Give PHP read accesss to /dev/urandom¶

ownCloud uses a RFC 4086 (“Randomness Requirements for Security”) compliant mixer to generate cryptographically secure pseudo-random numbers. This means that when generating a random number ownCloud will request multiple random numbers from different sources and derive from these the final random number.

The random number generation also tries to request random numbers from /dev/urandom, thus it is highly recommended to configure your setup in such a way that PHP is able to read random data from it.

Enable hardening modules such as SELinux¶

It is highly recommend to enable hardening modules such as SELinux where possible. See SELinux Configuration to learn more about SELinux.

Move data directory outside of the web root¶

It is highly recommended to move the data directory (where ownCloud stores its data) outside of the web root (i.e. outside of /var/www) It is possible to do this by moving the folder manually, and then adjusting the 'datadirectory' parameter in config.php.

Disable preview image generation¶

ownCloud is able to generate preview images of common filetypes such as images or text files. By default the preview generation for some file types that we consider secure enough for deployment is enabled by default. However, administrators should be aware that these previews are generated using PHP libraries written in C which might be vulnerable to vulnerable attack vectors.

For high security deployments we recommend disabling the preview generation by setting the enable_previews switch to false in config.php. As an administrator you are also able to manage which preview providers are enabled by modifying the enabledPreviewProviders option switch.

Redirect all unencrypted traffic to HTTPS¶

To redirect all HTTP traffic to HTTPS administrators are encouraged to issue a permanent redirect using the 301 status code, when using Apache this can be achieved by a setting such as the following in the Apache VirtualHosts config:

<VirtualHost *:80>
   ServerName cloud.owncloud.com
   Redirect permanent / https://cloud.owncloud.com/
</VirtualHost>

Enable HTTP Strict Transport Security¶

While redirecting all traffic to HTTPS is already a good start it will often not completely prevent man-in-the-middle attacks for a regular user. Thus administrators are encouraged to set the HTTP Strict Transport Security header which will instruct browsers to not allow any connection to the ownCloud instance anymore using HTTPS and a invalid certificate warning will often not be able to get bypassed.

This can be achieved by setting the following settings within the Apache VirtualHost file:

<VirtualHost *:443>
   ServerName cloud.owncloud.com
   Header always add Strict-Transport-Security "max-age=15768000"
</VirtualHost>

It shall be noted that this requires that the mod_headers extension to be installed.

Proper SSL configuration¶

Default SSL configurations by web servers are often not state of the art and require fine-tuning for an optimal performance and security experience. The available SSL ciphers and options depends completely on your environment and thus giving a generic recommendation is not really possible.

We recommend to use the Mozilla SSL Configuration Generator to generate a suitable configuration suited for your environment, furthermore the free Qualys SSL Labs Tests give a good guidance whether the SSL server was correctly configured.