Nextcloud on Virtualmin for Associations: Secure Operation with 2FA, Permissions and GDPR

Securely Operating Nextcloud on Virtualmin for Associations

Associations often face the challenge of securely managing member data while complying with the GDPR. Nextcloud on Virtualmin offers a flexible and privacy-friendly solution. In this article, we show you how to securely set up the platform for your association – from two-factor authentication to group and sharing permissions, encrypted external storage and retention periods.

1. Setting Up Two-Factor Authentication (2FA)

Two-factor authentication is a must for secure access to member data. Nextcloud supports various 2FA methods such as TOTP (e.g., with the Google Authenticator app) or hardware tokens. Here's how to enable 2FA for all association members:

• Log in to Nextcloud as an administrator.
• Go to Settings > Security and enable the desired 2FA providers.
• Enforce 2FA for all users via the admin settings under Authentication.
• Inform your members about the setup and provide instructions.

Tip: Use secure hosting for the server, e.g., web hosting or virtual servers from Dezhost, to create the foundation for a secure Nextcloud instance.

2. Configuring Group and Sharing Permissions Correctly

In an association, different members have different tasks. Use groups to manage permissions clearly. For example, create groups such as "Board", "Treasurer" and "Members" and assign them specific permissions.

• Create new groups under Users > Groups.
• Assign users to the appropriate groups.
• Configure access to folders and files via the sharing options: you can define for each group whether they can read, write or delete.
• Use the "Share only with groups" function to avoid accidental sharing with external parties.

This ensures that sensitive data such as member lists is only accessible to authorized persons.

3. File Locks and Version Control

To avoid conflicts during simultaneous editing, Nextcloud offers file locks. These prevent two people from editing the same file at the same time. You should also enable versioning to be able to trace changes.

• Enable file locking in the admin settings under Files.
• Ensure that versioning is enabled for all relevant folders.
• Configure the retention period for versions, e.g., 30 days, to save storage space.

These measures increase data integrity and facilitate collaboration.

4. Connecting Encrypted External Storage

Associations often want to use additional storage space, for example for backups or large files. Nextcloud allows the integration of external storage such as SFTP, SMB or Amazon S3. Important: The connection should be encrypted.

• Go to Settings > External Storage and add a new storage.
• Select "Encryption" as the authentication method and enter the credentials.
• Enable the "Force SSL/TLS" option if available.
• Test the connection and assign the appropriate permissions.

For maximum security, you can also use Nextcloud's server-side encryption to encrypt data on external storage.

5. GDPR-Compliant Retention Periods for Member Data

The GDPR requires that personal data is only stored for as long as necessary. In an association, this mainly affects member data, donation receipts and minutes. Set up automated deletion periods:

• Use the Nextcloud app "Retention" to automatically delete files after a certain period.
• Define different periods for different data categories (e.g., member lists after leaving + 3 years, donation receipts 10 years).
• Document the periods in a record of processing activities.
• Train your members in handling personal data.

Remember to also include backups in the deletion process. With virtual servers from Dezhost, you can automate and securely store backups.

Conclusion: Secure Association Operations with Nextcloud

With the right settings, Nextcloud on Virtualmin becomes a secure platform for your association. Two-factor authentication, clear group permissions, file locks, encrypted external storage and GDPR-compliant deletion periods protect member data and facilitate association work. Dezhost's hosting provides a reliable basis – whether web hosting or virtual server.