Security is the biggest strength of Nextcloud and the new release continues our track record of introducing new, innovative technologies to protect Nextcloud servers. In Nextcloud 12, a number of improvements for Bruteforce Protection were made and we introduced Rate Limiting as an option for app developers to make it harder to spam users on Nextcloud servers. This article will explain these new protections and help developers who work on Nextcloud apps to support them in their applications.
New in Nextcloud 12 is Rate Limiting. Rate Limiting can help protect servers from getting overloaded by broken apps and from users downloading too much data too quickly.
Improved: Brute Force Protection for apps
Brute Force Protection is meant to protect Nextcloud servers from attempts to guess user passwords in various ways. Besides the obvious “let’s try a big list of commonly used passwords” attack, it also makes it harder to use slightly more sophisticated attacks via the reset password form or trying to find app password tokens.
If triggered, brute force protection makes requests coming from an IP on a bruteforce protected controller with the same action slower and slower for a 24 hour period. The slow-down is up to 1 minute, slowly ramping up with increasing numbers of retries. One minute might not be much but slowing down retries from hundreds of times per second to 60 per hour effectively negates the danger of most brute force attempts. Triggers to the Brute Force Protection mechanism are stored in the database and result in a log entry so the admin can keep an eye on attempts at break in through brute force attacks.
Bruteforce protection can now be used by controllers of any app in a very easy way by adding an Annotation on a controller. @BruteForceProtection(action=string)
string is the name of the action. Such as login or reset. Brute-force attempts are on a per-action basis; this means if a violation for the login action is triggered, other actions such as reset or foobar are not affected.
The throttle() method has to be called on the response in case of a violation. Doing so will increase the throttle counter and make following requests slower.
Rate Limiting is a new security capability in Nextcloud 12. It allows a developer to specify how often an IP range or a user may send a request in a specific time period. This can be useful for expensive API calls, to prevent users from accessing too much data in a smaller attempt of time or harden bruteforce stuff further.
Rate limiting is currently only enabled if a memory cache is configured because every request is logged, requiring a potentially very large amount of database writes. Fallback to database may be added in the future, however the load on the database would be significant.
Like with Brute Force Protection, Rate Limiting can be enabled by adding Annotations to the controller: @UserRateThrottle(limit=int, period=int) The rate limiting that is applied to logged-in users. If not specified Nextcloud will fallback to AnonUserRateThrottle. @AnonRateThrottle(limit=int, period=int) The rate limiting that is applied to guests.
Rate limiting is only applied to the current controller method. So if the rate limit for one method is reached only the controller method will deliver a 429 status code.
As the above pull request shows, Rate Limiting and Brute Force Protection have been applied in the core Nextcloud code. We call on app developers to follow that example and implement these extra protections in their applications, making it even harder for adversaries to break the security of Nextcloud systems!
Today, US-based file sync & share vendor Kiteworks announced their acquisition of ownCloud and Dracoon. Kiteworks points out that their customers now have access to their file-sharing application. It is to be expected they will not maintain 3 similar products, but customers will have to migrate to the US firms’ platform or look for another […]
As part of Schleswig-Holstein's state digitization strategy, the state chancellery has announced they will work with Nextcloud to develop AI for working with government documents. This comes just after we announced the first private AI assistant last weekend with Hub 6. The German state already uses Nextcloud and their AI strategy aligns with our work on ethical, local AI technologies.
Over the last year, AI has become a popular topic. Some is hype, some is substance. Some is good, some is bad. We want to give you the good, not the bad, and ignore the hype! AI has a ton of opportunity – but also risk. So we put you in control – off by […]
The serious security flaws in ownCloud (now owned by Kiteworks) do NOT affect Nextcloud. We have strict security processes in place, and do not ship test data from libraries that can cause security breaches.