Nextcloud on Arch Linux (Encrypted System) [Part 01 - Preparation]

 In this series of posts I'm going to outline the process I used to create my own Nextcloud server. 

Network Setup

First step is to prepare my network. I'm planning to host this at home. Due to obvious security concerns I don't want to host this on my home network. I used pfSense to achieve what I want. The pfSense setup is outside the scope of this post. If you do need help or is curious about setting up pfSense let me know. Given below is an overview diagram of my network, 


The basic firewall rules in this network are

  • Server can't talk to the switch. 
  • Server can't talk to the pfSense router interface
  • Server interface has Suricata IDS/IPS running. 

Drive Preparation and Encryption


Secure erase the drive. 

Note: The drive I used was an old HDD. What I didn't notice was that the partition table was of type DOS. Had to change that to GPT and repeat this process in order for it to work.

I'm going to use a 250GB HDD for my instalation (not a SSD). First step is to secure erase the drive. (ref)
  • Use `lsblk` to identify the drive 
  • Create a temporary container across the whole drive using `cryptsetup open --type plain -d /dev/random /dev/sda wipe`
  • Wipe the container with zeroes using `dd if=/dev/zero of=/dev/mapper/wipe status=progress bs=1M`. According to the dm-crypt documentation use of if=/dev/urandom is not required as the encryption cipher is used for randomness.
  • Close the temporary container using `cryptsetup close wipe`
  • Reboot and confirm that the drive is now empty and all the previous partitions are gone.

Create efi boot and LUKS encrypted root partition

Now that the partition table of the drive is empty, I first created 2 partitions for the efi boot (512MB) and root(50GB). The efi boot partitions type was set to "ef". (step by step shown in the video). The boot partition is the only partition that won't be encrypted in this system. USB and other boot options will be disabled in bios, and password protected. This will prevent bootable media attacks. 

  • Since the efi boot partition won't be encrypted it can be directly formatted by using `mkfs.fat -F32 /dev/sda1`
  • Then I created the LUKS encrypted partition inside the previously created root partition using `cryptsetup -y -v luksFormat /dev/sda2`. 
  • The newly created encrypted root needs to be opened and formatted. The paraphrase is needed for this operation. Afterwords it can be mounted.
    • Open: `cryptsetup open /dev/sda2 cryptroot`
    • Format: `mkfs.ext4 /dev/mapper/cryptroot`
    • Mount: `mount /dev/mapper/cryptroot /mnt`
  • Now I"m going to unmount and close the encrypted root and use it during the OS install.
    • Unmount: `umount /mnt`
    • Close: `cryptsetup close cryptroot`

Next Steps

  • Installing the OS
  • Setting up Dropbear so the encrypted root can be unlocked headless
  • Setting up encrypted data partitions
  • Configuring Nextcloud
Stay tuned...

Comments

Post a Comment

Popular posts from this blog

Setting up KDiff3 to work with TortoiseGIT

Image
Setting up KDiff3 to work with TortoiseGIT When I work with git I do most of my work on the command line except for a few tasks. Resolving conflicts is one of them. So when it comes to resolving conflicts I prefer the KDiff3 instead of the TortoiseGIT diff. I was googling around to find the proper way and after grabbing things from difference places here is what I did. Obvious steps  :) Install git Install KDiff3 Install TortoiseGIT Then after that Open tortoise GIT settings Go to "Diff Viewer" Go to section "Configure the program used for comparing different revisio...." Choose "External" Enter the following "[ kdiff3 instalation path ]\kdiff3.exe %base %mine --L1 %bname --L2 %yname" Go to "Merge Tool" Choose "External" Enter the following "[ kdiff3 instalation path ]\kdiff3.exe %base %mine %theirs -o %merged" Click apply I will soon write something to show how to actually resolve...
Read more

Nextcloud and PHP8

Image
  PHP8 broke my Nextcloud instance !!! I run a Nextcloud instance on a self hosted Arch  linux server. Arch linux because I like the challenge 😁. Nextcloud due to privacy reasons. Recently Arch upgraded all php packages to php8 . Nextcloud 20.x, the version I'm using currently can't work on php8 thus my instance went offline. In this article I'm gonna describe how I managed to fix this issue. I run timeshift in my server via the cli. So I could have downgraded the php version. That would mean I would have to refrain from updating php and risk zero day vulnerabilities. That would nullify the whole purpose of running a self hosted Nextcloud instance for my sensitive data. Instead I went with dual php versions. I run php-fpm with Apache in my server so now I have to figure out how to run Fast CGI process manager with 2 php versions in the same Apache server. If you are thinking "well you are a SDE and you should know it", let me start by saying I neither use PHP...
Read more