Security is the biggest strength of Nextcloud and the new release continues our track record of introducing new, innovative technologies to protect Nextcloud servers. In Nextcloud 12, a number of improvements for Bruteforce Protection were made and we introduced Rate Limiting as an option for app developers to make it harder to spam users on Nextcloud servers. This article will explain these new protections and help developers who work on Nextcloud apps to support them in their applications.
New in Nextcloud 12 is Rate Limiting. Rate Limiting can help protect servers from getting overloaded by broken apps and from users downloading too much data too quickly.
Improved: Brute Force Protection for apps
Brute Force Protection is meant to protect Nextcloud servers from attempts to guess user passwords in various ways. Besides the obvious “let’s try a big list of commonly used passwords” attack, it also makes it harder to use slightly more sophisticated attacks via the reset password form or trying to find app password tokens.
If triggered, brute force protection makes requests coming from an IP on a bruteforce protected controller with the same action slower and slower for a 24 hour period. The slow-down is up to 1 minute, slowly ramping up with increasing numbers of retries. One minute might not be much but slowing down retries from hundreds of times per second to 60 per hour effectively negates the danger of most brute force attempts. Triggers to the Brute Force Protection mechanism are stored in the database and result in a log entry so the admin can keep an eye on attempts at break in through brute force attacks.
Bruteforce protection can now be used by controllers of any app in a very easy way by adding an Annotation on a controller. @BruteForceProtection(action=string)
string is the name of the action. Such as login or reset. Brute-force attempts are on a per-action basis; this means if a violation for the login action is triggered, other actions such as reset or foobar are not affected.
The throttle() method has to be called on the response in case of a violation. Doing so will increase the throttle counter and make following requests slower.
Rate Limiting is a new security capability in Nextcloud 12. It allows a developer to specify how often an IP range or a user may send a request in a specific time period. This can be useful for expensive API calls, to prevent users from accessing too much data in a smaller attempt of time or harden bruteforce stuff further.
Rate limiting is currently only enabled if a memory cache is configured because every request is logged, requiring a potentially very large amount of database writes. Fallback to database may be added in the future, however the load on the database would be significant.
Like with Brute Force Protection, Rate Limiting can be enabled by adding Annotations to the controller: @UserRateThrottle(limit=int, period=int) The rate limiting that is applied to logged-in users. If not specified Nextcloud will fallback to AnonUserRateThrottle. @AnonRateThrottle(limit=int, period=int) The rate limiting that is applied to guests.
Rate limiting is only applied to the current controller method. So if the rate limit for one method is reached only the controller method will deliver a 429 status code.
As the above pull request shows, Rate Limiting and Brute Force Protection have been applied in the core Nextcloud code. We call on app developers to follow that example and implement these extra protections in their applications, making it even harder for adversaries to break the security of Nextcloud systems!
Nextcloud Enterprise Day is soon here and we have an amazing lineup of speakers providing insightful talks! One of those speakers is George Imrie from Nextcloud customer T-Systems – Deutsche Telekom’s business-customer IT affiliate. T-Systems is a digital transformation specialist, with operations in 20 countries worldwide.In preparation for their talk at the Nextcloud Enteprise Day […]
Last week, Nextcoud CEO Frank Karlitschek appeared on one of Germany’s biggest public service TV broadcaster’s: ZDF. Watch the news item by ZDF here. Interviewed in Nextcloud’s Berlin office, Frank explains the challenge the company faces up against big tech giants like Google and Microsoft. “That’s all very difficult for us, due to the fact […]
Nextcloud Enterprise Day is soon here and we have an amazing lineup of speakers providing insightful talks! One of those speakers is Mr. Birkner from the State Institute for School Quality and Teacher Training in Saxony-Anhalt (LISA) in Germany. In preparation for his talk at the Nextcloud Enteprise Day on June 13th, we asked him […]