Self-hosted ownCloud with MFA - practical? Basically want to avoid monthly fees and share big files with clients, having a separate box with each user account. How does one even utilize the MFA code generators? Do those have fees? reddit / selfhosted ---------------------------------------------------------------------- _AinzOolGown · 2023-11-01 17:48 Hi ;) I use Nextcloud so very similar to Owncloud. I don't remember if i added the application "Two-Factor TOTP Provider" or if it was here by default, but if you don't have it, jut add a similar application to your Owncloud instance ;) Then you have to activate TOTP in administration/security and follow the steps Next, use a TOTP application on mobile/desktop (i use Authy) to link your Owncloud TOTP account to it When it's done, Authy (or other TOTP application) will generate the MFA code you need to connect to Owncloud :) ---------------------------------------------------------------------- GetInHereStalker · 2023-11-01 18:06 Nextcloud is also an offering on Turnkey. Basically we have two company users and 200 clients. We want to create 200 separate "boxes" or bins for the clients who have access to upload and download files just from their box, but obviously the company users will have access to all of the bins/user boxes. One requirement we have is MFA with some sort of phone authenticator app or at least email. We plan on having this on as a LAN device in our office and then pointing the port forwarding to the LAN IP:front end port of the device and giving out that ip address and port to clients. Can you provide some insight? Is it safe? I'm surprised the MFA feature is free - how does Microsoft Authenticator or whatever we choose to use make money? ---------------------------------------------------------------------- _AinzOolGown · 2023-11-01 18:25 I have'nt used it for medium of large business yet MFA itself, if correctly implemented of course, is pretty safe, but maybe you want to search how much it is secure, like here : [https://blog.hypr.com/how-secure-is-mfa](https://blog.hypr.com/how- secure-is-mfa) I read multiple articles and often, the weak point on MFA is SMS or call based code. That's why i only use OTP method, it's much more complicated to "hack". Anyway, having MFA is always better than to just have id/password :) As to how they do money, well, if you think about MS or Google, they make money with their huge numbers of paid services, and if it's free from them, don't worry, they sell your data when you use their products anyway ;) ---------------------------------------------------------------------- GetInHereStalker · 2023-11-01 18:27 Thanks! Did you ever use ownCloud? Just wondering which one to pick for overall ease of use. Remember the purpose here is strictly filesharing with clients. ---------------------------------------------------------------------- _AinzOolGown · 2023-11-01 18:35 I have, like some 10 years ago maybe \^\^ I began selfhosted cloud solution with them, and i think, if i'm not mistaken, Nextcloud was the "opensource" alternative to Owncloud or maybe a more open fork, something like that. So after maybe one or two years, i switched to Nextcloud and stayed with them since. Both products evolved greatly since, i cannot help you choose between, sorry. One more thing about MFA security. Like all security systems, you have to know your ennemy. If you want to be protected from "just" the average internet threat, MFA is plenty sufficient. If you want to be protected against a government, you need more than just that ;) ---------------------------------------------------------------------- GetInHereStalker · 2023-11-01 18:46 It's mostly a placebo. We use email for most stuff, but some clients think a "portal" is magically "safe" vs ordinary email so it's mostly for image, but if we're doing it we'd rather at least theoretically do it right. And we don't want to pay for a host. ---------------------------------------------------------------------- BCIT_Richard · 2023-11-01 19:07 I mean I agree to an extent, because Linda in accounting has less of an excuse to click malicious attachments in emails if she's typically retrieving them from portal.company.com instead. ---------------------------------------------------------------------- Discommodian · 2023-11-01 21:50 I run ownCloud on my home lab. I have the users coming from LDAP on my windows AD server and TOTP is supported. There is also an option to enforce MFA ---------------------------------------------------------------------- GetInHereStalker · 2023-11-01 22:01 It's more for clients to not go "email is not secure because I use it for ordinary stuff" even though some MFA actually uses email to send the code so if hackers get access to the email, they can just reset the password anyway. Obviously does not apply to phone MFA, but again that just means hackers need to hack the phone which is most people's computer anyway and the phone has the access codes saved already. So all MFA does in practice is make us less of a vector of attack because the hacked phone is still required as a piece...unless of course they hack directly into the server and download all of the data directly - then MFA wouldn't help. Just helps with someone guessing a user's password on our server. ---------------------------------------------------------------------- lilolalu · 2023-11-02 15:16 I think Owncloud, Nextcloud, Seafile are all well suited for your usecase. If you want MFA and flexible account selfservice, put authentik in front of it. German broadcaster ARD/ZDF has a nextcloud instances for a couple of ten thousand users running, so any of them will be able to handle a couple of hundred