Tempfiles and integrity scan

ℹ️ Support
,
1

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • Docker image: nextcloud:34.0.5
  • Operating system and version (e.g., Ubuntu 24.04):
    • Docker Host: Debian-13.7
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • Docker image: jwilder/nginx-proxy
  • Is this the first time you’ve seen this error? (Yes / No):
    • No
  • When did this problem seem to first start?
    • a month ago, with NC-34 or so
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Docker
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

We have a specific temp-directory specified in config.php to allow big uploads to NC.

Files in there are reported as problematic in the integrity scan.

“Some files have not passed the integrity check”

-> Results
=======
- core
- EXTRA_FILE
- tmp/sfi_file_sequence_oc65lc0lmz8d/seq-010.lock
- tmp/sfi_file_sequence_oc65lc0lmz8d/seq-018.lock
- tmp/sfi_file_sequence_oc65lc0lmz8d/seq-000.lock

Steps to replicate it (hint: details matter!):

  1. configure: 'tempdirectory' => '/var/www/html/tmp'

  2. php.ini contains upload_tmp_dir = /var/www/html/tmp

  3. the container uses these volumes:

    app:
    image: nextcloud:${NEXTCLOUD_VERSION}
    restart: always
    volumes:
    - /mnt/docker-volumes/nextcloud/app:/var/www/html
    - /mnt/nextcloud-data:/var/www/html/data
    - ./php.ini:/usr/local/etc/php/conf.d/zzz-custom.ini
    environment:
    - MYSQL_HOST=mariadb
    - VIRTUAL_HOST=xx.yy.zz
    - REDIS_HOST=redis
    env_file:
    - db.env
    depends_on:
    - nginx-proxy
    - mariadb

Nextcloud

Results
=======
- core
	- EXTRA_FILE
		- tmp/sfi_file_sequence_oc65lc0lmz8d/seq-010.lock
		- tmp/sfi_file_sequence_oc65lc0lmz8d/seq-018.lock
		- tmp/sfi_file_sequence_oc65lc0lmz8d/seq-000.lock

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

# docker exec -u 33 nextcloud-app-1 php occ    config:list system
{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.5.1",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "DE",
        "mail_smtpmode": "smtp",
        "remember_login_cookie_lifetime": "1800",
        "log_rotate_size": "10485760",
        "trashbin_retention_obligation": "auto, 180",
        "versions_retention_obligation": "auto, 365",
        "maintenance": false,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "TOTP",
            "cloud_users"
        ],
        "twofactor_enforced_excluded_groups": [],
        "loglevel": 2,
        "theme": "",
        "app_install_overwrite": [
            "files_retention"
        ],
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "mysql.utf8mb4": true,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "htaccess.RewriteBase": "\/",
        "overwrite.cli.url": "https:\/\/***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 1,
        "files.chunked_upload.max_size": 20971520,
        "config_preset": 7,
        "tempdirectory": "\/var\/www\/html\/tmp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        }
    }
}

Questions

I wonder if the tempdirectory of NC and the upload dir of PHP should be 2 different dirs or even volumes.

I’d expect temp-files not to be scanned for integrity … and these errors only pop up since a few weeks or so.

pls advise.

2

I don’t think tempdirectory is supposed to be located within the DocumentRoot. That puts you at risk of having this data publicly accessible from the Internet without authentication. Same for upload_tmp_dir. IMHO, that’s entirely a configuration problem.

3

I know it’s a config problem :wink: that’s why I ask.

So a solution in this case might be adding another persistent docker volume specifically for tempdirectory and mounting it aside, for example into /tempdirectory (and adjusting the config accordingly)? Right?

thanks!

EDIT: I am still not sure how to proceed with having both the parameter in php.ini AND config.php. The docs tell to adjust tempdirectory when not having access to php.ini. I have both, but the customer wants to allow huge uploads, so it seems I went the double-config approach back then.

4

Both are not required and the Nextcloud tempdirectory parameter takes priority over the php.ini entry even if present (as long as the specified directory exists).

P.S. Using tmpfs might be another option since with an explicit size it’ll use swap as a fallback. Must be carefully planned/sized.

5

Thanks for the explanation.

I had to provide an extra temp dir because the small VM they have set up didn’t provide enough space for big uploads in the original path.

Right now I added a separate docker volume, mounted it to /tempdirectory (with permissions for the webserver user) and adjusted the config accordingly. Seems to be quiet, waiting for their admin to test things.