Using self-signed certificates¶

When using self-signed certificates for external storage mounts the certificate needs to be imported in the personal settings of the user. Please refer to this blogpost for more informations.

Adding files to external storages¶

In general it is recommended to configure the background job Webcron or Cron as described in Defining Background Jobs so ownCloud is able to detect files added to your external storages without the need that a users is browsing your ownCloud installation.

Please also be aware that ownCloud might not always be able to find out what has been changed remotely (files changes without going through ownCloud), especially when it’s very deep in the folder hierarchy of the external storage.

You might need to setup a cron job that runs sudo -u www-data php occ files:scan --all (or replace “–all” with the user name, see also Using the occ Command) to trigger a rescan of the user’s files periodically (for example every 15 minutes), which includes the mounted external storage.

Example¶

{"group":{
    "admin":{
        "\/$user\/files\/Admin_Stuff":{
            "class":"\\OC\\Files\\Storage\\Local",
            "options":{ ... },
            "priority":150
            }
        }
    }
 "user":{
    "all":{
        "\/$user\/files\/Pictures":{
            "class":"\\OC\\Files\\Storage\\DAV",
            "options":{ ... },
            "priority":100
            }
        }
    "someuser":{
        "\/someuser\/files\/Music":{
            "class":"\\OC\\Files\\Storage\\FTP",
            "options":{ ... },
            "priority":100
            }
        }
    }
}

Priorities¶

An advanced feature is available, only configurable directly in data/mount.json, which allows mount configurations to have an associated priority. When two or more valid mount configurations exist for the same mount point, the one with the highest priority (defined by the largest number) will take precedence and become the active mount for the user.

Each backend has a default priority, assigned when a mount configuration with that backend is created. The default priority will be shown in the example section for each backend below. Should a backend not provide a default priority, a value of 100 will be used.

There is also a concept of priority types, to preserve compatibility with previous mount configuration parsing. Mount configurations are evaluated in the following order, with later mount types always overriding a previous mount type:

• user -> all : global mount configurations
• group : group mount configurations
• user (not all) : per-user mount configurations
• data/$user/mount.json : personal mount configurations

Backends¶

{ "class":"\\OC\\Files\\Storage\\Local",
  "options":{ "datadir":"\/mnt\/additional_storage" },
  "priority":150
}

{   "class":"\\OC\\Files\\Storage\\FTP",
    "options":{
        "host":"ftp.myhost.com:21",
        "user":"johndoe",
        "password":"secret",
        "root":"\/Videos",
        "secure":"false"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\SFTP",
    "options":{
        "host":"ssh.myhost.com",
        "user":"johndoe",
        "password":"secret",
        "root":"\/Books"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\SMB",
    "options":{
        "host":"myhost.com",
        "user":"johndoe",
        "password":"secret",
        "share":"\/test",
        "root":"\/Pictures"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\SMB",
    "options":{
        "host":"myhost.com",
        "user":"domain\/johndoe",
        "password":"secret",
        "share":"\/test",
        "root":"\/Pictures"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\DAV",
    "options":{
        "host":"myhost.com\/webdav.php",
        "user":"johndoe",
        "password":"secret",
        "secure":"true"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\AmazonS3",
    "options":{
        "key":"key",
        "secret":"secret",
        "bucket":"bucket"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\Dropbox",
    "options":{
        "configured":"#configured",
        "app_key":"key",
        "app_secret":"secret",
        "token":"#token",
        "token_secret":"#token_secret"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\Google",
    "options":{
        "configured":"#configured",
        "client_id":"#client_id",
        "client_secret":"#client_secret",
        "token":"#token"
    },
    "priority":100
}

{   "class":"\\OC\\Files\\Storage\\SWIFT",
    "options":{
        "host":"swift.myhost.com\/auth",
        "user":"johndoe",
        "token":"secret",
        "root":"\/Videos",
        "secure":"true"
    },
    "priority":100
}

External Storage Password Management¶

ownCloud handles passwords for external mounts differently than regular ownCloud user passwords.

The regular user and file share passwords (when you use the default ownCloud user backend) are stored using a strong cryptographically secure hashing mechanism in the database. On a new user account with a new password, the password is hashed and stored in the ownCloud database. The plain-text password is never stored. When the user logs in, the hash of the password they enter is compared with the hash in the database. When the hashes match the user is allowed access. These are not recoverable, so when a user loses a password the only option is to create a new password.

Passwords which are used to connect against external storage (e.g. SMB or FTP), there we have to differentiate again between different implementations:

1. Login with ownCloud credentials

When a mountpoint has this option, for example SMB / CIFS using OC login, the password will be intercepted when a user logs in and written to the PHP session (which is a file on the filesystem), and written encrypted into the session with a key from the configuration file. Every time that password is required ownCloud reads it from the PHP session file.

When you use this option, features such as sharing will not work properly from that mountpoint when the user is not logged-in.

Depending on the implementation of the application, this means that the password could get leaked in the ps output, as we use smbclient for SMB storage access in the community version. There is a bug report on this. Consequently, we’re currently evaluating an alternative approach accessing the library directly, and thus not leaking the password anymore. This is already implemented in the Enterprise Edition in our Windows Network Drive application, and it will get into the community version once we have streamlined the code of the files_external application a little bit more.

2. Stored credentials

When you enter credentials into the files_external dialog those are stored on the filesystem and encrypted with a key stored in config.php. This is required since ownCloud needs access to those files and shares even when the user is not logged-in to have sharing and other key features properly working.

To sum up:

The “login with ownCloud credentials” SMB function in the community edition exposes the password in the server system’s process list. If you want to get around this limitation without waiting for it to be addressed in CE you can get the Enterprise Edition. However, even then the password is stored in the PHP session and a malicious admin could access it. You can protect your PHP session files using protections available in your filesystem. Stored credentials are always accessible to the ownCloud instance.