Repository navigation
htaccess warning while files non accessible from internet #6281
Description
Activity
For info : my nextcloud.conf
DocumentRoot /var/www/html/nextcloud ServerName nextcloud.website.com <Directory /var/www/html/nextcloud/> Options +FollowSymlinks #Options MultiViews FollowSymlinks AllowOverride All <IfModule mod_dav.c> Dav off </IfModule> #Order allow,deny #Allow from all SetEnv HOME /var/www/html/nextcloud SetEnv HTTP_HOME /var/www/html/nextcloud Satisfy Any </Directory> TransferLog /var/log/apache2/nextcloud_access.log ErrorLog /var/log/apache2/nextcloud_error.log RewriteEngine on RewriteCond %{SERVER_NAME} =nextcloud.website.com RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent] </VirtualHost>```And my nextcloud-le-ssl.conf
<VirtualHost *:443> DocumentRoot /var/www/html/nextcloud ServerName nextcloud.website.com <Directory /var/www/html/nextcloud/> Options +FollowSymlinks #Options MultiViews FollowSymlinks AllowOverride All <IfModule mod_dav.c> Dav off </IfModule> #Order allow,deny #Allow from all SetEnv HOME /var/www/html/nextcloud SetEnv HTTP_HOME /var/www/html/nextcloud Satisfy Any </Directory> TransferLog /var/log/apache2/nextcloud_access.log ErrorLog /var/log/apache2/nextcloud_error.log SSLCertificateFile /etc/letsencrypt/live/nextcloud.website.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/nextcloud.website.com/privkey.pem Include /etc/letsencrypt/options-ssl-apache.conf <IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" </IfModule> </VirtualHost> </IfModule>```This seems to be a setup question. I would ask you to open this in the forums and ask for help there: https://help.nextcloud.com
Thanks
@MorrisJobke : this has been followed in the forum, and appears to be a security issue: #6449
Reacted by MichaIng
Steps to reproduce
Expected behaviour
Warning disappears
Actual behaviour
Warning still present: "Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. It is strongly recommended that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root."
Server configuration
Updated from an older Nextcloud/ownCloud or fresh install: fresh install
Where did you install Nextcloud from: Nextcloud website (zip)
Signing status:
Signing status
No errors have been found.List of activated apps:
Fresh install
Nextcloud configuration:
Config report
{
"system": {
"instanceid": "xxxx",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"192.168.0.40",
"nextcloud.website.com"
],
"datadirectory": "/var/www/html/nextcloud/data",
"overwrite.cli.url": "https://nextcloud.website.com",
"dbtype": "mysql",
"version": "12.0.2.0",
"dbname": "nextcloud",
"dbhost": "localhost",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true
}
}
data/.htaccess content
# Generated by Nextcloud on 2017-08-25 23:18:20 # line below if for Apache 2.4 Require all deniedline below if for Apache 2.2
<ifModule !mod_authz_core.c>
deny from all
Satisfy All
section for Apache 2.2 and 2.4
IndexIgnore *Are you using external storage, if yes which one: no
Are you using encryption: no