How to protect your Nextcloud Workspace with 2FA

Two-factor au­then­ti­ca­tion (2FA) adds a second layer of pro­tec­tion to the Nextcloud login process. In addition to a password, users need another factor, such as a one-time code, approval on another device or a hardware security key. This makes it much harder for attackers to access your Nextcloud instance, even if they know a user’s password.

Why should you use two-factor au­then­ti­ca­tion?

Nextcloud is often used to store con­fi­den­tial data including documents, project files, customer records and internal folders. A strong password helps, but it should not be the only thing pro­tect­ing that data. A safer setup uses several layers: two-factor au­then­ti­ca­tion, clear security policies, file access re­stric­tions and pro­tec­tion against automated login attacks. 2FA is an important ad­di­tion­al layer of security, which asks users for a second proof of identity (called a factor) when they sign in.

How to add 2FA to Nextcloud

Nextcloud uses an ex­ten­si­ble provider model, which means admins can enable different 2FA providers depending on how users work and how much pro­tec­tion they need. An ad­min­is­tra­tor must enable at least one 2FA provider first. After that, users can turn on two-factor au­then­ti­ca­tion in their personal settings. Admins can also make 2FA mandatory for everyone or only for selected groups.

Current Nextcloud versions include several 2FA providers, including TOTP, two-factor au­then­ti­ca­tion via Nextcloud no­ti­fi­ca­tion and backup codes. TOTP and no­ti­fi­ca­tion-based 2FA usually need to be enabled first in the apps section. Backup codes are available as a recovery option and should always be stored securely.

Not every 2FA method protects accounts in the same way:

• WebAuthn/FIDO2 with a hardware security key offers the strongest pro­tec­tion for admin accounts and users who handle con­fi­den­tial data. This method is also highly resistant to phishing.
• TOTP is a strong default for most teams and works with a range of au­then­ti­ca­tor apps.
• SMS and messenger codes are easy to use, but less secure compared to other methods.

Two-Factor TOTP Provider

In Nextcloud, the Two-Factor TOTP Provider adds time-based one-time password (TOTP) to the login process. To set it up, users scan a QR code in Nextcloud with an au­then­ti­ca­tor app, such as Google Au­then­ti­ca­tor, FreeOTP, or another com­pat­i­ble password manager app. When they sign in, Nextcloud asks for their password and a six-digit code from the app. The code changes every 30 seconds.

The TOTP provider works with RFC 6238-com­pat­i­ble apps and has been included in Nextcloud since version 25. It is disabled by default, so admins need to enable it in the apps section first. For most teams, TOTP offers a strong mix of security, simple setup and broad device support. Users should store their backup codes securely. Without them, a lost smart­phone can lock them out of their account.

Two-factor au­then­ti­ca­tion via Nextcloud no­ti­fi­ca­tion

Two-factor au­then­ti­ca­tion via Nextcloud no­ti­fi­ca­tion uses an already logged-in device or active browser session as the second factor. When a user signs in from another device or browser, Nextcloud sends a push no­ti­fi­ca­tion to the already logged-in device. The user can then approve or deny the login attempt. This method is con­ve­nient because users do not have to type in a code. However, it only works if a device is already signed in and the push no­ti­fi­ca­tion comes through. For admin accounts and users with access to con­fi­den­tial data, no­ti­fi­ca­tion-based 2FA should be combined with more secure options like TOTP, WebAuthn/FIDO2 and backup codes.

Two-factor WebAuthn or FIDO2

With WebAuthn, users confirm their login with a FIDO2 security key or a platform au­then­ti­ca­tor built into their device. Security keys can connect through USB, NFC or Bluetooth. Platform au­then­ti­ca­tors include features such as Face ID, Touch ID or Windows Hello, where the device uses bio­met­rics to verify the user’s identity.

WebAuthn provides strong pro­tec­tion against phishing. This is because a security key only works with the real Nextcloud domain it was set up for. If a user lands on a fake login page, the key will not approve the login there. That makes WebAuthn much more resistant to phishing than TOTP codes. Two-Factor WebAuthn is listed as a security app in the Nextcloud App Store and is available for current Nextcloud versions. It is a strong choice for admins, regulated busi­ness­es and users who work with con­fi­den­tial data.

Two-Factor Gateway: SMS, Signal, Telegram, WhatsApp, and XMPP

The Two-Factor Gateway app sends login codes through Signal, SMS, Telegram, WhatsApp or XMPP. This feels familiar because many users already know SMS and messenger codes from elsewhere online.

This method is weaker than WebAuthn and, in most cases, not as secure as gen­er­at­ing TOTP codes either. That’s because the code has to travel through third-party systems, such as a gateway provider, cellular network or messenger account. For accounts that need strong pro­tec­tion, SMS and messenger codes should not be the first choice. Two-Factor Gateway can still be useful when users cannot use an au­then­ti­ca­tor app or when you need a temporary solution.

How can admins make two-factor au­then­ti­ca­tion mandatory?

By default, two-factor au­then­ti­ca­tion is optional in Nextcloud. This means users can choose to enable it if they want. For busi­ness­es, it often makes sense to require 2FA to be used, es­pe­cial­ly among ad­min­is­tra­tors, HR teams, project managers and those with access to con­fi­den­tial data.

In current Nextcloud versions, admins can use the security settings to make two-factor au­then­ti­ca­tion a re­quire­ment. The re­quire­ment can be applied to all users or just to specific groups. Certain groups can also be exempt, if needed. At least one 2FA provider, be it TOTP or WebAuthn, must be enabled first. Before you make 2FA mandatory, tell users what is changing. Explain which method they should use, how setup works and where they can find their backup codes.

The Two-Factor Admin Support app is helpful when users can no longer sign in. For example, a user may lose a smart­phone, break an au­then­ti­ca­tor app or misplace a security key. With the app, ad­min­is­tra­tors can generate one-time login codes and help users regain access safely. Users should also store their own backup codes securely. Nextcloud provides ten backup codes, and each one can only be used once. Users can generate their own backup codes in the “Security” section in their settings. This helps prevent le­git­i­mate users from being per­ma­nent­ly locked out if a 2FA device gets lost.

How can File Access Control protect your files?

Two-factor au­then­ti­ca­tion protects the login. It makes sure the person signing in is really the account owner. But once someone is logged in, you still need to decide what they should be able to access. This is where the Nextcloud File Access Control app comes in.

File Access Control lets admins create rules for who can access files and folders. These rules work using Nextcloud Flow. A flow works like an “if-then” rule: If certain con­di­tions match, Nextcloud blocks access to the file or folder. These rules can be based on the IP address, user group, file type, file name, request time or tags added to files and folders. This gives admins more control than standard sharing settings alone.

File Access Control works well for folders con­tain­ing con­fi­den­tial data, such as:

• Personnel files
• Financial records
• Contracts
• Research data

You can give one of these folders an internal tag such as “Con­fi­den­tial.” A rule can then limit access to certain groups or to the company network. Make sure to use re­strict­ed or invisible tags for this. Otherwise, users might be able to remove or change the tag and bypass the rule.

When a File Access Control rule applies, Nextcloud blocks access. The user cannot open, download, edit, delete, upload or sync the file through the desktop client.

Common rules for File Access Control

How can you protect Nextcloud against brute-force and bot attacks?

In addition to 2FA, you should protect the Nextcloud login page against automated password attacks. Nextcloud includes built-in brute-force pro­tec­tion and it’s enabled by default. This feature does more than protect against simple password list attacks. It also helps stop bots from abusing password reset pages or app password tokens. When Nextcloud detects sus­pi­cious login activity, it slows requests from that IP address for up to 24 hours. The delay can be up to 25 seconds. If an IP address reaches the current threshold of 10 attempts within 30 minutes, Nextcloud tem­porar­i­ly returns “429 Too Many Requests” until the number of attempts drops below the threshold again.

Avoid disabling brute-force pro­tec­tion on live servers. You can also add fail2ban at the server level for stronger pro­tec­tion. Nextcloud handles sus­pi­cious login attempts itself, while fail2ban can actually block sus­pi­cious IP addresses at the operating system level using firewall rules.

Take extra care if your setup uses a reverse proxy or load balancer. If trusted_proxies or forwarded headers are set in­cor­rect­ly, Nextcloud may mis­tak­en­ly treat the proxy itself as the source of all requests. This can slow down or block le­git­i­mate users. So make sure Nextcloud sees the real client IP before you apply brute-force rules or fail2ban settings. This helps you avoid locking yourself out or blocking entire user groups.

What are 5 ways to make Nextcloud more secure?

• Require 2FA: Enable at least one 2FA provider such as TOTP or WebAuthn. No­ti­fi­ca­tion-based 2FA can work well alongside them. Require 2FA for admins and users who handle con­fi­den­tial data.
• Use WebAuthn for key accounts: Use FIDO2 security keys for ad­min­is­tra­tors, ex­ec­u­tives, HR, finance, and other users with access to con­fi­den­tial data.
• Require backup codes: Make sure users generate and store their one-time backup codes before 2FA becomes mandatory.
• Use File Access Control for con­fi­den­tial folders: Protect folders con­tain­ing con­fi­den­tial data with Flow rules, re­strict­ed tags, group rules and IP rules.
• Add fail2ban to brute-force pro­tec­tion: Keep Nextcloud’s built-in brute-force pro­tec­tion enabled and add fail2ban on servers that are ac­ces­si­ble from the internet.