[8.2] Test plan encrypt all and decrypt all

[DeepDiver1975]

8.2 introduces occ commands to encrypt and decrypt all files for all users.

this has to be tested and verified with

• [ ❌ ] ldap with more than 1 million users ([8.2] Test plan encrypt all and decrypt all #6 (comment))
• [ ⛔ ] users with a hell of files and folders (depth 1024 and in total 100.000 files ???) (Not able to have such deep folder structure [8.2] Test plan encrypt all and decrypt all #6 (comment))

@SergioBertolinSG adds:
[ 🕓 ] Encrypt all having only 1 user with 100.000 files of 1KiB. (It takes long time, perhaps three days or so which leads us again to owncloud/core#19358 )

[schiessle]

Let me add some points:

• [ ✅ ] only decrypt for a specific user
• [ ✅ ] run the script multiple times and check that it doesn't break files ([8.2] Test plan encrypt all and decrypt all #6 (comment)) (retested with master 2015-09-25)
• [ ✅ ] run with multiple users, where some user have a recovery key and some don't have one (encrypt-all [8.2] Test plan encrypt all and decrypt all #6 (comment)) (retested with master 2015-09-25)
• [ ✅ ] run with multiple users some has encrypted files and some has already decrypted files (were blocked by Running occ encryption:decrypt-all without a username doesn't stop and warn the user. core#19327)

@SergioBertolinSG adds:

• [ ✅ ] Encrypt all for 1000 LDAP users.
• [ ✅ ] Decrypt all users having some recovery key enabled and others don't. ([8.2] Test plan encrypt all and decrypt all #6 (comment)) (retested with master 25-09-2015)

[schiessle]

Btw, known limitation. We only decrypt the payload (files in data/user/files). files in trashbin and versions are not decrypted but this shouldn't be an issue as long as the admin keep the encryption modules enabled.

Alternatively he could use the occ script to clean up the trashbins and versions

[SergioBertolinSG]

At the end of the encryption when listing the users with passwords, ldap users show the uid, not the username. I think it could be a bit confusing.

+--------------------------------------+----------------------+
| Username                             | Private key password |
+--------------------------------------+----------------------+
| admin                                | wR+emn7r             |
| b8ddc6ea-8742-1034-8cb0-39af73a96b9a | 6rcFnp+g             |
| b8dee17e-8742-1034-8cb3-39af73a96b9a | Fw2onCBX             |
| b8df1298-8742-1034-8cb4-39af73a96b9a | AeTC6Mib             |
| b8df517c-8742-1034-8cb5-39af73a96b9a | A5CQeXoS             |

[SergioBertolinSG]

@schiesbn How can I decrypt only for one user?
encryption:decrypt-all seems to decrypt everything.

[SergioBertolinSG]

When encrypting everything only admin user can login.

It says owncloud is in a single user mode.

Opened issue here owncloud/core#19213

[schiessle]

At the end of the encryption when listing the users with passwords, ldap users show the uid, not the username. I think it could be a bit confusing.

I think the problem is that LDAP users can even have multiple login names, so I don't really know what to show here... @blizzz any idea what we can/should show instead for ldap users?

We could show the display name instead of the uid. But the display name is not guaranteed to be unique.

[schiessle]

How can I decrypt only for one user?

you can call decrypt-all with a user-id as parameter, see:

$ ./occ encryption:decrypt-all --help
Usage:
 encryption:decrypt-all [user]

Arguments:
 user                  user for which you want to decrypt all files (optional)

(same "problem" as above, for LDAP users you need the ID)

[SergioBertolinSG]

After decrypting only one user's files, it has disabled encryption app.

sudo -u www-data ./occ encryption:status
  - enabled: false
  - defaultModule: OC_DEFAULT_MODULE

Also when asking for login password, it is a single user but it writes 'users' in plural.

Please enter the users login password:

It's not plural, it's missing the apostrophe in user's

[schiessle]

After decrypting only one user's files, it has disabled encryption app.

That's the intended behavior. The idea is that if you want to decrypt all you also want to disable encryption, see the description:

This will disable server-side encryption and decrypt all files for all users if it is supported by your encryption module. Please make sure that no user access his files during this process!

The main purpose of adding a specific user as parameter is to allow to disable encryption for small instances where you don't have a recovery key but know the users login password or can ask them to enter it. Maybe there is one use case in a enterprise setup, if the decryption failed at some point and you want to call it again for a specific user. But every time it is coupled with the assumption that you want to disable encryption.

[schiessle]

@cmonteroluque thanks, typo is fixed here owncloud/core#19223

[SergioBertolinSG]

@schiesbn ok, thanks.

After decrypting files for only one user, enabling again encryption and running encrypt-all it returns errors related with locked files:

is it a problem? or it a bad use of encrypt-all ?

 encrypt files for user admin (1 of 3): /admin/files/Photos/Paris.jpg 
 [->--------------------------]


  [OCP\Lock\LockedException]                         
  "Photos/Paris.jpg.encrypted.1442835845" is locked  


  [OCP\Lock\LockedException]                          
  "files/e9be9dd5048c73ae94d6d5759fde6b90" is locked  

[schiessle]

@SergioBertolinSG I can reproduce it and will look into it. This worked in the past, maybe the way locking works changed recently?

  [OCP\Lock\LockedException]                          
  "files/e9be9dd5048c73ae94d6d5759fde6b90" is locked  

also this file is really confusing. Where does it come from? The encrypt all script doesn't create such files... @PVince81 @icewind1991 any idea? Is this something locking specific?

[PVince81]

@schiesbn this is just a hash of the file path, not the real path to the file.