OCC Commands

Backup Commands

Commands related to managing backups of the passwords app database.

passwords:backup:create

This command creates a manual backup of the complete password database. Unlike automatic backups, manual backups are not deleted automatically.

Parameter	Type	Required?	Description
<name>	string	no	The name of the backup. ASCII letters only. If none is given, the current date will be used.

passwords:backup:delete

This command deletes a manually created backup.

Parameter	Type	Required?	Description
<name>	string	yes	The name of the backup to delete.

passwords:backup:restore

This command restores the given backup.

Parameter	Type	Required?	Description
<name>	string	yes	The name of the backup to restore.
--user, -u	string	no	Restore data only for the given user id.
--no-data	-	no	Do not restore user data and encryption keys. This will only restore settings.
--no-user-settings	-	no	Do not restore user settings.
--no-app-settings	-	no	Do not restore app settings.
--no-interaction	-	no	Disables all questions and assumes "yes" for every confirmation

passwords:backup:list

This command prints a list of all available backups.

Parameter	Type	Required?	Description
--details, -d	-	no	List additional details such as the version and user and item counts.

passwords:backup:export

This command exports a given backup to a file.

Parameter	Type	Required?	Description
<name>	string	yes	The name of the backup to export.
<file>	string	no	Path of the file to export the backup to. Otherwise the backup will be exported to the current directory.

passwords:backup:import

This command imports the given file as a manual backup and validates it.

Parameter	Type	Required?	Description
<file>	string	yes	The path to the file to import.

Users

passwords:user:delete

Deletes the passwords app data of a user. The command will also delete the data of any deleted user and remove the lock on the user id. After the user data has been deleted, the user id can be assigned to a new user.

Parameter	Type	Required?	Description
<user>	string	yes	The id of the user.
--no-interaction	-	no	Disables all questions and assumes "yes" for every confirmation

passwords:user:move

Moves all data from one user account to another. If the target user already has data, you will be given the option to delete that data before moving or to abort the process.

Parameter	Type	Required?	Description
<source_user>	string	yes	The id of the user whose data should be moved.
<target_user>	string	yes	The id of the user which the data should be moved to.
--no-interaction	-	no	Disables all questions and assumes "yes" for every confirmation

Debugging

passwords:system:report

Print system information as detected by the app as JSON. This is mostly helpful for debugging reasons. With ./occ passwords:system:report debug, you get the report you are supposed to attach if you're submitting a bug report.

Parameter	Type	Required?	Description
<sections>	string/string[]	no	Print a report with the given sections.
--basic, -b	-	no	Print just a basic report. This will limit available sections.

Sections

Section	Description
debug	Shortcut for "version, environment, services, status, settings, encryption".
version	App, Nextcloud and PHP version information.
environment	Server environment information, e.g. OS, database or webserver setup.
services	Services configured for the passwords app.
settings	The values of some passwords app settings.
status	Internal status information, e.g. for updates and migrations.
apps	List of selected other apps installed on the server.
sharing	Approximate count of shared items.
encryption	Information about encryption methods used.

Other

passwords:pwned-list:process

Takes the Pwned Passwords list from haveibeenpwned.com (or any list with the same structure) and converts it for the local database password security check service.

Note: This command can take a lot of RAM. You should have ~100MiB free RAM per 1 million hashes. So --size 25 would require around 2.5GiB of RAM.

Creating an update file

By default, the command will import the hashes directly into the local database, but with the --mode parameter it is also possible to create an update file with the naming schema <size>m-v<database version>-<mode>.zip. This update file can then be distributed to other Nextcloud servers by hosting it on a server and configuring the source url:

./occ config:app:set passwords passwords/localdb/source --value="https://yourdomain/yourpath/<size>m-v:version-:format.zip";
./occ config:app:set passwords passwords/localdb/version --value="0";

Parameter	Type	Required?	Description
<file>	string	no	The location of the pwnedpasswords.txt file. Defaults to pwnedpasswords.txt
--size, -s	number	no	The amount of hashes to process in millions. E.g. "25". Defaults to 25.
--mode, -m	string	no	The mode for processing the hashes. import to import the m directly, json to pack it as JSON files, gzip to pack it as compressed files or file to pack it in whichever variant is used by the current server. Defaults to import.