Nextcloud server software obsolete

[alnetloc]

I posted this topic a couple of weeks ago, after an initial incident, but it was apparently deleted…but I’ve gotten another message: First, when using Nextcloud app to access my Murena Workspace files on my fp4, I get the message “the server has reached end of life…please upgrade”. Then, on my mac computer, when I recently linked an app to my Murena cloud files I got a similar message, telling me the server software was “obsolete”. I know Murena just underwent an major rebuild of their system, but these messages, so close on the heels of that event, do not instill a lot of confidence. I was hoping someone from Murena might respond and explain what I’m seeing. Perhaps there’s a good explanation…?

Regain your privacy! Adopt /e/OS the deGoogled mobile OS and online services

[Shakatus]

It is indeed the case, and not for the first time, that the Murena cloud is vulnerable and out of date, see here: Nextcloud Security Scan.

This is one of the reasons why I refrained from using Murena.io even before the server collapse last year!

[alnetloc]

Wow! Thanks for responding. Per your scan link, they get this grade:
F = This server version is end of life and has no security fixes anymore. It is likely trivial to break in and steal all the data or even take over the entire server

[alnetloc]

Manoj: Can you provide an explanation for what we are seeing relative to Murena Workspace server software? Or anyone with Murena? The silence by anyone from Murena leaves a lot of room for personal interpretation… For a company that values privacy so much, poor security leading to a hack would be the ultimate failure in privacy protection. But, maybe there’s a better explanation…please help us out here.

[Sunpower]

@alnetloc : did you forgot the @ symbol for referencing? @Manoj

As I understand the NextCloud implementation, murena did some special hardenings for better security. The flipside is a development time before a new version of NextCliud could be released on the murena server. That means the scan with F would have been bad if murena had installed a natural NextCloud server. But they did some hardening.

See:

About security of ecloud.global

Since it’s a common concern for /e/ users, we’d like to clarify a few points: ecloud.global is an instance of ecloud-selfhosting, which is based upon several open source projects. Nextcloud server-side encryption is not used, since the data is stored next to the application and NC themselves suggest full-disk encryption in this case. That’s what we use for now – LUKS. We have a long-standing relationship with a security expert in charge of hardening and monitoring our systems, including ecloud…

[Manoj]

Have passed on the message to the server team. Normally when NC releases a new version and our version is not of that level this message shows up. Anyway will have the team check it and revert with their response.

Update: Got an update from the server team. This is NC’s way of informing us to upgrade. The team is working on upgrading to v30 and we will share the date when the upgrade will be done.

[Sunpower]

Thank you for claifying!

[alnetloc]

Thank you for update!

[alnetloc]

Last night, per an email from Murena, they “…deploy[ed] a new release based on the latest Nextcloud 29 image, which includes performance improvements, bug fixes and security patches.” When I ran the Nextcloud Security Scan, linked above, it shows they applied the latest patches - now running Nextcloud 29.0.16.4. It also shows the hardening mentioned above. Thanks for deploying the latest patches. However, it also shows that this version of Nextcloud is not supported. @Manoj reported that v30 is coming.