Fedora 31 Server Edition filesystem permissions changed to 777

JaredBusch

@Woti Your system is not compromised (yet), as you caused the problem. But because of the global permissions change, it will be trivial to compromise down the road. That is why you have to (should) reinstall from scratch.

Assuming that your current Nextcloud instance is now working again, simply do a normal backup process.

https://docs.nextcloud.com/server/stable/admin_manual/maintenance/migrating.html

Prior to migrating you can also fix you permissions on the existing NC data files.

Assuming default file location:

# All the directories should be 755
find /var/www/html/nextcloud/data -type d -exec chmod 755 {} \;
# All of the files should be 644
find /var/www/html/nextcloud/data -type f -exec chmod 644 {} \;

scottalanmiller

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

How to backup and restore both MySql and Nextcloud content?
/data directory is located on a separate partition.

MySQL / MariaDB has standard backup procedures like mysqldump. Just use those. There's no NextCloud specific information to have here.

Same with the /data directory. Just take a normal backup of it like you would with any file server.

And in doing so, user creds are backed up automatically.

JaredBusch

@scottalanmiller said in Fedora 31 Server Edition filesystem permissions changed to 777:

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

How to backup and restore both MySql and Nextcloud content?
/data directory is located on a separate partition.

MySQL / MariaDB has standard backup procedures like mysqldump. Just use those. There's no NextCloud specific information to have here.

Same with the /data directory. Just take a normal backup of it like you would with any file server.

And in doing so, user creds are backed up automatically.

The linked migration instructions link to that info.

black3dynamite

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

I've decided to install my Server from scratch.
I am wondering about:

How to backup and restore both MySql and Nextcloud content?
/data directory is located on a separate partition.

Is it possible to restore user credentials?

Is there some Fedora / CentOS based howtos?

Any help is very appreciated.

Best regards,
Woti

You can adapt this script for your setup.
https://riegers.in/nextcloud-backup-and-restore/

Woti

Hello again

I did a backup og my MariaDB. But I saw under /var/lib/mysql are a couple of folders and files and all of them got permissions 777.
I mean shouldn't it be 640?
When I did the backup of the Nextcloud DB are the (wrong) permissions stored too?
These are the 5 folders:
/.rocksdb
/#rocksdb
/mysql
/nextcloud
/performance_schema

Can you guys be so kindly and check what are the right permissions for /var/lib/mysql folder and subfolders I wrote about?

I just wanna be sure before I delete everything

Best regards,
Woti

JaredBusch

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

Hello again

I did a backup og my MariaDB. But I saw under /var/lib/mysql are a couple of folders and files and all of them got permissions 777.
I mean shouldn't it be 640?
When I did the backup of the Nextcloud DB are the (wrong) permissions stored too?
These are the 5 folders:
/.rocksdb
/#rocksdb
/mysql
/nextcloud
/performance_schema

Can you guys be so kindly and check what are the right permissions for /var/lib/mysql folder and subfolders I wrote about?

I just wanna be sure before I delete everything

Best regards,
Woti

You don’t backup the DB by backing up a folder. you are not doing something that you were told.

scottalanmiller

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

I did a backup og my MariaDB. But I saw under /var/lib/mysql are a couple of folders and files and all of them got permissions 777.

To back up any database like this, you have to shut it down completely before taking the backup. No database is meant to be backed up that way. You should always use the DB's own backup tools to get a working backup. Anything taken this way is an unreliable copy - any corruption is expected.

scottalanmiller

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

But I saw under /var/lib/mysql are a couple of folders and files and all of them got permissions 777.
I mean shouldn't it be 640?

A correct backup and restore could not change them. What action did you take to do your backup and restore? The mysqldump commands cannot change the file permissions.

Woti

The permissions has been changed before. As I wrote in the beginning thread the entire filesystem has been changed to 777.
I could fix it via the rpm command but that command can just fix default files and folders, no user files and folders.

To backup the database I used this command as recommented:

mysqldump --single-transaction -h localhost -u nextadmin -pnextcloudPassword nextcloud > /mnt/cloud/Nextcloud-DB_`date +"%Y%m%d"`.sql

JaredBusch

@Woti then you take that resulting file and copy it to the new system and restore it. The permissions of the sql backup file are irrelevant as long and it can be read.

Woti

I'll see soon. I've reinstalled Fedora 31 Server from scratch. I'm using newer and stronger certificates following those two guides:
https://linuxize.com/post/secure-apache-with-let-s-encrypt-on-centos-8/
https://riegers.in/nextcloud-installation-guide-ubuntu-18-04/

Next step is to restore Nextcloud DB and get Nextcloud up and running again. I'm not working with the server every day, that's why it takes some time

Best regards,
Woti

JaredBusch

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

I'll see soon. I've reinstalled Fedora 31 Server from scratch. I'm using newer and stronger certificates following those two guides:
https://linuxize.com/post/secure-apache-with-let-s-encrypt-on-centos-8/
https://riegers.in/nextcloud-installation-guide-ubuntu-18-04/

Next step is to restore Nextcloud DB and get Nextcloud up and running again. I'm not working with the server every day, that's why it takes some time

Best regards,
Woti

Good luck. post here with questions. Busy but will always help if I can.

Woti

Everyone's busy that's why good things take time

Woti

My attempt to get running Nextcloud is stopped of a strange issue.
I get these following errors:
ssl_error_log:
[ssl:warn] AH01909: woti.dedyn.io:443:0 server certificate does NOT include an ID which matches the server name
Googling AH01909 gives a lot of answers but I can't figure it out.

http_error_log:
[lbmethod_heartbeat:notice] AH02282: No slotmem from mod_heartmonitor
Googling AH02282 gives me different answers, not sure if I need this modul at all? Never had this notice in my prior Fedora system.

Is there any way to completely undo certificate creation and start from scratch igjen without reinstalling the whole system?

Best regards,
Woti

travisdh1

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

My attempt to get running Nextcloud is stopped of a strange issue.
I get these following errors:
ssl_error_log:
[ssl:warn] AH01909: woti.dedyn.io:443:0 server certificate does NOT include an ID which matches the server name
Googling AH01909 gives a lot of answers but I can't figure it out.

http_error_log:
[lbmethod_heartbeat:notice] AH02282: No slotmem from mod_heartmonitor
Googling AH02282 gives me different answers, not sure if I need this modul at all? Never had this notice in my prior Fedora system.

Is there any way to completely undo certificate creation and start from scratch igjen without reinstalling the whole system?

Best regards,
Woti

Any reason you're not using certbot from Let's Encrypt?

Woti

Yes I do using certbot from Let's Encrypt. I did using it before re-installation too.
I was using this tutorial: https://linuxize.com/post/secure-apache-with-let-s-encrypt-on-centos-8/

certbot certonly --agree-tos --email [email protected] --apache -w /var/www/html -d woti.dedyn.io

openssl x509 -in /etc/letsencrypt/live/woti.dedyn.io/fullchain.pem -noout -subject
subject=CN = woti.dedyn.io

openssl x509 -in /etc/letsencrypt/live/woti.dedyn.io/fullchain.pem -noout -text | grep DNS
DNS:woti.dedyn.io

Woti

It looks like something is missing. I rolled back from https to default http and I can reach Apache's default welcome side by using IP address. But if I try to reach Nextcloud by IP the browser is showing me the sourcecode of Nextcloud's index.php file.
Using https again brings me just Internal Server Error.
The same happens with a clean installation of Nextcloud.
Am I missing something here?

Got fixes those two errors I wrote about above.
But getting now:
AH01071: Got error 'Primary script unknown'

scottalanmiller

Likely in your configs http has instructions to read index.php and https is missing that directive.

Woti

Can someone tell me what that entries mean? I found it access_log file.

https://github.com/robertdavidgraham/masscan

scottalanmiller

@Woti said in Fedora 31 Server Edition filesystem permissions changed to 777:

Can someone tell me what that entries mean? I found it access_log file.

https://github.com/robertdavidgraham/masscan

It's quite straightforward, but the name is so bizarre that it makes it confusing. It's not anything weird, other than the name.

The position in the log represents the "browser" identifier. The browser's name (Chrome, Firefox, etc.) is masscan and the browser version is 1.0. People are likely to be confused by that, so the "browser" ID includes the URL of the browser's code so that you can look it up.

So in this case, it tells us that someone using masscan made a request to your site. It's someone port scanning you.