Missing "Enable recovery key" field in the admin settings

Steps to reproduce

Install Nextcloud 13
Enable server-side encryption in the admin settings
Enable the app "Default encryption module"

Expected behaviour

The fields to enable recovery key should appear in the admin settings under "Encryption".

Actual behaviour

The fields to enable recovery key does not appear, hence we can not create the recovery key.

Server configuration

Operating system: Debian 9.3 (stretch)

Web server: NGINX 1.10

Database: Maria-DB 10.1.26

PHP version: PHP 7

Nextcloud version: 13

Updated from an older Nextcloud/ownCloud or fresh install: Fresh install

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:
  - activity: 2.6.1
  - comments: 1.3.0
  - dav: 1.4.6
  - encryption: 2.0.0
  - federatedfilesharing: 1.3.1
  - federation: 1.3.0
  - files: 1.8.0
  - files_pdfviewer: 1.2.0
  - files_sharing: 1.5.0
  - files_texteditor: 2.5.1
  - files_trashbin: 1.3.0
  - files_versions: 1.6.0
  - files_videoplayer: 1.2.0
  - firstrunwizard: 2.2.1
  - gallery: 18.0.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.1.0
  - nextcloud_announcements: 1.2.0
  - notifications: 2.1.2
  - oauth2: 1.1.0
  - password_policy: 1.3.0
  - provisioning_api: 1.3.0
  - serverinfo: 1.3.0
  - sharebymail: 1.3.0
  - survey_client: 1.1.0
  - systemtags: 1.3.0
  - theming: 1.4.1
  - twofactor_backupcodes: 1.2.3
  - updatenotification: 1.3.0
  - workflowengine: 1.3.0
Disabled:
  - admin_audit
  - files_external
  - user_external
  - user_ldap

Nextcloud configuration:

Config report

    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "13.0.0.14",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "log_rotate_size": "10485760",
        "log_type": "errorlog",
        "loglevel": "2",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "trashbin_retention_obligation": "auto,90",
        "activity_expire_days": 180,
        "logtimezone": "Europe\/Zurich",
        "maintenance": false

Are you using encryption: yes

Client configuration

Browser: Firefox, Vivaldi and Chrome

Operating system: Linux

Logs

nothing

@schiessle

cc @schiessle

I also have this problem;
I solved by going to the nextcloud folder from the terminal (/var/www/../nextcloud)

and typing the command:

sudo -u www-data php occ encryption:disable-master-key

done this I found the item to set the recovery key

@tigernero79

@tigernero79 thank you for the tip. Still I am not comfortable running the disable:enable-master-key command, since, according to the Nextcloud 13 documentation, it does not even exist and the enable command cannot be undone.

encryption:enable-master-key

Enable the master key. Only available
for fresh installations with no existing
encrypted data! There is also no way to
disable it again.

go to the nextcloud folder and run that command Next Log in via the web and you'll find the option to insert the Master Key

@tigernero79

@tigernero79 @CamZie I haven't tried the command either for the same reason. The docs state it is specifically only for new installations. Although, once they state new installation and once an "installation with no existing encrypted data".

do you have encrypted data? what does it have to do with new installation I have tested on my nextcloud because even I had no voice of the net after deactivation I appeared and I could create net from the web. I had no problems with data. then do what you feel but there are no problems. I did not have any. I deactivate the net, not the encrypted data. the net fill you from the web then.

@tigernero79

@tigernero79 I am not sure if I understood you correctly. I understand you ran the command and had no problems afterwards with your data.

Like @CamZie, I hesitate to run a command which does not exist according to the documentation. In fact the documentation says the encryption:enable-master-key cannot be undone.

you must enter from the terminal in your nextcloud folder type that command that you disability the Master Key done this you can enter through browser in your nextcloud and in the settings in the encryption section you will find again the possibility to re-enter the master key

If I run encryption:enable-master-key Nextcloud throws an exception because it does not find any master key in the database :/

since they are people who do not like to experiment, I have everything for them. Twice that the command to be launched via shell was with that command

sudo -u www-data php occ encryption:disable-master-key

appeared the voice in the web interfaces of nextcloud to set recovery password. only they are afraid of doing anything. what do you want to do with it?

Nextcloud 13 uses a master-key setup by default. Therefore no recovery key is needed. As long as the user can login they can access their files. Also password recovery, etc works because you encryption keys are no longer bound to the login password. If a admin needs to access the files of a user they also don't need the recovery key. They can just use the impersonate app (https://apps.nextcloud.com/apps/impersonate) to access the users files.

If you really want to go back the the old behavior, which I really don't recommend, you can do so by running sudo -u www-data php occ encryption:disable-master-key as already said. But this only works if you start with a fresh installation aka no encrypted files.

@schiessle

@schiessle
are you telling me that the recovery key makes no sense to keep it enabled? just app impersonate?

having I reintroduced in that nextcloud 13 this entry and entered the recovery key with one created by me now I have deactivated option from the encryption panel enough so or to delete the voice do I have to do anything else?

I do not understand it, there is no password area to insert any new password. Did you check my screen that I included?

See the image, no places to enter any password, there is a password column there but it is useless since no boxes appears for password underneath.

https://github.com/proxy/user-images.githubusercontent.com/8519469/47809563-2e8c6180-dd0f-11e8-8e04-cbe495360d85.jpg

Trust me I used to be able to do this before, so I actually know where and how to change the passwords and that is not possible now.

Also see this message at the top of the users screen

"
Password change is disabled because the master key is disabled
"

As you see the passwords cant be change in the ui.

try

sudo -u www-data php occ encryption:decrypt-all

Then

sudo -u www-data php occ encryption: disable-master-key

you should then have the option to recreate the user recovery key

Thanks here are the results

sudo -u www-data php occ encryption:decrypt-all
Server side encryption not enabled. Nothing to do.

sudo -u www-data php occ encryption:disable-master-key
Master key already disabled

I still get this in user panel

Password change is disabled because the master key is disabled

And I still do not have password boxes to change, so I cant change it.

I think this is a bug

try now

sudo -u www-data php occ encryption:enable-master-key

@tigernero79

@tigernero79
Thanks for the reply.

sudo -u www-data php occ encryption:enable-master-key
Warning: Only available for fresh installations with no existing encrypted data! There is also no way to disable it again. Do you want to continue? (y/n)

I have manu users and alot of data. Will I loose my existing data? I so not want to mess up my setup for myself and for my users.

@tigernero79

@tigernero79

So I made a backup and ifred the command you mentioned above. It seems to work now, I did not loose any data. Thanks for the help. I wil report any other I hit regarding this issue here.

thanks

Came here, too, because I couldnt figure out the situation.

Running a fresh installation of NC15.

Wholeheartedly upvoting a documentation update 👍
https://docs.nextcloud.com/server/15/admin_manual/configuration_files/encryption_configuration.html#enabling-users-file-recovery-keys

I followed the steps provided in this solution and they do not work for me.

I'm on Centos7 using NC15.0.4.

I have tried various ways from decrypting/disabling then encrypting/enabling but nothing seems to get my recovery keys up.

Any other methods I should try?

@gerroon

I have created a recovery key but as @gerroon mentioned I do not see password recovery option on the users page. Am I missing something? I am looking in the right place? Please help! Thank you.

SO vor NC 13 > /// Whats the Master Key? Where is it stored? How can i be save with this Key?
is it the Key within the Config File?

Does anyone have more information on where it is, so i can back it up?
Thanks!

That's why we decided to make the master key the default and strongly recommend to use the default. If you don't trust your Nextcloud admin, then end-to-end encryption is the only thing which will help.

This should find its way to the Nextcould encryption manual. Thanks!

@schiessle

I have been looking for an explanation of the encryption configuration as given by @schiessle in #8283 (comment) for the past two years! Why isn't it part of the official documentation? It should definitely be there, as proposed by @Dakavon.

Feeling lucky i found this issue thread, b/c i was following https://docs.nextcloud.com/server/24/admin_manual/configuration_files/encryption_configuration.html#enabling-users-file-recovery-keys, which is the page for nextcloud:latest but doesn't mention anywhere that the whole section only applies to Nextcloud <13 – while beginning with v13 the whole "enable recovery key"-section will not be displayed as it is not needed with the master key setup (if i understand this thread correctly).

Since v13 a lot of time has passed, shouldn't this have been added to the docs all along?

@tigernero79

hey i made
docker exec -u www-data -it nextcloud-aio-nextcloud bash -c "echo y | php occ encryption:decrypt-all"
docker exec -u www-data -it nextcloud-aio-nextcloud bash -c "echo y | php occ encryption:disable-master-key"

then i have put a recovery key
then i did
sudo -u www-data php occ encryption:enable-master-key

and recovery key settings gones again is this normal ?
Becaus if i didnt make this
sudo -u www-data php occ encryption:enable-master-key
i was not able to change account password
@tigernero79

Added docs here nextcloud/documentation#14791
Anyone, feel free to have a read and tell me if that makes sense.

Navigation Menu

Repository navigation

Missing "Enable recovery key" field in the admin settings #8283

Steps to reproduce

Expected behaviour

Actual behaviour

Server configuration

Client configuration

Logs

24 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Missing "Enable recovery key" field in the admin settings #8283

Description

Steps to reproduce

Expected behaviour

Actual behaviour

Server configuration

Client configuration

Logs

Activity

MorrisJobke commented on Feb 9, 2018

tigernero79 commented on Feb 10, 2018

CamZie commented on Feb 12, 2018

tigernero79 commented on Feb 12, 2018

TecJon commented on Feb 12, 2018

tigernero79 commented on Feb 12, 2018

TecJon commented on Feb 12, 2018

tigernero79 commented on Feb 12, 2018

bjo81 commented on Feb 27, 2018

tigernero79 commented on Feb 27, 2018

schiessle commented on Feb 28, 2018

tigernero79 commented on Feb 28, 2018

24 remaining items

gerroon commented on Nov 1, 2018

tigernero79 commented on Nov 2, 2018

gerroon commented on Nov 2, 2018

tigernero79 commented on Nov 2, 2018

gerroon commented on Nov 2, 2018

gerroon commented on Nov 4, 2018

apiraino commented on Jan 13, 2019

Hubrisious commented on Feb 19, 2019

2nutz4u commented on Apr 10, 2019

asim-vax commented on Sep 10, 2019

Dakavon commented on Apr 4, 2020

nunesgh commented on Oct 20, 2020

Philzen commented on Jun 19, 2022

NEVARLeVrai commented on Jan 14, 2025

skjnldsv commented on May 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions