# Help with setting up encryption **URL:** \ **Category:** ℹ️ Support\ **Tags:** external\_storage, encryption-server\ **Created:** [June 28, 2019, 12:17pm UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678 "2019-06-28T12:17:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![DByte](https://help.nextcloud.com/user_avatar/help.nextcloud.com/dbyte/32/4324_2.png) [@DByte](https://help.nextcloud.com/u/DByte)\ **Post date:** [June 28, 2019, 12:17pm UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/1 "2019-06-28T12:17:40Z")
Nextcloud version: _16.0.1_ Operating system and version: _Ubuntu 16.04_ Apache or nginx version: _2.4.18_ PHP version: _7.3.6_ The issue you are facing: I run a small NC server with just a couple of users. Some of them want the ability to mount external storage but at the same time, maintain data privacy. To help them, I want to enable automatic encryption for external storage only. In addition, I prefer to have the ability to change passwords for users who forget them using the admin interface. I’ve read the manual and have done the steps below: 1. Activate the default encryption module 2. Go to Settings \> Security and enable “Server-side encryption” I did _not_ enable the option to encrypt home storage. 3. Have user mount external storage and create a file there. 4. Success! The file is encrypted. However, I have now lost the ability to change user passwords via the admin interface: " Password change is disabled because the master key is disabled". I have also lost the ability to change the password using the occ command because this gives me the same error! I never had an opportunity to enable a master key nor does the message tell me how to enable a master key. This is not helpful. The documentation says that there is an occ command to enable a master key but that this _must only be done on an installation with no data._ Obviously, this does not apply to my situation. The ability to change user passwords via the web interface matters to me because I need it at times. So I decided to reverse enabling encryption: 1. Tell user to disconnect external storage. 2. Run the occ command to decrypt all data: (occ encryption:decrypt-all) 3. Disable “Server-side encryption” in Settings \> Security. 4. Deactivate the default encryption module. This does not restore the functionality to change the user password in the interface. So now I am stuck. I can not change passwords and I have not achieved my goal to encrypt data on external storage automatically. Is this the first time you’ve seen this error? _Y_: I have a few questions regarding this experience: 1. Did I misunderstand the manual/documentation? 2. Did I do something wrong by enabling encryption the way I did? 3. Is it really unsafe to use `occ encryption:enable-master-key` on an installation with existing data? 4. How do I regain the ability to change passwords, either on the CLI or preferably in the admin interface? ---
**Author:** ![DByte](https://help.nextcloud.com/user_avatar/help.nextcloud.com/dbyte/32/4324_2.png) [@DByte](https://help.nextcloud.com/u/DByte)\ **Post date:** [July 1, 2019, 12:29pm UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/2 "2019-07-01T12:29:05Z")
No one any ideas? I’d appreciate any insight in this matter. ---
**Author:** ![michaelof](https://help.nextcloud.com/user_avatar/help.nextcloud.com/michaelof/32/7723_2.png) [@michaelof](https://help.nextcloud.com/u/michaelof)\ **Post date:** [May 9, 2020, 1:24am UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/3 "2020-05-09T01:24:24Z")
I’ve the same issue on 18.0.4, still no answers? Tried your hints on [Nextcloud 16 - Password change is disabled because the master key is disabled](https://help.nextcloud.com/t/nextcloud-16-password-change-is-disabled-because-the-master-key-is-disabled/56022), but really garbaged my existing data. Took me a while to restore because of another (home-made :-)) issue … Is there any documentation available about the nextcloud encryption insights? ---
**Author:** ![PancakeConnaisseur](https://help.nextcloud.com/letter_avatar/pancakeconnaisseur/32/5_5575768a8748004e209b776fc1b2916d.png) [@PancakeConnaisseur](https://help.nextcloud.com/u/PancakeConnaisseur)\ **Post date:** [May 9, 2020, 2:27am UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/4 "2020-05-09T02:27:36Z")
AFAIK the [server-side encryption feature is not production ready](https://help.nextcloud.com/t/what-is-the-state-of-the-end-to-end-encryption-feature/73571) and I would not recommend using it at all. At least it seems to be too sketchy to trust anything valuable with it. ---
**Author:** ![KarlF12](https://help.nextcloud.com/user_avatar/help.nextcloud.com/karlf12/32/46873_2.png) [@KarlF12](https://help.nextcloud.com/u/KarlF12)\ **Post date:** [May 9, 2020, 7:34am UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/5 "2020-05-09T07:34:50Z")
As I understand it, the reason you can’t change their passwords is because doing so would destroy the key used to encrypt their files, thus destroying their data. At least, this is how it works with EFS. I realize this doesn’t resolve your current predicament, but if I could offer a suggestion, if you want data to be encrypted at rest on external storage, you may be better off doing full disk encryption on the external storage. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 4, 2024, 10:00am UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/6 "2024-12-04T10:00:51Z")
---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [December 11, 2024, 3:14pm UTC](https://help.nextcloud.com/t/help-with-setting-up-encryption/55678/7 "2024-12-11T15:14:31Z")