Set Master key for encryption afterwards

[CordlessWool]

Hi,

i want to install some apps (e.g. nextant and onlyoffice) witch need a master key when nextcloud is encrypted, but I found no way to activate it afterwards. So are there any work items to add it afterwords or will that be not possible?

Will it be possible to decrypt all files with recovery key if all users will activate password recovery, set Master key and activate it again? Are there any other options?

thanks

[blizzz]

@schiessle

[Dozecloud-llc]

You could just do cd /var/www/nextcloud then sudo -u www-data php occ encryption:decrypt-all then encrypt everthing using sudo -u www-data php occ encryption:encrypt-all and then set your recovery key

[CordlessWool]

and it will be no problem if one or more user have not enabled the recovery key?

[Dozecloud-llc]

yes there be no problems. if you have main recovery key. When you turn encryption back set a recovery key for everyone

[CordlessWool]

I tested in on a new instance and it did not work for me.

Firstly I activate the encryption via admin interface in the browser, like I did it on the other instance of nextcloud, then I create some user and upload some gb of data for the test.

So the test instance is nearly the same as the production one.
Now I went to singeluser mode on command line and decrypt the data.
There I got the following message after decryption was finishing:

Files for following users couldn't be decrypted,
maybe the user is not set up in a way that supports this operation:
abb
abc

I think that is the first problem. But I tried to watch the data I had uploaded and they were watchable, so I went on.

Activating the master key and encrypt all data again...

but now the data are not displayable anymore, only the files I watched for testing are watch able anymore. I could also not set a new recovery key, the option on the web-interface disappears and I found no command to set it via commandline

[schiessle]

this only works if all users have a recovery key enabled

[CordlessWool]

Is only deactivating encryption possible or could I run in problems too?

[schiessle]

with Nextcloud 13.0.5 or later you can safely disable encryption occ encryption:disable. Just make sure to keep the default encryption module enabled. This way Nextcloud can still read/decrypt old files, every new file will be stored unencrypted