Nextcloud Hub 26 Spring is here. Check the relase blog post and explore all new features!
Read more
Image Credit: Garrett LeSage
https://flic.kr/p/iYxHLh
Security is the biggest strength of Nextcloud and the new release continues our track record of introducing new, innovative technologies to protect Nextcloud servers. In Nextcloud 12, a number of improvements for Bruteforce Protection were made and we introduced Rate Limiting as an option for app developers to make it harder to spam users on Nextcloud servers. This article will explain these new protections and help developers who work on Nextcloud apps to support them in their applications.
Nextcloud 11 introduced better password handling, CSP 3.0 and Same-site Cookies support improvements and expanded brute force protection. In Nextcloud 12, Bruteforce Protection can now be used by application developers to improve the protection of their application.
New in Nextcloud 12 is Rate Limiting. Rate Limiting can help protect servers from getting overloaded by broken apps and from users downloading too much data too quickly.
Brute Force Protection is meant to protect Nextcloud servers from attempts to guess user passwords in various ways. Besides the obvious “let’s try a big list of commonly used passwords” attack, it also makes it harder to use slightly more sophisticated attacks via the reset password form or trying to find app password tokens.
If triggered, brute force protection makes requests coming from an IP on a bruteforce protected controller with the same action slower and slower for a 24 hour period. The slow-down is up to 1 minute, slowly ramping up with increasing numbers of retries. One minute might not be much but slowing down retries from hundreds of times per second to 60 per hour effectively negates the danger of most brute force attempts. Triggers to the Brute Force Protection mechanism are stored in the database and result in a log entry so the admin can keep an eye on attempts at break in through brute force attacks.
Bruteforce protection can now be used by controllers of any app in a very easy way by adding an Annotation on a controller.
@BruteForceProtection(action=string)
string is the name of the action. Such as login or reset. Brute-force attempts are on a per-action basis; this means if a violation for the login action is triggered, other actions such as reset or foobar are not affected.
The throttle() method has to be called on the response in case of a violation. Doing so will increase the throttle counter and make following requests slower.
Find more details and an example controller method in the documentation.
Rate Limiting is a new security capability in Nextcloud 12. It allows a developer to specify how often an IP range or a user may send a request in a specific time period. This can be useful for expensive API calls, to prevent users from accessing too much data in a smaller attempt of time or harden bruteforce stuff further.
Rate limiting is currently only enabled if a memory cache is configured because every request is logged, requiring a potentially very large amount of database writes. Fallback to database may be added in the future, however the load on the database would be significant.
Like with Brute Force Protection, Rate Limiting can be enabled by adding Annotations to the controller:
@UserRateThrottle(limit=int, period=int) The rate limiting that is applied to logged-in users. If not specified Nextcloud will fallback to AnonUserRateThrottle.
@AnonRateThrottle(limit=int, period=int) The rate limiting that is applied to guests.
Rate limiting is only applied to the current controller method. So if the rate limit for one method is reached only the controller method will deliver a 429 status code.
More details and example code can be found in the documentation.
On Github, see a real life example on how rate limiting can be easily applied: Nextcloud Server pull request 4434.
As the above pull request shows, Rate Limiting and Brute Force Protection have been applied in the core Nextcloud code. We call on app developers to follow that example and implement these extra protections in their applications, making it even harder for adversaries to break the security of Nextcloud systems!
Oggi presentiamo Nextcloud Hub 26 Spring, la nostra versione celebrativa. Ti offre una scelta ancora più ampia di strumenti, un'interfaccia più curata, una collaborazione senza stress e la nuova strategia di piattaforma, che permette agli sviluppatori di sfruttare meglio il nostro vasto ecosistema. costruito insieme, progettato per il futuro
Per saperne di più
Nextcloud Hub 25 Autumn semplifica l'avvio di una potente collaborazione con il pieno controllo dei tuoi dati. Dagli aggiornamenti del design globale al miglioramento dell'usabilità e delle prestazioni, scopri la nostra ultima release in questo blog.
Per saperne di più
Le organizzazioni, grandi e piccole, necessitano di una soluzione che garantisca la resilienza e la sovranità digitale delle loro operazioni: un'alternativa open source e rispettosa della privacy a Teams. E oggi presentiamo questa soluzione: Nextcloud Talk.
Per saperne di più
Organize your personal and team projects using kanban boards and Gantt charts with the private and secure Nextcloud Deck app.
Per saperne di più
We met Michael Redinger, the Head of the Central IT Service (ZID) at the University of Innsbruck, to ask him a few questions about how the University uses Nextcloud.
Per saperne di più
L’impostazione di un Nextcloud All-in-One o AIO è un modo semplice ed efficace per ottenere un’installazione Nextcloud completa con molte funzioni funzionanti già pronte. Ti offre una facile implementazione e manutenzione di queste funzionalità, permettendoti di mantenere i tuoi dati sotto il tuo controllo. In questo blog troverai le istruzioni per configurare un All-in-One su […]
Per saperne di più
