How to protect your Nextcloud Workspace with 2FA
Two-factor authentication (2FA) adds a second layer of protection to the Nextcloud login process. In addition to a password, users need another factor, such as a one-time code, approval on another device or a hardware security key. This makes it much harder for attackers to access your Nextcloud instance, even if they know a user’s password.
Why should you use two-factor authentication?
Nextcloud is often used to store confidential data including documents, project files, customer records and internal folders. A strong password helps, but it should not be the only thing protecting that data. A safer setup uses several layers: two-factor authentication, clear security policies, file access restrictions and protection against automated login attacks. 2FA is an important additional layer of security, which asks users for a second proof of identity (called a factor) when they sign in.
How to add 2FA to Nextcloud
Nextcloud uses an extensible provider model, which means admins can enable different 2FA providers depending on how users work and how much protection they need. An administrator must enable at least one 2FA provider first. After that, users can turn on two-factor authentication in their personal settings. Admins can also make 2FA mandatory for everyone or only for selected groups.
Current Nextcloud versions include several 2FA providers, including TOTP, two-factor authentication via Nextcloud notification and backup codes. TOTP and notification-based 2FA usually need to be enabled first in the apps section. Backup codes are available as a recovery option and should always be stored securely.
Not every 2FA method protects accounts in the same way:
- WebAuthn/FIDO2 with a hardware security key offers the strongest protection for admin accounts and users who handle confidential data. This method is also highly resistant to phishing.
- TOTP is a strong default for most teams and works with a range of authenticator apps.
- SMS and messenger codes are easy to use, but less secure compared to other methods.
Two-Factor TOTP Provider
In Nextcloud, the Two-Factor TOTP Provider adds time-based one-time password (TOTP) to the login process. To set it up, users scan a QR code in Nextcloud with an authenticator app, such as Google Authenticator, FreeOTP, or another compatible password manager app. When they sign in, Nextcloud asks for their password and a six-digit code from the app. The code changes every 30 seconds.
The TOTP provider works with RFC 6238-compatible apps and has been included in Nextcloud since version 25. It is disabled by default, so admins need to enable it in the apps section first. For most teams, TOTP offers a strong mix of security, simple setup and broad device support. Users should store their backup codes securely. Without them, a lost smartphone can lock them out of their account.
| Advantages | Disadvantages |
|---|---|
| ✓ Familiar to many users and easy to set up | ✗ Less phishing-resistant than WebAuthn/FIDO2 |
| ✓ Works with a range of authenticator apps | ✗ A lost smartphone can cause login problems without backup codes |
| ✓ Does not require additional hardware | ✗ Codes can be stolen in sophisticated phishing attacks |
| ✓ Much stronger than password-only login | ✗ Users need correct time settings and an authenticator app |
| ✓ Easy to roll out for small teams |
Two-factor authentication via Nextcloud notification
Two-factor authentication via Nextcloud notification uses an already logged-in device or active browser session as the second factor. When a user signs in from another device or browser, Nextcloud sends a push notification to the already logged-in device. The user can then approve or deny the login attempt. This method is convenient because users do not have to type in a code. However, it only works if a device is already signed in and the push notification comes through. For admin accounts and users with access to confidential data, notification-based 2FA should be combined with more secure options like TOTP, WebAuthn/FIDO2 and backup codes.
| Advantages | Disadvantages |
|---|---|
| ✓ Login attempts are quick and easy to approve | ✗ Only works if another device is already signed in |
| ✓ No need to type in temporary login codes | ✗ Push notifications must come through reliably |
| ✓ Uses existing Nextcloud devices or browser sessions | ✗ Less practical for users who only use one device |
| ✓ Does not require additional hardware | ✗ A lost device may require backup codes or admin support |
| ✓ Works well alongside TOTP or WebAuthn | ✗ Not as phishing-resistant as WebAuthn/FIDO2 |
Two-factor WebAuthn or FIDO2
With WebAuthn, users confirm their login with a FIDO2 security key or a platform authenticator built into their device. Security keys can connect through USB, NFC or Bluetooth. Platform authenticators include features such as Face ID, Touch ID or Windows Hello, where the device uses biometrics to verify the user’s identity.
WebAuthn provides strong protection against phishing. This is because a security key only works with the real Nextcloud domain it was set up for. If a user lands on a fake login page, the key will not approve the login there. That makes WebAuthn much more resistant to phishing than TOTP codes. Two-Factor WebAuthn is listed as a security app in the Nextcloud App Store and is available for current Nextcloud versions. It is a strong choice for admins, regulated businesses and users who work with confidential data.
| Advantages | Disadvantages |
|---|---|
| ✓ Strong protection against phishing | ✗ Requires compatible browsers and devices |
| ✓ Fast and convenient after setup | ✗ Hardware keys can add extra costs |
| ✓ Well suited for admins and users who handle confidential data | ✗ Lost security keys require a clear recovery process |
| ✓ No login codes to type in | ✗ Some users may need help during rollout |
| ✓ Security key works only with the real Nextcloud domain |
Two-Factor Gateway: SMS, Signal, Telegram, WhatsApp, and XMPP
The Two-Factor Gateway app sends login codes through Signal, SMS, Telegram, WhatsApp or XMPP. This feels familiar because many users already know SMS and messenger codes from elsewhere online.
This method is weaker than WebAuthn and, in most cases, not as secure as generating TOTP codes either. That’s because the code has to travel through third-party systems, such as a gateway provider, mobile network or messenger account. For accounts that need strong protection, SMS and messenger codes should not be the first choice. Two-Factor Gateway can still be useful when users cannot use an authenticator app or when you need a temporary solution.
| Advantages | Disadvantages |
|---|---|
| ✓ Familiar to most users | ✗ Less secure than WebAuthn/FIDO2 |
| ✓ No authenticator app setup required | ✗ Dependent on external services or mobile networks |
| ✓ Supports multiple messaging services | ✗ SMS can be vulnerable to SIM swapping |
| ✓ Useful as a temporary solution | ✗ Messenger accounts can also be compromised |
| ✓ Good when ease of use matters most | ✗ Not ideal for admins or users who handle confidential data |
How can admins make two-factor authentication mandatory?
By default, two-factor authentication is optional in Nextcloud. This means users can choose to enable it if they want. For businesses, it often makes sense to require 2FA to be used, especially among administrators, HR teams, project managers and those with access to confidential data.
In current Nextcloud versions, admins can use the security settings to make two-factor authentication a requirement. The requirement can be applied to all users or just to specific groups. Certain groups can also be exempt, if needed. At least one 2FA provider, be it TOTP or WebAuthn, must be enabled first. Before you make 2FA mandatory, tell users what is changing. Explain which method they should use, how setup works and where they can find their backup codes.
The Two-Factor Admin Support app is helpful when users can no longer sign in. For example, a user may lose a smartphone, break an authenticator app or misplace a security key. With the app, administrators can generate one-time login codes and help users regain access safely. Users should also store their own backup codes securely. Nextcloud provides ten backup codes, and each one can only be used once. Users can generate their own backup codes in the ‘Security’ section in their settings. This helps prevent legitimate users from being permanently locked out if a 2FA device gets lost.
How can File Access Control protect your files?
Two-factor authentication protects the login. It makes sure the person signing in is really the account owner. But once someone is logged in, you still need to decide what they should be able to access. This is where the Nextcloud File Access Control app comes in.
File Access Control lets admins create rules for who can access files and folders. These rules work using Nextcloud Flow. A flow works like an ‘if-then’ rule: if certain conditions match, Nextcloud blocks access to the file or folder. These rules can be based on the IP address, user group, file type, file name, request time or tags added to files and folders. This gives admins more control than standard sharing settings alone.
File Access Control works well for folders containing confidential data, such as:
- Personnel files
- Financial records
- Contracts
- Research data
You can give one of these folders an internal tag such as ‘Confidential.’ A rule can then limit access to certain groups or to the company network. Make sure to use restricted or invisible tags for this. Otherwise, users might be able to remove or change the tag and bypass the rule.
When a File Access Control rule applies, Nextcloud blocks access. The user cannot open, download, edit, delete, upload or sync the file through the desktop client.
Pay special attention to public sharing links and external storage. Both are useful, but they can weaken your security rules if they are configured too openly. For folders containing confidential data, decide whether public links should be allowed at all. For especially sensitive data, make sure your sharing settings, tags and File Access Control rules all work together.
Common rules for File Access Control
| Rule type | Example rule | What Nextcloud does | When to use it | |
|---|---|---|---|---|
| IP range | Allow access only from the internal network, such as 192.168.10.0/24 | Blocks access from outside the network | To keep HR or finance folders available only on the company networ | |
| User group | Only allow access for members of the HR group | Blocks all other groups | To share personnel files only with HR | |
| Tag | Apply a tag such as ‘Confidential’ to a file or folder | Applies the rule to files with that tag | To label and protect confidential documents | |
| File type / MIME type | Block ZIP file uploads | Stops users from uploading certain file formats | To prevent unwanted or risky file types | |
| Time frame | Block access outside working hours | Allows access only during defined times | To limit team access to certain hours | |
| File name | Block files with certain names or patterns | Blocks files based on their name | To prevent temporary, misnamed or unwanted files |
AI features in Nextcloud, such as Context Chat, may be able to read or index files that users cannot open directly. File Access Control mainly protects direct access to files and folders. It does not automatically apply to every AI-powered feature. If your Nextcloud stores confidential data, only use AI apps where you really need them and check which files they can read, index or include in chat responses before you use them.
How can you protect Nextcloud against brute-force and bot attacks?
In addition to 2FA, you should protect the Nextcloud login page against automated password attacks. Nextcloud includes built-in brute-force protection and it’s enabled by default. This feature does more than protect against simple password list attacks. It also helps stop bots from abusing password reset pages or app password tokens. When Nextcloud detects suspicious login activity, it slows requests from that IP address for up to 24 hours. The delay can be up to 25 seconds. If an IP address reaches the current threshold of 10 attempts within 30 minutes, Nextcloud temporarily returns ‘429 Too Many Requests’ until the number of attempts drops below the threshold again.
Avoid disabling brute-force protection on live servers. You can also add fail2ban at the server level for stronger protection. Nextcloud handles suspicious login attempts itself, while fail2ban can actually block suspicious IP addresses at the operating system level using firewall rules.
Take extra care if your setup uses a reverse proxy or load balancer. If trusted_proxies or forwarded headers are set incorrectly, Nextcloud may mistakenly treat the proxy itself as the source of all requests. This can slow down or block legitimate users. So make sure Nextcloud sees the real client IP before you apply brute-force rules or fail2ban settings. This helps you avoid locking yourself out or blocking entire user groups.
What are 5 ways to make Nextcloud more secure?
- Require 2FA: Enable at least one 2FA provider such as TOTP or WebAuthn. Notification-based 2FA can work well alongside them. Require 2FA for admins and users who handle confidential data.
- Use WebAuthn for key accounts: Use FIDO2 security keys for administrators, executives, HR, finance, and other users with access to confidential data.
- Require backup codes: Make sure users generate and store their one-time backup codes before 2FA becomes mandatory.
- Use File Access Control for confidential folders: Protect folders containing confidential data with Flow rules, restricted tags, group rules and IP rules.
- Add fail2ban to brute-force protection: Keep Nextcloud’s built-in brute-force protection enabled and add fail2ban on servers that are accessible from the internet.