ownCloud encryption migration 6.0.5 -> 9.1.1

encryption
upgrade
9.1.x
help

#1

After upgrading my very old ownCloud installation (I did not notice my distributor discontinued the package) to the latest version, I am trying to migrate my encryption module to the latest version.
I havent been using the module in my old installation for a long time, but I get log entries telling me to migrate the keys. I could not find a workaround so I want to complete the migration and disable encryption again.

However I have trouble completing the migration:
- The command described in the documentation (encryption:migrate-keys) is not available, and when enabling encryption and hitting the "start migration"-button I get this error message:
Installation is in transit between the old Encryption (ownCloud <= 8.0)\n\t\t\tand the new encryption. Please enable the \"Default encryption module\"\n\t\t\tand run 'occ encryption:migrate'
- encryption:list-modules does not return any results, so I cannot enable the default encryption module

Server configuration
Operating system: Debian Jessie
Web server: nginx 1.6.5
Database: mariadb 10.0.27
PHP version: php5-fpm 5.6.26
ownCloud version (see ownCloud admin page): 9.1.1
Updated from an older ownCloud or fresh install: Updated from 6.0.5
Special configuration (external storage, external authentication, reverse proxy, server-side-encryption): none

Integrity status for oC9+

No errors have been found.

#2

Hi,

this is due to the fact that this command is only available in oC 8.0. To go from 6.0.5 to 9.1.1 the following upgrade path would be needed:

6.0.5 -> 6.0.9 -> 7.0.15 -> 8.0.15

Then the following migration is needed (only possible with oC 8.0):

https://doc.owncloud.org/server/9.1/admin_manual/configuration_files/encryption_configuration.html#encryption-migration-to-owncloud-8-0

Afterwards you can continue:

8.0.15 -> 8.1.11

Afterwards the next migration is needed:

https://doc.owncloud.org/server/9.1/admin_manual/configuration_files/encryption_configuration.html#encryption-migration-to-owncloud-8-1

If both migrations where successfull and you can still access your files you can continue with:

8.1.11 -> 8.2.8 -> 9.0.5 -> 9.1.1

Only with this explained steps you have the chances that such an outdated versions might be successful upgraded to the latest 9.1.1.

If you have already upgraded to 9.1.1 without the two migration steps the only chance to get this working again is to revert to your oC 6.0.5 backup and then follow the steps above.


#3

Thanks for the reply!
As downgrades are not supported I suppose this will only work if I have a backup of the 6.0.5 installation I can use?


#4

Yes, unfortunately you need to go back to your 6.0.5 backup as explained above:

If you don't have that much users / files and if you don't use external storages also consider to make a backup of your files on client-side and do a fresh install of 9.1.1. Afterwards re-import the files again. This would be the cleanest way.


#5

Like you, I've been using the encryption app in OC 6 (even before) but after a number of problems only related to encryption, I decided to turn it off in OC 7. Since then it works without problems, however from that time when ownCloud was encrypted, there were still some files left which weren't properly converted. In a few cases, I had to manually delete some files (luckily it was not important and the client had an unencrypted version). Also the encryption change between OC 7 and 8 (later there is also a larger update).

If possible, I would consider a new setup because running these updates already takes much time and encryption makes it more complicated. In case you have a problem with OC 7, there is no support any more.


#6

After going through the code I figured out a (hacky) solution for this problem:
- Delete legacy entries (appid == files_encryption) in oc_appconfig
- Delete directories containing public/private keys
- Remove the (empty) user files_encryption directories

Now everything works as expected, however I am aware that this fix might have unexpected consequences and a clean solution would've been a fresh install. I think though that I did not miss anything while going through the code and so I don't anticipate any future issues.
Thanks for your help :slight_smile: