Unavoidable security & setup warnings with NC 21 update

Bartman2 · February 23, 2021, 5:20pm

But these are working in httpd.conf:

Redirect 301 /.well-known/carddav “/nextcloud/remote.php/dav”
Redirect 301 /.well-known/caldav “/nextcloud/remote.php/dav”

Why the other not?

I tried the add the AllowOverride All in httpd.conf and add the lines to .htaccess, but no effect.
I’m confused.

shrisha · February 23, 2021, 5:32pm

Edit to your actual path.

DocumentRoot "/var/www/html/nextcloud"
<Directory /var/www/html/nextcloud>
  Require all granted
  AllowOverride All

Then .htaccess file inside of nextloud folder will be considered by apache

Bartman2 · February 23, 2021, 7:00pm

hmm, does not work. the dav redirect is working from httpd.conf. .htaccess is read from nextcloud folder. .htcaccess is read from root too.
So why is this well-known/webfinger and nodeinfo not picked up from public.php?

kchan101 · February 24, 2021, 8:52am

Double-check the posts above - the nginx config changes for webfinger and nodeinfo use index.php and not public.php

Bartman2 · February 24, 2021, 10:39am

@kchan101, I tried index.php too, without luck. And Nextcloud docs say public.php.
Dav is working well, but webfinger and nodeinfo, not.
https://www.mysite.com/.well-known/webfinger brings me to the dashboard of Nextcloud when I set the redirect to index.php. If I set it back to public.php, .well-known/webfinger redirects to:
https://www.mysite.com/nextcloud/.well-known/webfinger.
But still a security warning in Nextcloud settings.

Does anyone with this kind of setup has got it working?

Ubuntu server, Apache, php7.4-fpm, Nextcloud 21 in subdir as conf-available /nextcloud.

kchan101 · February 24, 2021, 11:08am

The docs only seem to document entries for caldav/carddav. Besides using index.php rather than public.php, the format of the rewrite is also different. I have the following entries which got rid of the warnings:

RewriteRule ^.well-known/carddav /nextcloud/remote.php/dav/ [R=301,L]
RewriteRule ^.well-known/caldav /nextcloud/remote.php/dav/ [R=301,L]
RewriteRule ^.well-known/webfinger /nextcloud/index.php/.well-known/webfinger [R=301,L]
RewriteRule ^.well-known/nodeinfo /nextcloud/index.php/.well-known/nodeinfo [R=301,L]

Don’t forget to also restart httpd.

Can you post the entries you have?

Bartman2 · February 24, 2021, 11:24am

I’ve found it here: General troubleshooting — Nextcloud latest Administration Manual latest documentation
and on other Nextcloud decs pages. I will try your suggestion. It differs from the docs in the way that it redirects to .well-known too.

kchan101 · February 24, 2021, 11:27am

That link is for NC19 documentation. As you’ve already alluded to in a post above, the API changed in NC21.

Bartman2 · February 24, 2021, 11:32am

Yes, it is working now! Thank you so much kchan101! This is the redirect part in my httpd.conf:

Redirect 301 /.well-known/carddav “/nextcloud/remote.php/dav”
Redirect 301 /.well-known/caldav “/nextcloud/remote.php/dav”
Redirect 301 /.well-known/webfinger “/nextcloud/index.php/.well-known/webfinger”
Redirect 301 /.well-known/nodeinfo “/nextcloud/index.php/.well-known/nodeinfo”

Thanks a lot.

shrisha · February 24, 2021, 4:25pm

What do you think would be entries for nginx then? I tried:

rewrite ^/.well-known/webfinger /index.php?service=webfinger last;
rewrite ^/.well-known/nodeinfo /index.php?service=nodeinfo last;

and

location ^~ /.well-known/webfinger {
        return 301 $scheme://$host/index.php/webfinger;
    }
    
location ^~ /.well-known/nodeinfo {
        return 301 $scheme://$host/index.php/nodeinfo;
    }

with no success

kchan101 · February 24, 2021, 4:37pm

Miyamoto has already given above the nginx config in post marked as “Solution”

Otherwise, your second config is missing a path element

location ^~ /.well-known/webfinger {
return 301 $scheme://$host/index.php/.well-known/webfinger;
}

location ^~ /.well-known/nodeinfo {
return 301 $scheme://$host/index.php/.well-known/nodeinfo;
}

shrisha · February 24, 2021, 4:45pm

Yes I tried his solution with no effect. and just tried yours, some warnings.

kchan101 · February 24, 2021, 5:05pm

Is your install under a nextcloud subdirectory?

Maybe you need

location ^~ /.well-known/webfinger {
return 301 $scheme://$host/nextcloud/index.php/.well-known/webfinger;
}

location ^~ /.well-known/nodeinfo {
return 301 $scheme://$host/nextcloud/index.php/.well-known/nodeinfo;
}

shrisha · February 24, 2021, 5:12pm

Tried this too. no effect. Funny thing is there is no problem with caldav and carddav with exact same formating.

klou · February 24, 2021, 6:03pm

I’m having the same problems, though with Docker, which for some reason has a different/older nginx.conf.

However, the approved solution (Miyamoto) works as far as nginx redirects are concerned, but https://my.nextcloud.com/index.php/.well-known/nodeinfo ALSO returns 403. I’ve looked elsewhere, and the checks seem to be looking for a HTTP 200. So, something else might be incorrect, but maybe not nginx.

ohlin5 · February 24, 2021, 7:03pm

I too am having this same issue. NC 21 on Ubuntu 20.04, proxied through a separate VM running Apache as a reverse proxy. Cannot figure out how to get rid of the webfinger error.

klou · February 24, 2021, 10:55pm

To those of us who are still having problems with “.well-known”:

Do you have Social and/or Federation installed and enabled?
Do you get 403 or 404 when hitting https://my.nextcloud.com/.well-known/i-am-the-wurst ?

ohlin5 · February 24, 2021, 10:57pm

Can’t even install social, get an error message about extraction failing. Federation yes, but I tried disabling it and I still get the error message in admin
No, I get a white page that just says: {“message”:“i-am-the-wurst not supported”}

Appears there’s an official issue for this bug too: Security and config warnings · Issue #25753 · nextcloud/server · GitHub

klou · February 24, 2021, 11:06pm

I don’t have either enabled, and I think Social is broken right now. However, I am wondering if webfinger/nodeinfo is only enabled and active IF either Social or Federation is also enabled. Social definitely uses them, but not sure about Federation.
That’s more than me – I get 403, but the URL changes to https://my.nextcloud.com/index.php/.well-known/i-am-the-wurst . According to above, that’s what it’s supposed to do, right?

The test is from Add well known handlers API by ChristophWurst · Pull Request #24702 · nextcloud/server · GitHub, where it should return 404 (I haven’t tried from curl yet).

And a successful check either returns 404 or 200: server/admin.js at f37e150d1caa0918e3258011f3c9b04ce469bb7c · nextcloud/server · GitHub

tessus · February 28, 2021, 7:09pm

I’m sorry, who came up with that design?

Why do I want Nextcloud to verify any phone numbers? Just let people turn of verification and the problem is solved. Now I set a region so that nc is happy, but the verification will still fail for users, who do not live in that region, which is very much possible, if you have a worldwide user base. So what’s the point?

P.S.: I have 3 SIM cards for 3 different countries. There’s a very good reason why I don’t add a country code to some of my phone numbers. (I know, not a profile thing, but still - an explanation why it can make sense not to use a country code.)