Corporate Nextcloud Security Gaps: Default Settings, Antivirus Failures and Open Source Integration Challenges
A detailed analysis from K2Tech reveals that corporate Nextcloud deployments require extensive security hardening beyond default open source configurations. The article examines integration with LDAP, WAF, Anti-DDoS and multiple antivirus engines including ClamAV, Kaspersky Scan Engine and PT Sandbox over ICAP. Critical issues include antivirus plugins bypassing scans during unreachable states or chunked file uploads via MOVE commands, allowing infected files to reach S3 storage. Performance tests on identical 4 vCPU and 16 GB RAM hardware showed Kaspersky Scan Engine delivering the highest throughput while PT Sandbox imposed heavy CPU loads. The piece also covers architecture spanning MariaDB Galera, Redis, Elasticsearch and multi-AZ S3, plus the need for custom parameter tuning and continuous testing due to frequent Nextcloud releases. Overall, the report emphasizes that true corporate-grade security for open source file sharing demands significant post-installation effort and monitoring.
HabrJul 24, 2026Translated from Russian