What you want is called client side encryption. Everything on the server cannot be read. Everything is encrypted until it is actually on the client computer.
Lucky for you there is already a plugin for that.
this post was submitted on 17 Oct 2023
1 points (100.0% liked)
Self-Hosted Main
502 readers
4 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
- Service: Dropbox - Alternative: Nextcloud
- Service: Google Reader - Alternative: Tiny Tiny RSS
- Service: Blogger - Alternative: WordPress
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
- Awesome-Selfhosted List of Software
- Awesome-Sysadmin List of Software
founded 1 year ago
MODERATORS
Cheers! I actually use this for some encryption here and there. My thought was more along the lines of the entire content. Server side.
I think this plugin is probably the best you're gonna get. It encrypts and decrypts on client side. So the data that is transmitted and stored in dokuwiki is already encrypted before it even hits the server, so data on server side at all times is encrypted. So even if an attacker gets access to the VPS, the data there is encrypted and they have no way of knowing what passphrase was used for the encryption as it not stored/configured on server side.
Just to add some clarification. Client side encryption basically means that all of the content on the server is always encrypted (or at least it is once it’s been saved on a client using client side encryption).
The whole point is that the server is entirely unable to decrypt the data - there’s no possibility of some cached credentials being used to decrypt the data when you aren’t logged in, there’s no risk of accidental decryption keys being saved in log files. All the decryption takes place on the client and any bad actors would need to compromise your local PC to get access to your data.
Done right this is the best solution for what you are looking for.
In case anyone was wondering. I implemented a small php function. It uses aes 256 with a sha256 key “derivation” to encrypt things.
I choose the key when encrypting, and force encryption upon logout.
Cheers!
This to me sounds like something that NextCloud is built for. Instead of building something piece by piece with github repos it might just be easier to switch your service platform to something that already has features like that built in.
I have resisted nextcloud. It was always slow, and cumbersome for me. I’ll have to check it out again.
It's not exactly a Formula 1 car these days, but it IS faster than it used to be.
looks like these dokuwiki plugins will let you add encryption: https://www.dokuwiki.org/plugins?plugintag=encryption#extension__table
If the attacker can attack your password hashes at full speed (they get access to the disk) then you would need a fairly hefty password or a random passphrase with a fair number of words in it. That fact can make the sort of protection you seem to be hoping for impractical in many cases.
Not sure I follow. What I am proposing is a way of encrypting the content of the website. Decrypted only while in use, this way, if someone gets access to the server (bug, leaked password, etc) the content is still encrypted.
I am making a distinction between a rate limited login password (which would be secure with something like "Karma27!") and a password that protects encrypted disk data (which would need to be something like "Swipe Stapling Mortally Eloquence Obliged"). It sounds like you are planing to just use the login password for encrypted disk data encryption, which in general won't work as the sort of thing that people use in that case can be trivially cracked.
You can do some password stretching, but that only gets you a factor of thousands improvement.
Just encrypt database tables. It would be the easiest way as for me. But I still see no reason for doing anything that weird
You could always shove a firewall to lock all incoming ports and add CF Zero Trust to setup SSO (through G-Workspace/Office/Okta/2fa etc). Zero Trust should prevent anyone who isn't you logging in (unless people have your login)