Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/settings.yml
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,8 @@ labels:
color: fef2c0
- name: p1-urgent
color: fc2929
description: Consider a hotfix release with only that fix (ex: lost trust, money, security issue, ...)
description: |
Consider a hotfix release with only that fix (ex: lost trust, money, security issue, ...)
- name: p2-high
color: fc2929
description: Escalation, on top of current planning, release blocker.
Expand Down
2 changes: 1 addition & 1 deletion docs/new-version-branch.md
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ This step creates the branch locally, necessary for content changes and for the
1. In `antora.yml`, in section `asciidoc.attributes`, DO NOT adjust relevant `-version` keys. They are required for local building.
1. In `site.yml`, in section `asciidoc.attributes`, DO NOT adjust relevant `-version` keys. They are used for local building and will be correctly set in the docs repo when doing a full build. NOTE: any attribute values defined here overwrite any attributes included via the `load-global-site-attributes.js` extension.
1. Run a build by entering `npm run antora-local`. No build errors should occur.
1. Commit the changes and push the new `x.y` branch. This makes the branch available for futher processing. DO NOT CREATE A PR!
1. Commit the changes and push the new `x.y` branch. This makes the branch available for further processing. DO NOT CREATE A PR!

**Step 3: Protect the new branch**

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ The location of the upload directory can be defined via the environment variable

[NOTE]
====
The space temporarily consumed in the upload directory will not count against the user quota. If a user has no quota left in his peronal storage and the quota excludes external mounts, uploads to a windows network drive share as example will succeed. The file temporarily created in the upload directory will not count against his personal storage.
The space temporarily consumed in the upload directory will not count against the user quota. If a user has no quota left in his personal storage and the quota excludes external mounts, uploads to a windows network drive share as example will succeed. The file temporarily created in the upload directory will not count against his personal storage.
====
--

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ $CONFIG = [
'bucket' => 'owncloud',
//
// uncomment to indicate available storage size in the objectstore in bytes (in this example 1TB),
// without this setting, apps relying on available storage might be limited in funcionality e.g. metrics app
// without this setting, apps relying on available storage might be limited in functionality e.g. metrics app
//'availableStorage' => 1099511627776,
//
// uncomment to enable server side encryption
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@

[IMPORTANT]
====
* For security reasonsfederated sharing *strictly requires HTTPS (SSL/TLS)*.
* For security reasons, federated sharing *strictly requires HTTPS (SSL/TLS)*.

* If you want to use HTTP for development and testing purposes, you have to set xref:{config-sample}#allow-schema-fallback-for-federated-sharing-servers[OWNCLOUD_SHRAING_FEDERATION_ALLOW_HTTP_FALLBACK] to 'true'.
* If you want to use HTTP for development and testing purposes, you have to set xref:{config-sample}#allow-schema-fallback-for-federated-sharing-servers[OWNCLOUD_SHARING_FEDERATION_ALLOW_HTTP_FALLBACK] to 'true'.
====

== Configuration
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ Set the default number of days that user shares will expire. The default value i

Check this option to limit the maximum expiration date to be the default. Users can choose an earlier expiration date if they wish.

=== Set Default Expiration Date for Group Sshares
=== Set Default Expiration Date for Group Shares

Check this option to set a default expiration date when sharing with a group. The user can change or remove the default expiration date of a share.

Expand Down Expand Up @@ -260,7 +260,7 @@ If an exception occurred during the transfer ownership command or the command te

When a user is deleted, their files are also deleted. As you can imagine, this is a problem if they created file shares that need to be preserved, because these disappear as well. In ownCloud, files are tied to their owners. This means, whatever happens to the file owner also happens to the files.

One solution to get around this issueis, to create persistent shares for your users. You can retain ownership of them, or you could create a special user for the purpose of establishing permanent file shares. Simply create a shared folder in the usual way, and share it with the users or groups who need to use it. Set the appropriate permissions on it and the share is independent which users come and go, the file shares will remain. Because all files added to the share or edited in it are automatically owned by the owner of the share regardless of who adds or edits them.
One solution to get around this issue is to create persistent shares for your users. You can retain ownership of them, or you could create a special user for the purpose of establishing permanent file shares. Simply create a shared folder in the usual way, and share it with the users or groups who need to use it. Set the appropriate permissions on it and the share is independent which users come and go, the file shares will remain. Because all files added to the share or edited in it are automatically owned by the owner of the share regardless of who adds or edits them.

== Create Shares Programmatically

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ To configure the Full Text Search, go to menu:Settings[Admin > Search].

Independent of the authentication method selected below, you need to provide the URL of the Elasticsearch server. For any of the authentication methods selected, your Elasticsearch server must be prepared upfront.

For the URL, both `HTTP` and `HTTPS` incuding the address and port can be used.
For the URL, both `HTTP` and `HTTPS` including the address and port can be used.

The app provides several authentication methods. Select the one of your choice and check out the details for the respective authentication method below:

Expand Down Expand Up @@ -364,5 +364,5 @@ Currently, the app has the following known limitations:

* If a shared file is renamed by the sharee (share receiver), the sharee cannot find the file using the new filename.
* Search results are not updated when a text file is rolled back to an earlier version.
* The app does not return results for recieved federated share files.
* The app does not return results for received federated share files.
* Search does currently not work when encrypting files via the encryption app.
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ The caching backends supported by ownCloud are:
* xref:apcu[APCu] +
This is a data cache only and does *not* cache any opcode. APCu is part of the Docker image.
* xref:redis[Redis] +
This is an in-memory data structure store (cache) for single and multi-server ownCloud installations, which provides file locking and can be set up in local or distributed environments. The required `php-redis` extension is already part of the Docker image. Redis is used of the Docker Compose deployment example. For details see the xref:installation/installing_with_docker.adoc#docker-compose[Installalling With Docker] documentation.
This is an in-memory data structure store (cache) for single and multi-server ownCloud installations, which provides file locking and can be set up in local or distributed environments. The required `php-redis` extension is already part of the Docker image. Redis is used of the Docker Compose deployment example. For details see the xref:installation/installing_with_docker.adoc#docker-compose[Installing With Docker] documentation.

[NOTE]
====
Expand Down Expand Up @@ -66,7 +66,7 @@ xref:configuration/files/files_locking_transactional.adoc[transactional file loc
====
Authentication with Redis:

* ownCloud does support the password protection available with current Redis versions which can be configurted with environment variables.
* ownCloud does support the password protection available with current Redis versions which can be configured with environment variables.
* With Redis version 6 upwards, a new authentication mechanism has been introduced named ACL (Access Control Lists). ownCloud does currently not support Redis ACLs.
====

Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
= Email Configuration
:toc: right
:expermimental:
:experimental:
:page-aliases: go/admin-email.adoc

== Introduction
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ To start the migration, it must be initialized first:
[width="100%",cols="20%,70%",]
|===
| `-f --force`
| Normally, init is protected against accidentially overwriting an existing kiteworks connection. Use --force to do so.
| Normally, init is protected against accidentally overwriting an existing kiteworks connection. Use --force to do so.
|===

== Verify That the Migration can be Started
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ encryption
file system with newly created master key
encryption:select-encryption-type Select the encryption type. Only `masterkey` is available.
Note that this setting is only necessary when migration from user
key encryption. New encryptions will autmatically use master key.
key encryption. New encryptions will automatically use master key.
encryption:set-default-module Set the encryption default module
encryption:show-key-storage-root Show current key storage root
encryption:status Lists the current status of encryption
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Description:
====
* Cleaning up previews is a database-intense operation. The command can take a considerable amount of time when the database and filesystem are on NFS. Note that the command execution time depends on the total quantity of items in the database and not on the number of items likely to be cleaned up.
* Once started, the command cannot be stopped, e.g. with kbd:[CTRL+C], you need to end the process manually.
* If you have upgraded your system but the backgroundjob does not appear in the job list, you can manually add it.
* If you have upgraded your system but the background job does not appear in the job list, you can manually add it.
====

=== Example
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ OAuth2 support is available in ownCloud via the {oc-marketplace-url}/apps/oauth2

To use the OAuth2 app, your ownCloud installation will need to meet the following dependencies:

For the provided ownCloud image, the configuration already meets these criterias:
For the provided ownCloud image, the configuration already meets these criteria:

* *Apache:* +
{mod_rewrite-url}[mod_rewrite] and {mod_headers-url}[mod_headers] modules are installed and enabled.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,7 @@ sudo systemctl start clamav-daemon.service

When successful, an output similar to the following should appear on the terminal:

[source,plainetxt]
[source,plaintext]
----
Synchronizing state of clamav-daemon.service with SysV service script with
/lib/systemd/systemd-sysv-install.
Expand Down Expand Up @@ -285,7 +285,7 @@ ClamAV can run in an ownCloud Dockerised deployment only in *ClamAV Daemon (TCP

In _ClamAV Daemon (TCP Socket)_ mode, ClamAV runs on a different server.

image::configuration/server/virus-scanner-support/clamav_daemon_tcp.png[ClamAV Deamon TCP,width=350]
image::configuration/server/virus-scanner-support/clamav_daemon_tcp.png[ClamAV Daemon TCP,width=350]

. Set btn:[Mode] to "*ClamAV Daemon (TCP Socket)*".
. Set btn:[Host] to the host name or IP address of the remote server running ClamAV, and set btn:[Port] to the server's port number.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ With the Kerberos app, you can reuse the authentication ticket generated from a

== General Information

When using the Kerberos app, the Windows login session from the user is taken to log in to ownCloud. This is very convenient, as the user does not need to re-authenticate for using ownCloud as he already has authenticated to his Domain. In addition by using the Kerberos ticket, the user can also use file resoures via the xref:enterprise/external_storage/windows-network-drive_configuration.adoc[Windows Network Drive (WND)] app without the need to re-authenticate. This generates a seamless user experience. This is done by the configuration made, which enables the webserver to make the ticket available for PHP for further processing.
When using the Kerberos app, the Windows login session from the user is taken to log in to ownCloud. This is very convenient, as the user does not need to re-authenticate for using ownCloud as he already has authenticated to his Domain. In addition by using the Kerberos ticket, the user can also use file resources via the xref:enterprise/external_storage/windows-network-drive_configuration.adoc[Windows Network Drive (WND)] app without the need to re-authenticate. This generates a seamless user experience. This is done by the configuration made, which enables the webserver to make the ticket available for PHP for further processing.

=== Kerberos Benefits

Expand Down Expand Up @@ -106,13 +106,13 @@ image::enterprise/authentication/kerberos/kerberos-principle.drawio.svg[Kerberos

* Make sure the clocktime of the KDC, the client and the server the ownCloud instance is running on is in sync. 5 minutes are the highest difference you may allow for Kerberos to work properly. Without going into the details, you may use NTP for that task.

* All members in the realm, which includes cients, must support `DES3, AES128 or AES256` encryption. This applies to Windows 10+ and modern Linux based OS desktops. If a client does not support this encryption standard, he can not use Kerberos. Alternatively the legacy crypto `RC4-HMAC-EXP` can be added during configuration - which is _strongly discouraged_ for security reasons. See the http://web.mit.edu/kerberos/krb5-1.5/krb5-1.5/doc/krb5-admin/Supported-Encryption-Types.html#Supported%20Encryption%20Types[Kerberos supported encryption types,window=_blank] for more information.
* All members in the realm, which includes clients, must support `DES3, AES128 or AES256` encryption. This applies to Windows 10+ and modern Linux based OS desktops. If a client does not support this encryption standard, he can not use Kerberos. Alternatively the legacy crypto `RC4-HMAC-EXP` can be added during configuration - which is _strongly discouraged_ for security reasons. See the http://web.mit.edu/kerberos/krb5-1.5/krb5-1.5/doc/krb5-admin/Supported-Encryption-Types.html#Supported%20Encryption%20Types[Kerberos supported encryption types,window=_blank] for more information.

* Replace in the configuration examples where applicapable the placeholders accordingly:
* Replace in the configuration examples where applicable the placeholders accordingly:
** `<user-name>` +
The name of the user account like `owncloud_spnego_user` which is used as principal.
** `<complex-password>` +
A complex password for `<user-name>`. Remember this password as it helps debugging, but keep protected as you can access domain servcies with it. Also see: xref:keytab-files[Keytab Files] for additional info when this password needs to be changed.
A complex password for `<user-name>`. Remember this password as it helps debugging, but keep protected as you can access domain services with it. Also see: xref:keytab-files[Keytab Files] for additional info when this password needs to be changed.
** `<FQDN>` +
The fully qualified domain name the ownCloud instance is accessed, like `owncloud.example.com`.
** `<realm>` +
Expand Down Expand Up @@ -506,7 +506,7 @@ sudo apachectl -k graceful
. Click *Advanced* and add, if not exists, the ownCloud website to the local zone . For example, `\https://<FQDN>`.
. Click btn:[Add].

.For Google Chrome on Linux or macOS, Kerberos authentication is configured ieither via command line parameters or policy files:
.For Google Chrome on Linux or macOS, Kerberos authentication is configured either via command line parameters or policy files:
{empty}

. Command line parameters
Expand Down Expand Up @@ -555,7 +555,7 @@ and double click it.
Though some research has been made, no options have been identified. This section will be updated on changes known.

////
must be enabled via a command line sitch
must be enabled via a command line switch

https://support.google.com/chrome/thread/201738899/kerberos-sso-stopped-working-under-linux-after-updating-chrome-to-110?hl=en

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ To configure the WOPI app in your ownCloud installation, add the following confi
# Only for Office 365 (cloud), not needed for Office Online Server
# URL of the O365 proxy instance.
# Note that you will get a working URL from ownCloud Support
# post a written declaration that your company has an eligable
# post a written declaration that your company has an eligible
# Microsoft Business contract.
'wopi.proxy.url' => 'https://o365.example.com',

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ The available elements in EXIF metadata can vary depending how the file was crea

* Screenshot or graphics software may have: +
**Property XPath** = +///PNG:Software+ +
**Property Value** = +gnome-screenhot+
**Property Value** = +gnome-screenshot+
+
**Property XPath** = +//PNG:Comment+ +
**Property Value** = +Created with GIMP+
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ NOTE: See the linked section for important information when planning to use xref
When the xref:enterprise/authentication/kerberos.adoc[Kerberos Authentication] has been set up, a necessary config key xref:configuration/server/config_apps_sample_php_parameters.adoc#a-map-of-servers-with-the-required-kerberos-data[wnd.kerberos.servers] needs to be provided upfront in `config.php`.

* `Kerberos Server ID` +
This ID can be chosen from the config paramater section `wnd.kerberos.servers` and defines required parameters for the WND Kerberos setup. Multiple ID's with different setups can be created.
This ID can be chosen from the config parameter section `wnd.kerberos.servers` and defines required parameters for the WND Kerberos setup. Multiple ID's with different setups can be created.
* `ockeytab` +
This is the keytab file that has been described in xref:enterprise/authentication/kerberos.adoc#keytab-files[Keytab Files].
* `ocservice` +
Expand Down Expand Up @@ -237,7 +237,7 @@ image::enterprise/external_storage/windows_network_drive/wnd-kerberos-1.png[WND

Note that this authentication method can only be used by ordinary users if the admin hands over the `Kerberos Server ID` created. Consider this as a very sensitive information like a password.

When the data has been entered correctly, the moint point will show up as follows:
When the data has been entered correctly, the mount point will show up as follows:

image::enterprise/external_storage/windows_network_drive/wnd-kerberos-2.png[WND mountpoint with Kerberos authorization,width=500]

Expand Down Expand Up @@ -452,7 +452,7 @@ NOTE: The `wnd.activity.sendToSharees` key depends on the `wnd.activity.register

Collaborative WND (CWND) can only be set by an admin in menu:Settings[Admin > Storage]. This mount type cannot be selected by users in the user section. To prepare access for your mount point using the CWND mount type, you must provide a _Service Account_ (SA) which is an ordinary SMB user granting read access to the share you want to mount. You can use one SA for all CWND mounts or separate ones. The SA is used to gather the contents of a share used by the WND Listener and provides a common `file_id` to all accessing users, while the accessing users can only access those files and folders for which they've been granted rights.

NOTE: For obvious reasons, do not use the `$user` placeholder for the share name. It would map to the logged in users home directoy shared collaboratively.
NOTE: For obvious reasons, do not use the `$user` placeholder for the share name. It would map to the logged in users home directory shared collaboratively.

NOTE: For the time being, no CWND is possible with Kerberos because of a necessary service user which is currently not available for Kerberos.

Expand Down
Loading