4

Is it a good idea to restrict access to my Nextcloud server by using OpenVPN, so every user (this is for small group of people), will get their own VPN account and after that they will be able to access to their account as well.

For the restriction part, I'm not sure how to manage that, probably on firewall side and on server side, using UFW or apache config.

<Location "/">
              Order deny,allow
              deny from all
              allow from 192.168.1.1
</Location>

What is your suggestion for this idea?

Improve this question
2
  • 2
    Just make the server listen only at the IP address of the VPN interface so that the server is only facing to the VPN but not to the public internet. Then the server is not even visible from the internet. See Listen directive in Apache documentation.
    – Steffen Ullrich
    Jan 2, 2017 at 18:06
  • This can be a good solution.
    – user134969
    Jan 2, 2017 at 18:22

1 Answer 1

Reset to default
-1

Given that Nextcloud is designed to be an internet facing - e.g. "cloud" - solution, adding a VPN seems rather overkill unless you are planning to use it for very sensitive or high-value data.

Note that in using a VPN, you are committing yourself to getting the network design right and to ensuring that all the users have secure computers since you are allowing those devices into your secure network.

In my view, you would be better served spending a little time making sure that access to the Nextcloud server is properly configured. Also make sure that the server is constantly patched and that you are receiving security alerts from it so you know if someone/something is attacking.

Improve this answer
7
  • 1
    If VPN is used instead of the usual hardening I would agree. But if it is used to restrict access additionally it is a valid part of security in depth.
    – Steffen Ullrich
    Jan 2, 2017 at 18:03
  • Only if the VPN is correct and securely configured AND the client computers are also secure. This is potentially a much bigger attack surface than hardening a web service. This is important to note as too many people think that a VPN is some magic security solution and it absolutely isn't. You are allowing remote computers into an internal network, that might be much more secure but there are many ways to get it wrong including having a single compromised client machine.
    – Julian Knight
    Jan 2, 2017 at 20:20
  • I didn't get the feeling from the OP that they understood the complexities of security both the network and the client computers correctly - apologies to the OP if I got that wrong, the simplest solution is to secure the web interface and enforce strong passcodes - maybe add multi-factor auth if that is available.
    – Julian Knight
    Jan 2, 2017 at 20:22
  • If the OP does not get the security of the client system right it might be even worse to connect to the public internet using an insecure client than to connect only to the private cloud instance via VPN. Hardening the public available server does not make the clients more secure but requiring the clients to connect via the public internet just increases the attack surface of the clients.
    – Steffen Ullrich
    Jan 2, 2017 at 21:39
  • Well it depends doesn't it. Depending on the architecture, a single server might be compromised or a whole network with multiple servers and other client machines (which may be exposed because they too are on the same VPN). We don't have enough information to make a definitive statement about what is best in this case. When in doubt, apply Occam's Razor. Simplicity often wins. Either could be the right answer.
    – Julian Knight
    Jan 2, 2017 at 21:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .