Skip to content

Commit 7b73d1d

Browse files
committed
add nc-encrypt
Signed-off-by: nachoparker <nacho@ownyourbits.com>
1 parent 532a6a8 commit 7b73d1d

File tree

15 files changed

+731
-37
lines changed

15 files changed

+731
-37
lines changed

bin/ncp-provisioning.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,12 @@ BKP="$( ls -1t /var/www/nextcloud-bkp_*.tar.gz 2>/dev/null | head -1 )"
6464
ncp-restore "$BKP_NEW" && rm "$BKP_NEW"
6565
}
6666

67+
## Check for encrypted data and ask for password
68+
if needs_decrypt; then
69+
echo "Detected encrypted instance"
70+
a2dissite ncp nextcloud
71+
a2ensite ncp-activation
72+
apache2ctl -k graceful
73+
fi
74+
6775
exit 0

bin/ncp/CONFIG/nc-datadir.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ configure()
100100
# datadir
101101
ncc config:system:set datadirectory --value="$DATADIR"
102102
ncc config:system:set logfile --value="$DATADIR/nextcloud.log"
103+
set_ncpcfg datadir "${datadir}"
103104
restore_maintenance_mode
104105
}
105106

bin/ncp/SECURITY/nc-encrypt.sh

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
#!/bin/bash
2+
3+
# Data at rest encryption for NextCloudPi
4+
#
5+
# Copyleft 2021 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com>
6+
# GPL licensed (see end of file) * Use at your own risk!
7+
#
8+
# More at: nextcloudpi.com
9+
#
10+
11+
is_active()
12+
{
13+
mount | grep ncdata_enc | grep -q gocryptfs
14+
}
15+
16+
install()
17+
{
18+
apt_install gocryptfs
19+
}
20+
21+
configure()
22+
{
23+
(
24+
set -eu -o pipefail
25+
local datadir parentdir encdir tmpdir
26+
datadir="$(get_ncpcfg datadir)"
27+
[[ "${datadir}" == "null" ]] && datadir=/var/www/nextcloud/data
28+
parentdir="$(dirname "${datadir}")"
29+
encdir="${parentdir}/ncdata_enc"
30+
tmpdir="$(mktemp -u -p "${parentdir}" -t nc-data-crypt.XXXXXX))"
31+
32+
[[ "${ACTIVE}" != "yes" ]] && {
33+
if ! is_active; then
34+
echo "Data not currently encrypted"
35+
return 0
36+
fi
37+
save_maintenance_mode
38+
trap restore_maintenance_mode EXIT
39+
echo "Decrypting data..."
40+
mkdir "${tmpdir}"
41+
chown www-data: "${tmpdir}"
42+
pkill tail # prevents from umounting in docker
43+
mv "${datadir}"/* "${datadir}"/.[!.]* "${tmpdir}"
44+
fusermount -u "${datadir}"
45+
rmdir "${datadir}"
46+
mv "${tmpdir}" "${datadir}"
47+
rm "${encdir}"/gocryptfs.*
48+
rmdir "${encdir}"
49+
echo "Data no longer encrypted"
50+
return
51+
}
52+
53+
if is_active; then
54+
echo "Encrypted data already in use"
55+
return
56+
fi
57+
58+
# Just mount already encrypted data
59+
if [[ -f "${encdir}"/gocryptfs.conf ]]; then
60+
echo "${PASSWORD}" | gocryptfs -allow_other -q "${encdir}" "${datadir}" 2>&1 | sed /^Switch/d
61+
62+
# switch to the regular virtual hosts after we decrypt, so we can access NC and ncp-web
63+
a2ensite ncp nextcloud
64+
a2dissite ncp-activation
65+
apache2ctl -k graceful
66+
67+
echo "Encrypted data now accessible"
68+
return
69+
fi
70+
mkdir -p "${encdir}"
71+
echo "${PASSWORD}" | gocryptfs -init -q "${encdir}"
72+
save_maintenance_mode
73+
trap restore_maintenance_mode EXIT
74+
75+
mv "${datadir}" "${tmpdir}"
76+
77+
mkdir "${datadir}"
78+
echo "${PASSWORD}" | gocryptfs -allow_other -q "${encdir}" "${datadir}" 2>&1 | sed /^Switch/d
79+
80+
echo "Encrypting data..."
81+
mv "${tmpdir}"/* "${tmpdir}"/.[!.]* "${datadir}"
82+
chown -R www-data: "${datadir}"
83+
rmdir "${tmpdir}"
84+
85+
set_ncpcfg datadir "${datadir}"
86+
87+
echo "Data is now encrypted"
88+
)
89+
}
90+
91+
# License
92+
#
93+
# This script is free software; you can redistribute it and/or modify it
94+
# under the terms of the GNU General Public License as published by
95+
# the Free Software Foundation; either version 2 of the License, or
96+
# (at your option) any later version.
97+
#
98+
# This script is distributed in the hope that it will be useful,
99+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
100+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
101+
# GNU General Public License for more details.
102+
#
103+
# You should have received a copy of the GNU General Public License
104+
# along with this script; if not, write to the
105+
# Free Software Foundation, Inc., 59 Temple Place, Suite 330,
106+
# Boston, MA 02111-1307 USA
107+

bin/nextcloud-domain.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
source /usr/local/etc/library.sh
44

5+
# wait until user decrypts the instance first
6+
while :; do
7+
needs_decrypt || break
8+
sleep 1
9+
done
10+
511
# wicd service finishes before completing DHCP
612
while :; do
713
local_ip="$(get_ip)"

build/docker/docker-compose.yml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ services:
1010
volumes:
1111
- ncdata:/data
1212
- /etc/localtime:/etc/localtime:ro
13+
# for nc-encrypt
14+
devices:
15+
- /dev/fuse:/dev/fuse
16+
# for nc-encrypt # NOTE: take a look at this https://github.com/docker/for-linux/issues/321#issuecomment-677744121
17+
cap_add:
18+
- SYS_ADMIN
1319
container_name: nextcloudpi
1420

1521
volumes:

build/docker/nextcloud/020nextcloud

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,14 @@ bash /usr/local/bin/ncp-provisioning.sh
5858
echo "Starting notify_push daemon"
5959
start_notify_push
6060

61+
if needs_decrypt; then
62+
echo "Waiting for user to decrypt instance"
63+
while :; do
64+
sleep 1
65+
needs_decrypt || break
66+
done
67+
fi
68+
6169
echo "Configuring Domain"
6270
# Trusted Domain (local/public IP)
6371
bash /usr/local/bin/nextcloud-domain.sh

changelog.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11

2-
[v1.42.3](https://github.com/nextcloud/nextcloudpi/commit/2d804cb) (2021-10-25) nextcloud-domain: fix variable collision
2+
[v1.43.0](https://github.com/nextcloud/nextcloudpi/commit/9bad41c) (2021-10-22) add nc-encrypt
33

4-
[v1.42.2](https://github.com/nextcloud/nextcloudpi/commit/9ff21bb) (2021-10-23) nc-backup-auto: ncc path
4+
[v1.42.5](https://github.com/nextcloud/nextcloudpi/commit/f0abbbc) (2021-10-27) letsencrypt: sync ncp and nc cert paths
5+
6+
[v1.42.4 ](https://github.com/nextcloud/nextcloudpi/commit/f7e28c2) (2021-10-27) small trusted domains refactor
7+
8+
[v1.42.3 ](https://github.com/nextcloud/nextcloudpi/commit/b1e7323) (2021-10-25) nextcloud-domain: fix variable collision
9+
10+
[v1.42.2 ](https://github.com/nextcloud/nextcloudpi/commit/9ff21bb) (2021-10-23) nc-backup-auto: ncc path
511

612
[v1.42.1 ](https://github.com/nextcloud/nextcloudpi/commit/e11ce59) (2021-10-22) ncp-web: fix log download bug
713

etc/library.sh

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ command -v jq &>/dev/null || {
3232
PHPVER=$( jq -r .php_version < "$NCPCFG")
3333
RELEASE=$( jq -r .release < "$NCPCFG")
3434
}
35-
command -v ncc &>/dev/null && NCVER="$(ncc status | grep "version:" | awk '{ print $3 }')"
35+
command -v ncc &>/dev/null && NCVER="$(ncc status 2>/dev/null | grep "version:" | awk '{ print $3 }')"
3636

3737
function configure_app()
3838
{
@@ -481,6 +481,29 @@ function restore_maintenance_mode()
481481
fi
482482
}
483483

484+
function needs_decrypt()
485+
{
486+
local active
487+
active="$(find_app_param nc-encrypt ACTIVE)"
488+
(! is_active_app nc-encrypt) && [[ "${active}" == "yes" ]]
489+
}
490+
491+
function set_ncpcfg()
492+
{
493+
local name="${1}"
494+
local value="${2}"
495+
local cfg
496+
cfg="$(jq '.' "${NCPCFG}")"
497+
cfg="$(jq ".${name} = \"${value}\"" <<<"${cfg}")"
498+
echo "$cfg" > "${NCPCFG}"
499+
}
500+
501+
function get_ncpcfg()
502+
{
503+
local name="${1}"
504+
jq -r ".${name}" < "${NCPCFG}"
505+
}
506+
484507
# License
485508
#
486509
# This script is free software; you can redistribute it and/or modify it

etc/ncp-config.d/nc-encrypt.cfg

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"id": "nc-encrypt",
3+
"name": "Nc-encrypt",
4+
"title": "nc-encrypt",
5+
"description": "Data at rest encryption for NCP",
6+
"info": "The encryption password will be needed after every reboot.\nThis will increase CPU usage.",
7+
"infotitle": "",
8+
"params": [
9+
{
10+
"id": "ACTIVE",
11+
"name": "Active",
12+
"value": "no",
13+
"type": "bool"
14+
},
15+
{
16+
"id": "PASSWORD",
17+
"name": "Password",
18+
"value": "ownyourbits",
19+
"type": "password"
20+
}
21+
]
22+
}

ncp-web/activate/index.php

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,25 @@
11
<?php
2-
// disallow once activated
3-
exec("a2query -s ncp-activation", $output, $ret);
4-
if ($ret != 0) {
5-
http_response_code(404);
6-
exit();
7-
}
8-
session_start();
2+
// disallow once activated
3+
exec("a2query -s ncp-activation", $output, $ret);
4+
if ($ret != 0) {
5+
http_response_code(404);
6+
exit();
7+
}
8+
ini_set('session.cookie_httponly', 1);
9+
if (isset($_SERVER['HTTPS']))
10+
ini_set('session.cookie_secure', 1);
11+
session_start();
12+
13+
// security headers
14+
header("Content-Security-Policy: default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self'; object-src 'self';");
15+
header("X-XSS-Protection: 1; mode=block");
16+
header("X-Content-Type-Options: nosniff");
17+
header("X-Robots-Tag: none");
18+
header("X-Permitted-Cross-Domain-Policies: none");
19+
header("X-Frame-Options: DENY");
20+
header("Cache-Control: no-cache");
21+
header('Pragma: no-cache');
22+
header('Expires: -1');
923
?>
1024
<!DOCTYPE html>
1125
<html class="ng-csp" data-placeholder-focus="false" lang="en">
@@ -63,7 +77,7 @@
6377
</div>
6478
<footer role="contentinfo">
6579
<p class="info">
66-
<a href="https://ownyourbits.com/2017/02/13/nextcloud-ready-raspberry-pi-image/" target="_blank" rel="noreferrer noopener">NextCloudPi</a> – Keep your data close</p>
80+
<a href="https://nextcloudpi.com" target="_blank" rel="noreferrer noopener">NextCloudPi</a> – Keep your data close</p>
6781
</footer>
6882
<?php
6983
include('../csrf.php');

0 commit comments

Comments
 (0)