Table of Contents
Nextcloud audit
basis is goed. Nog wel wat finetunen.
context
dit document beschrijft hoe je Nextcloud nakijkt op gebruikersacties.
Niet onbelangrijk gezien bestanden vanop alle mogelijke apparaten een onwaarschijnlijke weg kunnen afleggen.
Het is ook een prima manier om uploads van bestanden te troubleshooten
installatie
- installeer de NC module Auditing / Logging
- meld aan op linux
- open
config/config.php - voeg onderstaande lijnen toe:
'loglevel' => 3, 'logdateformat' => 'F d, Y H:i:s', 'logtimezone' ⇒ 'Europe/Brussels', 'log.condition' => [ 'apps' => ['admin_audit'], ],
werking
- bewerkingen worden nu gelogd naar
data/audit.log:{"reqId":"YBKCOlfNqcu@wMAGcT1ragAAAAc","level":1,"time":"January 28, 2021 10:22:03","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MKCOL","url":"/remote.php/dav/files/koen/home/media/scans/New%20folder","message":"File created: \"/home/media/scans/New folder\"","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.0stable-Win64 (build 20201210) (Nextcloud)","version":"20.0.4.0"} {"reqId":"YBKCOlfNqcu@wMAGcT1ragAAAAc","level":1,"time":"January 28, 2021 10:22:03","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MKCOL","url":"/remote.php/dav/files/koen/home/media/scans/New%20folder","message":"File written to: \"/home/media/scans/New folder\"","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.0stable-Win64 (build 20201210) (Nextcloud)","version":"20.0.4.0"} {"reqId":"YBKCQlfNqcu@wMAGcT1rdgAAAAc","level":1,"time":"January 28, 2021 10:22:11","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MOVE","url":"/remote.php/dav/files/koen/home/media/scans/New%20folder","message":"File renamed: \"/home/media/scans/New folder\" to \"/home/media/scans/Voorbeeld\"","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.0stable-Win64 (build 20201210) (Nextcloud)","version":"20.0.4.0"} - nakijken of bestanden vanaf een apparaat worden geupload:
tail -f data/audit.log|grep -i created –color{"reqId":"YBXqnurT7cjSN@bVAmmLWgAAACs","level":1,"time":"January 31, 2021 00:24:15","remoteAddr":"109.128.15.166","user":"koen","app":"admin_audit","method":"MOVE","url":"/remote.php/dav/uploads/koen/c9fede51d1980bd566f529a9043ca141/.file","message":"File created: \"/home/media/fotos/20200109_075205.jpg\"","userAgent":"Mozilla/5.0 (Android) Nextcloud-android/3.14.3","version":"20.0.4.0"}