Next Cloud Encrypted with XQ - AWS EC2/S3 Setup & Configuration

Written By Brian Wane

Implementing Zero Trust data security in Nextcloud can provide several significant benefits, enhancing the overall security and efficiency of your data management system. Here are the primary advantages:

1. Enhanced Security

  • Minimized Attack Surface: Zero Trust security assumes that threats could come from both outside and inside the network. By implementing it, Nextcloud can reduce the attack surface, limiting the risk of breaches.

  • Continuous Verification: Zero Trust requires continuous verification of users, devices, and other entities, ensuring that only authorized users have access to specific data at any given time.

  • Micro-Segmentation: This approach divides the network into smaller, isolated segments, preventing lateral movement in case of a breach. In Nextcloud, this can limit the spread of potential attacks.

2. Improved Data Protection

  • Granular Access Controls: Zero Trust enforces strict access controls based on user roles, ensuring that users can only access data necessary for their tasks. This minimizes unauthorized data exposure.

  • End-to-End Encryption: It enhances encryption protocols for data at rest and in transit, ensuring that sensitive information remains secure even if intercepted.

3. Compliance and Governance

  • Regulatory Compliance: Zero Trust helps organizations comply with data protection regulations like GDPR, HIPAA, and others by implementing stringent access controls and data protection measures.

  • Audit and Monitoring: Continuous monitoring and logging of all access and activity ensure thorough audit trails, simplifying compliance audits and investigations.

4. Operational Efficiency

  • Reduced Risk of Insider Threats: By continuously verifying users and devices, Zero Trust reduces the risk posed by insider threats, ensuring that only authenticated and authorized individuals can access sensitive data.

  • Automated Threat Detection: Implementing Zero Trust can incorporate automated systems for detecting and responding to suspicious activities, thereby improving response times and reducing the workload on IT security teams.

5. Scalability and Flexibility

  • Adaptability to Modern Work Environments: Zero Trust is well-suited for cloud environments and remote work scenarios, where traditional perimeter-based security models are less effective. This makes Nextcloud more adaptable to modern, flexible working conditions.

  • Scalable Security Model: As organizations grow, Zero Trust scales effectively, maintaining security without compromising performance.

6. User Experience

  • Seamless User Authentication: While enhancing security, Zero Trust can also offer seamless authentication processes, such as Single Sign-On (SSO), improving the user experience without sacrificing security.

Practical Implementation in Nextcloud

  • Identity and Access Management (IAM): Integrating IAM solutions that support Zero Trust principles can ensure robust user authentication and authorization within Nextcloud.

  • Network and Device Security: Ensuring that all devices accessing Nextcloud are authenticated and secure, possibly using tools like endpoint detection and response (EDR) systems.

  • Policy Enforcement: Implementing strict access policies that define who can access what data under what conditions, continuously enforced by Nextcloud’s security mechanisms.

By integrating Zero Trust data security principles, Nextcloud can significantly enhance its security posture, ensuring robust protection of sensitive data, compliance with regulations, and improved operational efficiency, all while maintaining a positive user experience.

AWS EC2/S3 Setup & Configuration

Modify EC2 Instance Security Group

In order to be able to access the EC2 instance hosting NextCloud a security group will have to be created and modified to allow access to specific IP Addresses to the specific ports of the instance. This can be used as a security mechanism to only allow access to NextCloud for specific IP Addresses which the clients are currently utilizing. Alternatively you can allow access to port 443 for all IP addresses in order to make your NextCloud instance public.

  1. Navigate to your EC2 Dashboard in AWS

  2. Click on “Security Groups” in the left-hand side navigation bar.

  3. Select the security group attached to your NextCloud EC2 Instance.

  4. Edit the inbound rules to include your IP Address and the ports utilized by NextCloud.

    1. Default Ports: 80 (HTTP), 443 (HTTPS), 22 (SSH)

  5. you can now login remotely and manage your NextCloud server using https://your_Instance_ip (If you have already setup a domain as well you can just use your domain name)

Create an S3 Bucket

These steps are utilized in order to generate a S3 bucket to be utilized with NextCloud. You can also create multiple S3 buckets if you prefer but the policy in the next step would have to be modified accordingly.

  1. Navigate to https://s3.console.aws.amazon.com/s3/buckets

  2. Click “Create Bucket”

  3. Provide your bucket a Name and Region

  4. Click Create Bucket

  5. Create a folder within the bucket to store your backups.

Setup a policy to provide access S3 bucket access to your EC2

These steps outline the necessary steps to create an IAM policy which will be utilized to grant specific action access to the NextCloud EC2 instance. Creating this policy followed by an IAM role will enable you to grant S3 bucket access to a specific S3 bucket without needing to utilize an accessKeyId and secretAccessKey which can be problematic if compromised.

  1. Navigate to https://console.aws.amazon.com/iam/

  2. Click on Policies in the left hand side navigation menu

  3. Add a User and create a new policy for the user

  4. Create a policy with the following input (Replace ‘BUCKETNAME’ in the policy below with your actual bucket name):

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
                          "s3:ListBucket",
                          "s3:ListBucketMultipartUploads"
],
"Resource": [
"arn:aws:s3:::BUCKETNAME"
]
},
{
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
                          "s3:DeleteObject",
                          "s3:ListMultipartUploadParts",
                          "s3:PutObject",
                          "s3:GetObject"
],
"Resource": [
"arn:aws:s3:::BUCKETNAME/*"
]
}
]
}

  1. Click on Roles followed by clicking “Create Role”.

  2. Select the AWS Service option followed by selecting EC2 option in the Use Cases list followed by pressing “Next”.

  3. Select the policy you have created in the previous step followed by clicking “Next”.

  4. Provide a name and description for your role followed by pressing “Create Role”

  5. Navigate to your EC2 Dashboard and select the EC2 instance currently running your NextCloud server.

  6. Click Actions, in the dropdown menu hover over security, and click modify IAM role followed by selecting your newly created role.

S3FS & XQFS Setup & Configuration

Mount your S3 bucket as local drive on EC2 instance

In these next steps we will utilize a tool called S3FS to mount the S3 bucket to the local filesystem of the EC2 instance. S3FS is a utility that allows users to mount object storage buckets locally and read and write in a way that the users used to. This utility tool is fully supported by Amazon but there are alternatives that come at a cost. AWS Storage Gateway would accomplish the same implementation as the following but come at a cost to the user. 

  1. sudo apt-get install s3fs -y

  2. sudo mkdir /bucket 

  3. In order to allow non-root user access for Fuse edit the fuse.conf with the user_allow_other option.


sudo vi /etc/fuse.conf


  1. In this file add the following option.


# Allow non-root users to specify the allow_other or allow_root mount options.
user_allow_other


  1. sudo vi /etc/fstab and add an entry on a new line with the following content (Replace BUCKETNAME with your specific buckets name)


BUCKETNAME /bucket fuse.s3fs _netdev,allow_other,iam_role=auto 0 0


  1. sudo mount -a

  2. In your /bucket directory you should now be able to see all the contents within the S3 Bucket.

NextCloud External Drive Configuration

Setup Bucket Connection within NextCloud

In the following steps we are adding the S3 mounted directory as a storage location accessible within NextCloud. User access controls can be controlled within NextCloud allowing only specific users to access specific drives. It is recommended that within NextCloud you implement 2FA protocols which can be configured through the NextCloud apps and/or use Microsoft AD support.

  1. Login to your NextCloud server using https://your_Instance_ip (If you have already setup a domain as well you can just use your domain name)

  2. Click your profile on the top right followed by the ‘+ Apps’ option in the dropdown menu.

  3. Enable “External Storage Support” from the Apps menu.

  4. Click back on your profile on the top right followed by clicking settings.

  5. In the settings screen you should now see “External Storage” as an option under “Administration”

  6. Input the following settings:

    1. Provide your folder a name

    2. Select “Local” from the storage dropdown 

    3. Authentication: None 

    4. Configuration: /xqEncrypted (Or path of the xqfs mounted virtual drive if you used a different name)

    5. Available For: You can input specific users or user groups who should have access to this directory.

  7. In your “Files” you should now see the directory you just added - any data added to this directory will be encrypted and stored on the S3 bucket.

Setup Bucket Connection within NextCloud (Optional - Client Side XQFS Deployment)

Similar to the above In the following steps we are adding the bucket as a storage location accessible within NextCloud. User access controls to specific locations within the bucket can be controlled within NextCloud allowing only specific users to access specific drives. It is recommended that within NextCloud you implement 2FA protocols which can be configured through the NextCloud apps and/or use Microsoft AD support. These are the steps you would take if users were utilizing local deployments of XQFS and simply using NextCloud as the connection to their S3 storage location.

  1. Login to your NextCloud server using https://your_Instance_ip (If you have already setup a domain as well you can just use your domain name)

  2. Click your profile on the top right followed by the ‘+ Apps’ option in the dropdown menu.

  3. Enable “External Storage Support” from the Apps menu.

  4. Click back on your profile on the top right followed by clicking settings.

  5. In the settings screen you should now see “External Storage” as an option under “Administration”

  6. Input the following settings:

    1. Provide your folder a name

    2. Select “Local” from the storage dropdown 

    3. Authentication: None 

    4. Configuration: /bucket/path/within/bucket 

    5. Available For: You can input specific users or user groups who should have access to this directory.

  7. In your “Files” you should now see the directory you just added - any data added to this directory will be encrypted and stored on the S3 bucket.

Brian Wane
Previous

Harnessing Data-Driven Healthcare for Achieving Excellence
Next

Embracing Zero Trust: A Paradigm Shift in Healthcare Cybersecurity