at least "15552000" seconds. For enhanced security, it is recommended to enable HSTS as described in the security tips ↗.
5. Your web server is not properly set up to resolve "/.well-known/caldav". Further information can be found in the documentation ↗.
6. Your web server is not properly set up to resolve "/.well-known/carddav". Further information can be found in the documentation ↗.
7. The database is used for transactional file locking. To enhance performance, please configure memcache, if available. For more details see the documentation ↗.
8. No memory cache has been configured. To enhance performance, please configure a memcache, if available. For more details see the documentation ↗.

sean

ymd we hope to have a new installer in the future that doesn't have these issues but for now you should be able to fix them by editing your configuration on the server:

The reverse proxy header configuration is incorrect: add the following to your app's config/config.php, replacing 'opalN' with your Opalstack server hostname:

'trusted_proxies' =>
 array (
   0 => 'opalN.opalstack.com',
 ),

PHP memory limit: add memory_limit=512M to your app's .user.ini.
PHP OPCache module: run the app via a private Apache/PHP-FPM stack so that you'll have your own opcache. Instructions are at HOWTO run a private PHP-FPM stack on Nginx or Apache on Opalstack

Strict-transport-security header: add the following to the your app's .htaccess:

Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"

caldav and carddav: try removing the trailing slashes from the related rewrite URLs in your app's .htaccess, for example:

RewriteRule ^\.well-known/carddav /remote.php/dav [R=301,L]
RewriteRule ^\.well-known/caldav /remote.php/dav [R=301,L]

database is used for transactional file locking: spin up a Redis instance and configure Nextcloud to use it. We don't have a detailed Redis tutorial but some info is available here. The related Nextcloud docs are here.

No memory cache has been configured: spin up a memcached instance and configure Nextcloud to use it. You can run memcached by following the instructions under "Start a memcached instance" here. Once you have memcached running, add the following to your app's config/config.php replacing "USER" and "APP" with your shell user and app names:

'memcache.local' => '\OC\Memcache\Memcached',
'memcache.distributed' => '\OC\Memcache\Memcached',
'memcached_servers' => [
  [ '/home/USER/logs/apps/APP/memcached.sock', 0 ],
],

Hope this helps 🙂

ymd

Thank you for quick answer, this is very helpful! I will probably set up an own php-fpm stack.
Did I understand correctly that for Nextcloud your repo

https://github.com/defulmere/userspace-fpm-installer/tree/opalstack

is better than the one suggested in the HOWTO mentioned above (i.e https://github.com/rsanden/userspace-fpm-installer/tree/opalstack)

You have made some update that have never been merged apparently.

sean

ymd You're very welcome!

Regarding the repo, the fixes for my branch aren't critical and either branch should work. Feel free to use mine if you'd like.

azuiker

Sean and YMD, this thread is useful -- I can finally fix some of the errors I've been seeing in my Nextcloud install (which I then need to update). Thank you.

bobbyfiend

This thread has helped me a couple of times. Since upgrading to Nextcloud 29 a bunch of things are broken (again) and my fixes aren't working. Any help is welcome. Errors/warnings:

Your "trusted_proxies" setting is not correctly set, it should be an array of IP addresses - optionally with range in CIDR notation. For more details see the documentation ↗.

Current setting in config.php:

'trusted_proxies' =>
  array (
    0 => '46.165.217.151',
    1 => '209.58.146.193',
    2 => '209.58.138.136',
  ),

I tried just 0 => 'opal15.opalstack.com' first, but that also didn't make the error disappear. The IP addresses above are for opal15, imap1.us, and mail1.us, which are a stretch (I didn't know if I now needed multiple trusted proxies...) Not sure where to go from here.

The PHP memory limit is below the recommended value of 512 MB.

Here's my .user.ini file in the root directory of the Nextcloud app, right now:

mbstring.func_overload=0
always_populate_raw_post_data=-1
default_charset='UTF-8'
output_buffering=0
memory_limit=512M
opcache.memory_consumption=256
opcache.interned_strings_buffer=16

The last 2 lines are suggestions from other (also new) warnings. The settings in .user.ini seem to have no effect (I've tried memory_limit = 512M, 1024M, and 1G); Nextcloud admin view still shows memory_limit=128M.

Some headers are not set correctly on your instance - The Strict-Transport-Security HTTP header is not set (should be at least 15552000 seconds). For enhanced security, it is recommended to enable HSTS.

.htaccess in the root of the Nextcloud app directory includes this:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"

I also tried it under <IfModule mod_env.c> (because I'm not 100% sure where it goes). No effect so far.

Then a bunch of other warnings, like

The database is missing some indexes. Due to the fact that adding indexes on big tables could take some time they were not added automatically. By running "occ db:add-missing-indices" those missing indexes could be added manually while the instance keeps running. Once the indexes are added queries to those tables are usually much faster. Missing optional index "dav_shares_resourceid_type" in table "dav_shares". Missing optional index "dav_shares_resourceid_access" in table "dav_shares". Missing optional index "oc_npushhash_di" in table "notifications_pushhash". Missing optional index "schedulobj_lastmodified_idx" in table "schedulingobjects".

I used the occ-web app (because I can't run occ commands on shared hosting) and ran the command suggested above. There was no feedback except lines that seemed to note the command had run (I rand it later and there was no feedback at all, so i assume the command ran the first time). Nevertheless, this error persists.

The app is type "Apache/PHP-FPM" so maybe .user.ini, .htaccess, etc. don't work for that setup? Not sure. In any case, Nextcloud is broken (i.e., refuses to sync or authenticate the desktop app) and my tech-ignorant ass can't fix it. If you have any suggestions, they would be very useful to me.

nick

bobbyfiend Re:

In my tests, the following updates resolve the messages:

Your "trusted_proxies" setting is not correctly set, it should be an array of IP addresses - optionally with range in CIDR notation. For more details see the documentation ↗.

The Opal server IP should suffice for this:
'trusted_proxies' => [ 'xxx.xxx.xxx.xxx', // Replace with the actual IP address ],

The PHP memory limit is below the recommended value of 512 MB.

The value memory_limit = 512M in my test app resolved this warning. If you open a ticket we can check further or maybe restart the PHP server to pickup the changes if they are not propagating for some reason.

Some headers are not set correctly on your instance - The Strict-Transport-Security HTTP header is not set (should be at least 15552000 seconds). For enhanced security, it is recommended to enable HSTS.

Adding Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" to my test app .htaccess, literally at the bottom of the file, resolved the warning. As above, maybe Apache needs a nudge to reload the settings.

The database is missing some indexes. Due to the fact that adding indexes on big tables could take some time they were not added automatically. By running "occ db:add-missing-indices" those missing indexes could be added manually while the instance keeps running. Once the indexes are added queries to those tables are usually much faster. Missing optional index "dav_shares_resourceid_type" in table "dav_shares". Missing optional index "dav_shares_resourceid_access" in table "dav_shares". Missing optional index "oc_npushhash_di" in table "notifications_pushhash". Missing optional index "schedulobj_lastmodified_idx" in table "schedulingobjects".

Running phpXX occ db:add-missing-indices where XX is the PHP version in use, from the nextcloud app dir, resolved this in my test app.

The app is type "Apache/PHP-FPM" so maybe .user.ini, .htaccess, etc. don't work for that setup? Not sure. In any case, Nextcloud is broken (i.e., refuses to sync or authenticate the desktop app) and my tech-ignorant ass can't fix it. If you have any suggestions, they would be very useful to me.

Those configs work because it is an Apache/PHP-FPM app so no problems with that. If the above do not work I would open a support ticket for closer inspection.

bobbyfiend

Thanks for the reply! What I did was... nothing (except what I noted above). I got busy and came back and checked about 24 hours later and all the errors + most warnings were gone. I assume it's like you said; the server just needed to catch up.