Decryption corrupted all files — serious file loss

[mmaedler]

Steps to reproduce

1. Enable server-side encryption via occ encryption encrypt:all
2. Disable server-side encryption via occ encryption decrypt:all
3. All files being opened trigger "Bad Signature error in log" and seem corrupted

Expected behaviour

Files should be decrypted and accessible

Actual behaviour

Files are corrupted and cannot be opened anymore. Due to that I have lost important files.

Server configuration

Operating system: Ubuntu 16.04 server

Web server: nginx

Database: mysql

PHP version: 7.0

Nextcloud version: 12.0.4

Updated from an older Nextcloud/ownCloud or fresh install: Updated

Where did you install Nextcloud from:

Signing status:

Signing status

``` No errors have been found. ```

List of activated apps:

App list

``` Enabled: - activity: 2.5.2 - admin_audit: 1.2.0 - admin_notifications: 1.0.1 - announcementcenter: 3.1.1 - bruteforcesettings: 1.0.3 - calendar: 1.5.7 - comments: 1.2.0 - contacts: 2.0.1 - dav: 1.3.0 - encryption: 1.6.0 - external: 2.0.3 - federatedfilesharing: 1.2.0 - federation: 1.2.0 - files: 1.7.2 - files_accesscontrol: 1.2.5 - files_automatedtagging: 1.2.2 - files_external: 1.3.0 - files_pdfviewer: 1.1.1 - files_sharing: 1.4.0 - files_texteditor: 2.4.1 - files_trashbin: 1.2.0 - files_versions: 1.5.0 - files_videoplayer: 1.1.0 - firstrunwizard: 2.1 - gallery: 17.0.0 - logreader: 2.0.0 - lookup_server_connector: 1.0.0 - nextcloud_announcements: 1.1 - notifications: 2.0.0 - oauth2: 1.0.5 - password_policy: 1.2.2 - provisioning_api: 1.2.0 - quota_warning: 1.1.1 - serverinfo: 1.2.0 - sharebymail: 1.2.0 - socialsharing_email: 1.0.3 - survey_client: 1.0.0 - systemtags: 1.2.0 - theming: 1.3.0 - twofactor_backupcodes: 1.1.1 - updatenotification: 1.2.0 - workflowengine: 1.2.0 ```

Nextcloud configuration:

Config report

``` { "system": { "instanceid": "occ76c8edd49", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "datadirectory": "\/var\/www\/nextcloud\/data", "dbtype": "mysql", "version": "12.0.4.3", "dbname": "owncloud", "dbhost": "127.0.0.1", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "loglevel": 3, "logtimezone": "Europe\/Berlin", "maintenance": false, "theme": "", "appstoreenabled": true, "appstoreurl": "https:\/\/apps.nextcloud.com\/api\/v0", "trusted_domains": [ "oc.betaserv.net" ], "mail_smtpmode": "php", "mail_smtpsecure": "ssl", "secret": "***REMOVED SENSITIVE VALUE***", "forcessl": true, "memcache.local": "\\OC\\Memcache\\APCu", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "\/run\/redis\/redis.sock", "port": 0, "dbindex": 0, "timeout": 1.5 }, "appstore.experimental.enabled": true, "trashbin_retention_obligation": "auto", "updater.release.channel": "stable", "mail_from_address": "Nextcloud", "mail_domain": "", "mail_smtpauthtype": "LOGIN", "mail_smtpauth": 1, "mail_smtphost": "", "mail_smtpport": "587", "preview-libreoffice-path": "\/lib\/libreoffice\/program\/soffice", "singleuser": true, "updatechecker": true, "updater.server.url": "https:\/\/updates.nextcloud.com\/updater_server\/", "token_auth_enforced": true, "overwrite.cli.url": "https:\/\/oc.betaserv.net" } } ```

Are you using encryption: yes and no

[kwiatekk]

Hi there, I'm having recently the same problem with encrypted files with nextcloud(snap) installation with Ubuntu 18.04. Could anyone help me to overcome this problem? Where to start? Thanks in advance. Kristof

[JB1985]

I am also here because I also have the problem that not all files are decrypted, too. I also do not know how to save the data. Update to 17.0.1 and to make decrypt again?

I'm stinking why it was not documented that the decryption ist buggy.

[kwiatekk]

update oc_filecache set encrypted = 1 where fileid = ; JB1985 have you tried to type this command? Or maybe you know what to do with it?

[JB1985]

kwiatekk tell me how to find the fileid of the files that there are not yet decryptet?!

[kwiatekk]

Do not, yet I'm still fighting with that.

On Sat, 23 Nov 2019, 22:08 JB1985, notifications@github.com wrote:

kwiatekk tell me how to find the fileid of the files that there are not yet decryptet?!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/nextcloud/server/issues/8311?email_source=notifications&email_token=AJDCURBDV44QBQOBX66JS7DQVGLU3A5CNFSM4EQIGEX2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEE75WHI#issuecomment-557832989, or unsubscribe https://github.com/notifications/unsubscribe-auth/AJDCURDMPEWZLFOJKQE3HC3QVGLU3ANCNFSM4EQIGEXQ .

[JB1985]

There are some files that can not be decrypted. I have try with @yahesh decrypt-file.php but still not work.

[yahesh]

@kwiatekk @JB1985 I wouldn't advise to directly modify the database, but rather restore a backup of your server from before you tried to decrypt all files and just download the files from Nextcloud after the restore.

The encrypted database field actually isn't a boolean but an integer that also denotes the file version of an encrypted file which is relevant to calculate the MACs/"signatures" of the encrypted files. If you have to fiddle around with the database in order to rescue your encrypted files then it would be advisable to also set the encryption_skip_signature_check configuration value of your Nextcloud instance to true.

[phonon112358]

I encountered the same issue in NC 18.0.1 when following the documentation!!!

[ffs69]

Hi,

I am facing the same problem here, many of my .jpg and .txt files have become corrupted. And unfortunately I don't have a recent backup.

Is there a working solution since? I'm surprised the problem is still happening.

@yahesh is it possible and how can I use rescue/decrypt-all-files.php on a shared web hosting?

Many thanks in advance, I am in depression!

C.