Securing Nextcloud for Clubs Properly: Setting Up Two-Factor Authentication, Group Permissions, and Encrypted Backups on Your Own Virtualmin Server Step by Step

Nextcloud for Clubs: Security Has Priority

Nextcloud is the perfect solution for clubs to share files, collaborate, and manage member data. But especially with sensitive club data, security is paramount. In this guide, we show you how to secure your Nextcloud instance on your own Virtualmin server – with two-factor authentication, group permissions, and encrypted backups.

Before we start: Make sure you have a reliable server. At Dezhost you will find powerful virtual servers that are ideal for Nextcloud. Web hosting packages can also be sufficient for smaller clubs.

Step 1: Install Nextcloud on Virtualmin

Virtualmin is a powerful control panel that simplifies web server management. Here's how to install Nextcloud:

• Log in to Virtualmin and create a new virtual server for your Nextcloud domain.
• Install PHP and the required extensions (e.g., php-json, php-mbstring, php-xml, php-zip, php-gd, php-curl).
• Download the latest Nextcloud version and extract it into the public_html directory of your virtual server.
• Create a MySQL database and a user for Nextcloud.
• Open your domain in the browser and follow the installation wizard.

After installation, you should regularly apply updates to close security gaps.

Step 2: Set Up Two-Factor Authentication (2FA)

Two-factor authentication is one of the most effective measures to prevent unauthorized access. Nextcloud supports various 2FA methods. We recommend the Two-Factor TOTP app.

How to enable 2FA:

• Log in to Nextcloud as an administrator.
• Go to Apps and search for "Two-Factor TOTP". Install and enable the app.
• Navigate to Settings > Security and enable two-factor authentication.
• Each user must now scan a QR code with an authenticator app (e.g., Google Authenticator, Authy) upon first login.

Alternatively, you can use hardware tokens or email codes. Important: Instruct all club members to use 2FA.

Step 3: Manage Group Permissions Granularly

In a club, members have different tasks and require different access rights. Nextcloud offers a flexible group and permission system.

Create groups and assign permissions:

• Go to Settings > Users and create groups such as "Board", "Members", "Treasurer".
• Assign users to the appropriate groups.
• For each group, you can define which folders and files can be accessed. To do this, click the share icon of a folder and select the group.
• For example, revoke access to confidential board folders from the "Members" group.

This ensures that everyone only sees the data they need.

Step 4: Set Up Encrypted Backups

Regular backups are essential to avoid data loss. On a Virtualmin server, you can automate and encrypt backups.

Backup strategy:

• Use the Virtualmin backup module to create regular backups of databases and files.
• Store the backups in an external location, e.g., on another server or in cloud storage.
• Encrypt the backups with GnuPG or a similar tool. Virtualmin supports encryption of backup archives.
• Regularly test the restoration to ensure that the backups work.

A good backup strategy includes daily incremental backups and weekly full backups.

Step 5: Additional Security Measures

In addition to the points mentioned, you should follow these tips:

• SSL encryption: Enable HTTPS for your Nextcloud instance. Virtualmin offers Let's Encrypt integration.
• Regular updates: Keep Nextcloud, Virtualmin, and all components up to date.
• Strong passwords: Enforce complex passwords and regular changes.
• Firewall: Configure the firewall to open only necessary ports.
• Monitoring: Monitor the logs for suspicious activities.

Conclusion: Security Is a Process

Securing your Nextcloud for the club is not a one-time project but an ongoing process. With the steps described here – 2FA, group permissions, and encrypted backups – you create a solid foundation. Remember to train your members regularly and document security policies.

If you are still looking for the right server for your club, check out the virtual servers from Dezhost. You can also register domains directly there.