mirrors/nextcloud-documentation
3
0
Fork 0
mirror of https://github.com/nextcloud/documentation.git synced 2025-10-26 11:18:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1605 from owncloud/LukasReschke-patch-1

Browse Source 
Add note about installing ownCloud in a DMZ
This commit is contained in:
Carla Schroder 2015-08-29 11:57:51 +02:00
commit ef791b4a0f
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
admin_manual/configuration_server/harden_server.rst
View File

@ -148,6 +148,18 @@ Administrators are encouraged to install ownCloud on a dedicated domain such as
cloud.domain.tld instead of domain.tld to gain all the benefits offered by the
Same-Origin-Policy.
Ensure that your ownCloud instance is installed in a DMZ
--------------------------------------------------------
As ownCloud supports features such as Federated File Sharing we do not consider
Server Side Request Forgery (SSRF) part of our threat model. In fact, given all our
external storage adapters this can be considered a feature and not a vulnerability.
This means that a user on your ownCloud instance could probe whether other hosts
are accessible from the ownCloud network. If you do not want this you need to
ensure that your ownCloud is properly installed in a segregated network and proper
firewall rules are in place.
Serve security related Headers by the web server
------------------------------------------------