Safe to install nextcloud image?

🚧 Installation
1

Hello, while searching for guides to install on an Orange Pi board, i found this contribution on another site. Is there a way to check whether the script or image is safe to install?

1 Like
2

Hi @BubbaDroid5397 and welcome to the Nextcloud forums.

You can download it, by using the link in his reddit post and then open it in a text editor…

wget https://git.tomislav-kopic.from.hr/tomislav/OrangePi_Nextcloud_installer/raw/master/nextcloud_Install.sh

nano nextcloud_Install.sh

…or you can look at it on the git repository on his website… tomislav/OrangePi_Nextcloud_installer - MyGIT

3

Thanks @bb77. The instructions look straightforward, but I want to know whether the script installs a proper version of Nextcloud. The script includes many echo commands for strings which appear to be hard coded keys. Could they later be used to access my cloud remotely?

4

I’m not sure what the strings contain… However there’s a comment at the top of the script, which states, that these strings are just base64 encoded config files. In order to see what they actually contain you would have to decode them…

Maybe one of these web sites is of any help:

https://base64.guru/converter/decode

https://www.base64decode.org/

Or you can try decoding them using the command line:

https://linuxhint.com/bash_base64_encode_decode/

1 Like
5

Hello, your best bet for support would be to use NextcloudPI, which supports the Orange Pi. You can install it directly from Debian using the curl script.

NextCloudPi can be installed in any architecture running the latest Debian

*Note: this assumes a clean Debian (or any Armbian/Raspbian derivative system) install, and there is no rollback method*

# curl -sSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh | bash
2 Likes
6

I wrote and maintain the script you’ve linked and it’s completely safe to install.
It will always install the latest version of Nextcloud. No passwords are hard coded.
No data is ever sent anywhere. I take security very seriously.

Base64 encoded strings are just compressed config files for Nginx, PHP and Nextcloud i know it’s very ugly to see but I wanted the script to be a single file.

sources:
I’m not a hax0r

7

Yes, but i did not like how your script works and apache is a bit too unsafe for my taste :slight_smile:

but my script(the one that the OP linked) on this post, does a better job at installing and optimizing Nextcloud and all of the other accompanying services like Nginx, Postgresql, PHP and Redis to match the resources available on the machine, especially on low power machines like 256mb Orange PI Zero.