Hi,

this Tuturial describes the steps to setup owncloud on top of debian/raspian with lighttpd as webserver and https encryption with certificates sign by Let’s encrypt campain.

Operating System

Install a minimal debian jessie system.

Login as root. On raspbian login as user pi change to root.

If you want to setup the cloud by ssh and you want to login with root an password authentification set “PermitRootLogin” to “yes” in /etc/ssh/sshd_config.

Don’t forget to set it back to “without-password” after finishing.

Install required packages

For Raspbian Users. Do not start graphical desktop, just boot in text mode

Set the hostname respectily full qualified domain name

Configure a static IP Address. Disable old (init) config style by saving /etc/network/interfaces and creating an empty file

Setting up eth0. Create a file /etc/systemd/network/eth0.network, Name it as you want.

[Match]
# You can also use wildcards. Maybe you want enable dhcp
# an all eth* NICs
Name=eth0
[Network]
#DHCP=v4
# static IP
# 192.168.100.2 netmask 255.255.255.0
Address=192.168.100.2/24
Gateway=192.168.100.1
DNS=192.168.100.1

and enable systemd-networkd and resolved

Define DNS Server. You can add the DNS Server either in the Network section of the NIC adapter config (see above) or in /etc/systemd/resolved.conf
Create a symlink

Enable lighttpd on Port 80

Start the webserver and see if its running

https certificates

Lets Encrypt

Create the certificates. Get project sources

Install additional packages needed by letsencrypt create the virtual environment. Do not use the standard shell on Debian 8 based systems. Also the Python Package Index must be reachable:

If you want to use your own key and signing request:
Create your server key and csr by openssl. Do not enter a challenge password at the end of the creation process otherwise lighttpd will prompt at each start for it.

Create Key and Signing request. For a better quality of random numbers consider to generate the key on a “real” PC. Note: The CommonName and the the subjectAltName of the siging request must set to the domain name to which the certificate should belongs to. The output format of the csr must set to DER.
Create an x509 v3 exentension file /etc/lighttpd/ssl/ssl_v3.cfg

[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[ v3_req ]
basicConstraints = CA:FALSE
nsCertType = server,client
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth,clientAuth,emailProtection,codeSigning,timeStamping
subjectAltName = @alt_names
[alt_names]
DNS.1 = yourhost.yourdomain.net
# DNS.2 =
[req_distinguished_name]

Generate Key and signing request

Verify that your csr contains all your parameter:

Get the certificate from the LetsEncrypt CA. This example is based on the webroot authenticator to validate the domain (DV). Means, the letsencrypt-auto script creates a file in the webroot of your webserver which will be read during the domain validation process by the LetsEncrypt webservice.

Before you call the script make sure your webserver is reachable from the internet by your dns name at port 80 (letsencrypt http-01 challenge).
If your Webserver is behind a DSL Router ensure you have configured a port forwarding rule from port 80 to the internal ip address of your webserver. The default lighttpd Webroot for Port 80 is at /var/www/html.
If you want to use your own csr and webroot authentification you have to specify a webroot-map in letsencrypts config file to define a conjunction between domain name and webroot path otherwise an error “PluginError–webroot-path must be set” occurs.
Create a config file /etc/letsencrypt/cli.ini

authenticator = webroot
webroot-path = /var/www/html
webroot-map = {"yourhost.yourdomain.net" : "/var/www/html"}


And set restricted permissions for csr, certificate and key.

For testing

For testing https you can use selfsigned certificates

Configure Lighttpd

Append the following lines to your config file /etc/lighttpd/lighttpd.conf , ensure that the owncloud data directory is not readable from the web.

# If you want to use HTTP logging (troubleshooting) insert both lines below
# Consider to mount the log folder /var/log/lighttpd as 
# tmpfs (but logs are lost after reboot) to avoid excessive writing to the SD Card.
# Add fstab
# tmpfs           /var/log/lighttpd   tmpfs  rw,size=256M,noexec,nodev,nosuid,uid=33,gid=33   0   0
server.modules += ( "mod_accesslog" )
accesslog.filename = "/var/log/lighttpd/access.log"
# SSL Server settings
# redirect all to https
$HTTP["scheme"] == "http" {
     # redirect all http traffic to https, expect the letsencrypt webroot auth requests
     $HTTP["url"] !~ "^/\.well-known/" {
         # capture vhost name with regex conditiona -> %0 in redirect pattern
         # must be the most inner block to the redirect rule
         $HTTP["host"] =~ ".*" {
             url.redirect = (".*" => "https://%0$0")
         }
    }
}
$SERVER["socket"] == ":443" {
  ssl.engine = "enable"
  ssl.pemfile = "/etc/lighttpd/ssl/server.pem"
  # ssl.ca-file = "/etc/lighttpd/ssl/server.crt"
  # Enter your hostname
  server.name = "yourhost.yourdomain.net"
  server.document-root = "/var/www/owncloud"
  ssl.use-sslv2 = "disable"
  ssl.use-sslv3 = "disable"
  ssl.use-compression = "disable"
  ssl.honor-cipher-order = "enable"
  # A more secure cipher list. Not working with older Webbrowsers!
  ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:AES128+EECDH:AES128+EDH"
  server.errorlog = "/var/log/lighttpd/serror.log"
  accesslog.filename = "/var/log/lighttpd/saccess.log"
}
# Owncloud Data directory
$HTTP["url"] =~ "^/oc/data/" {
     url.access-deny = ("")
}
# Owncloud root
$HTTP["url"] =~ "^/oc($|/)" {
     dir-listing.activate = "disable"
}
# Letsencrypt webauth root
$HTTP["url"] =~ "^/\.well-known/" {
     dir-listing.activate = "disable"
}
# Not Owncloud or Webauth
$HTTP["url"] !~ "^/oc$|^/oc/|^/\.well-known/" {
     url.access-deny = ("")
}

Create the webserver root directory for your owncloud instance

Start the webserver and see if its running

Owncloud

Installing owncloud(In this tutorial 8.2)

Owncloud is now extracted to the subfolder owncloud in the webserver root /var/www/owncloud . I renamed this folder to oc. If you plan another name alter also the deny and dir-listing directive in lighttpd.conf to your folder.

Remove owncloud sources

Set Folder permissions

Database

The default database backend of owncloud is sqlite. If you plan to synchronize your Data with the Ownclound Desktop Client a real Database System is recommended.
Here are the steps to setup a mysql Datebase. Install the server and choose secure password.

Secure your installation

Open the MySQL Console as Database root

Create a User ocuser (Replace ocpassword with your Password ) and the database owncloud and permit the user to the database.

mysql> create database owncloud;
mysql> CREATE USER 'ocuser'@'localhost' identified by 'ocpassword';
mysql> grant all on owncloud.* to 'ocuser'@'localhost';
mysql> FLUSH PRIVILEGES;

If you want to change the password

mysql> use mysql;
mysql> SET PASSWORD FOR 'ocuser'@'localhost' = PASSWORD('ocpassword');


Securing the installation

AppArmor

I use AppArmor to secure lighttpd and mysql. The raspbian kernel does not support AppArmor out of the box. To use AppArmor you have to recompile the kernel. My post provides a script which supports you :-). Debian Jessie has the support for AppArmor already included.

Installing and activating, on a PC with grub booloader add apparmor=1 security=apparmor to the kernel parameters in /etc/default/grub

On an Raspberry edit /boot/cmdline.txt

Check if apparmor is correct installed

Note: If error “apparmor filesystem is not mounted.” occurs you have to forgot to call update-grub
By default a mysql profiles is loaded and enforced. Create a lighttpd profile /etc/apparmor.d/usr.sbin.lighttpd This profile is based on the example shipped with debian /usr/share/doc/apparmor-profiles/extras/usr.sbin.lighttpd and OpenSUSE

# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# vim:syntax=apparmor

#include 

/usr/sbin/lighttpd {
  #include 
  #include 
  #include 
  # needed to change max file descriptors
  capability sys_resource,
  # network service ;)
  capability net_bind_service,
  # changing the uid/gid on startup
  capability setgid,
  capability setuid,
  /etc/ld.so.cache r,
  /etc/lighttpd r,
  /etc/lighttpd/*.conf r,
  /etc/lighttpd/conf.d/*.conf r,
  /etc/lighttpd/auth.d/* r,
  /etc/lighttpd/vhosts.d r,
  /etc/lighttpd/vhosts.d/* r,
  /usr/sbin/lighttpd mix,

  /usr/lib/lighttpd/*.so mr,
  /usr/lib64/lighttpd/*.so mr,

  /etc/ssl/private/*.pem r,
  /etc/lighttpd/ssl/server.pem r,
  
  # home dir. e.g. used for sockets.
  /var/lib/lighttpd/ r,
  /var/lib/lighttpd/** rwl,
  
  # mod_compress cache
  /var/cache/lighttpd/ r,
  /var/cache/lighttpd/** rwl,
  
  # pid
  /{,var/}run/lighttpd.pid rwl,
  
  # log files
  /var/log/lighttpd/*.log rw,
  
  # Socket
  /run/lighttpd/* w,
  
  # exec 
  # /usr/bin/php-cgi Cx,
  /usr/bin/php5-cgi Cx,
  
  # include_shell
  /bin/bash mix,
  /bin/dash mix,
  /bin/zsh mix,
  /bin/cat mix,

  # http docs
  /var/www/ r,
  /var/www/** r,
	
  
  # Debian/Ubuntu integration in default installation
  #include 
  /etc/mime.types r,
  /usr/share/lighttpd/ r,
  /usr/share/lighttpd/*.pl rmix,
  /etc/lighttpd/conf-available/ r,
  /etc/lighttpd/conf-available/*.conf r,
  /etc/lighttpd/conf-enabled/ r,
  /etc/lighttpd/conf-enabled/*.conf r,
  
  profile /usr/bin/php5-cgi {
    #include 
    /etc/* r,
    /etc/ssl/openssl.cnf r,
    /etc/php/** r,
    /etc/php5/** r,
    /lib/lib*so* mr,
    /var/lib/php5/sessions/* rwk,
    /var/www/ r,
    /var/www/** r,
    /var/www/owncloud/oc/apps/** rwk,
    /var/www/owncloud/oc/config/** rwk,
    /var/www/owncloud/oc/data/** rwk,	
    /tmp/ r,
    /tmp/* rwk,
    /usr/share/mysql/charsets/Index.xml r,
    /usr/bin/php5-cgi r,
    /usr/lib/lib*so* mr,
    /usr/lib{,32,64}/** mr,
  }  
}

Set it in enforce mode

Add the line

/etc/ld.so.cache r,

also into /usr/sbin/mysqld {} Section of /etc/apparmor.d/usr.sbin.mysqld

If have already tested the apparmor profile for a while. If owncloud shows unexpected behaviours check the syslog for apparmor DENIES and send it to me:

Tripwire

Next step in security is to monitor filesystem changes. Here are the steps to handle this with tripwire. For further information see documention
Install tripwire

Create a site key. The site key is used for creating and signing the policy

Create a local key. The local key is used checking file integrity and update database on changes (OS Update..)

Adjust the config /etc/tripwire/twcfg.txt as needed and create the config file from the text template

Adjust the default policy /etc/tripwire/twpol.txt to your system. This is an good overview.
and append the rules for owncloud to the end of the file /etc/tripwire/twpol.txt

#
# owncloud
#
#
(
  rulename = "owncloud Directories",
  severity = $(SIG_MED)
)
{
        /var/www/                         -> $(SEC_BIN) (recurse = 1) ;
        /var/www/owncloud/oc/config       -> $(SEC_CONFIG) (recurse = 1) ;
        !/var/www/owncloud/oc/data;
}

Create the policy file from text file

Do the init filesystem scan and create the database and eleminate all errors

Checking your system is simple, the report is stored at /var/lib/tripwire/report/.

If your database has to be updated, maybe you update your Linux OS, run “tripwire –update” against the latest report file. This opens an text editor. Edit only the changes (removing the [X] => [ ]) which should not be written to the database. Save the file and you will prompted for the local passphrase.

After updating the database its an good idea to copy the database file /var/lib/tripwire/*.twd to an storage which is readonly. Before each tripwire check command check also if the database in the /var/lib/tripwire and on the readonly storage is identically.
Setup an cron job which periodically starts an tripwire check

Owncloud Configuration

All backend service are now prepared and running. Open a brower and connect to your Owncloud Installation. Navigate to

https://yourFQDNHostname/oc/

Owncloud is now ready to configure and use

Michael