Change the config data "secret"

ℹ️ Support
, , , ,
1
Support intro

Sorry to hear you’re facing problems. :slightly_frowning_face:

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart:

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 34.0.4
  • Operating system and version (e.g., Ubuntu 24.04):
    • Debian 13
  • Web server and version (e.g, Apache 2.4.25):
    • Apache 2.4
  • PHP version (e.g, 8.3):
    • 8.4
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Bsre metal
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

We recently got hacked via Security issue - Hack · Issue #354 · CollaboraOnline/richdocumentscode · GitHub and they got a copy of our config.php. Therefore we want to change the secret in our config.php but I’m not sure how to do that. I have found some hints but… only hints, nothing official.

We do not have encryption enabled.

2

Changing the main secret will invalidate existing user login sessions, browser cookies, and app tokens.

but here’s how to proceed:

  • Log in to your server via terminal.

  • Generate a new 64-character random hexadecimal string by running:
    e.g.

    openssl rand -hex 64

(careful since this is shell-code you got via the net, you better (get to) know what you’re doing here)

  • Open your Nextcloud configuration file (located at /path/to/nextcloud/config/config.php).

  • Update or add the 'secret' line with your generated string:

     'secret' => 'YOUR_NEW_GENERATED_64_CHAR_STRING',

(again, careful to use code from the net. Only do that if you know what you’re doing)

  • Save the file and clear your browser cookies. Users will need to log back into their devices and apps.

Hope that’ll help

3

It also invalidates anything that is stored encrypted in the database…

Why do you want to do it?

Sorry… should have read fully :roll_eyes:

4

Yes, discovered right away that just changing the key breaks stuff (for example oauth2 logins).

I guess I’m stuck with the existing key…