Kenneth Skovhede
a7ef8e42f2
This PR is a security hardning change and will break some setups. The hardning is done to ensure the datafolder is not compromised and particularly that it is not maliciously seeded. The changes now **requires** that the datafolder is locked down with exact permissions, or Duplicati will refuse to use it. This is a change to prior functionality where the folder would simply be locked down if it was not already locked. Previously, a file named `insecure-permissions.txt` could be placed in the folder to instruct Duplicati not to set permissions. With this change that file is no longer supported. The only way to opt-out of the permission check is to supply `--allow-insecure-datafolder` or the environment variable `DUPLICATI__ALLOW_INSECURE_DATAFOLDER`. Once either of those are set, Duplicati will no longer check permissions and accept folders with other permissions. The setting can be applied to `preload.json`, but the file needs to be in a trusted location, which is either the directory with the binaries or the file pointed to by `DUPLICATI_PRELOAD_SETTINGS`. The setting cannot be placed in a `preload.json` file that is in an insecure folder as the folder is not read if the permissions are not correct. The previous paths `/usr/local/share/Duplicati/preload.json` and `C:\ProgramData\Duplicati\preload.json` are no longer supported as they cannot be guaranteed to be locked down. A `preload.json` in the datafolder is still supported, provided the folder passes the permission check (or the `--allow-insecure-datafolder` is passed to the executable). For most users, this should not cause any problems as Duplicati has been locking down the folders, so they should be correctly locked down already. The configuretool has been updated with a `secure-datafolder` command that can be used to force the correct permissions on a folder, in case the folder did not have the correct permissions. For some Docker setups it may not be possible to set the permissions and the check will fail. These setup will need to apply `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true` in the image to run without the protections.
423 lines
22 KiB
C#
423 lines
22 KiB
C#
// Copyright (C) 2026, The Duplicati Team
|
|
// https://duplicati.com, hello@duplicati.com
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
// copy of this software and associated documentation files (the "Software"),
|
|
// to deal in the Software without restriction, including without limitation
|
|
// the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
// and/or sell copies of the Software, and to permit persons to whom the
|
|
// Software is furnished to do so, subject to the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included in
|
|
// all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
|
// DEALINGS IN THE SOFTWARE.
|
|
using System;
|
|
using System.IO;
|
|
using System.Linq;
|
|
using System.Reflection;
|
|
using System.ServiceProcess;
|
|
using Duplicati.Library.AutoUpdater;
|
|
using Duplicati.Library.Utility;
|
|
using Microsoft.Win32;
|
|
|
|
namespace Duplicati.WindowsService
|
|
{
|
|
public class Program
|
|
{
|
|
[STAThread]
|
|
public static int Main(string[] args)
|
|
{
|
|
PreloadSettingsLoader.ConfigurePreloadSettings(ref args, PackageHelper.NamedExecutable.WindowsService);
|
|
|
|
if (!OperatingSystem.IsWindows())
|
|
throw new NotSupportedException("Unsupported Operating System");
|
|
var install = args != null && args.Any(x => string.Equals("install", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only", x, StringComparison.OrdinalIgnoreCase));
|
|
var uninstall = args != null && args.Any(x => string.Equals("uninstall", x, StringComparison.OrdinalIgnoreCase));
|
|
var install_agent = args != null && args.Any(x => string.Equals("install-agent", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only-agent", x, StringComparison.OrdinalIgnoreCase));
|
|
var uninstall_agent = args != null && args.Any(x => string.Equals("uninstall-agent", x, StringComparison.OrdinalIgnoreCase));
|
|
var reset_password = args != null && args.Any(x => string.Equals("reset-password", x, StringComparison.OrdinalIgnoreCase));
|
|
var install_certs = args != null && args.Any(x => string.Equals("install-certs", x, StringComparison.OrdinalIgnoreCase));
|
|
var remove_certs = args != null && args.Any(x => string.Equals("remove-certs", x, StringComparison.OrdinalIgnoreCase));
|
|
var set_init_password = args != null && args.Any(x => string.Equals("set-init-password", x, StringComparison.OrdinalIgnoreCase));
|
|
var lock_key = args != null && args.Any(x => string.Equals("lock-service-key", x, StringComparison.OrdinalIgnoreCase));
|
|
var secure_datafolder = args != null && args.Any(x => string.Equals("secure-datafolder", x, StringComparison.OrdinalIgnoreCase));
|
|
var help = args != null && HelpOptionExtensions.IsArgumentAnyHelpString(args);
|
|
|
|
if (help)
|
|
{
|
|
Console.WriteLine("This is a Windows Service wrapper tool that hosts the Duplicati.Server.exe process, letting it run as a windows service.");
|
|
Console.WriteLine("|To run from a console, run the Duplicati.Server.exe instead of Duplicati.WindowsService.exe");
|
|
Console.WriteLine();
|
|
Console.WriteLine("Supported commands (Must be run as Administrator):");
|
|
Console.WriteLine(" install:\r\n Installs and starts the service");
|
|
Console.WriteLine(" install-only:\r\n Installs the service");
|
|
Console.WriteLine(" uninstall:\r\n Uninstalls the service");
|
|
Console.WriteLine(" install-agent:\r\n Installs and starts the agent service");
|
|
Console.WriteLine(" install-only-agent:\r\n Installs the agent service");
|
|
Console.WriteLine(" uninstall-agent:\r\n Uninstalls the agent service");
|
|
Console.WriteLine(" reset-password:\r\n Sets a new API password and restarts the service");
|
|
Console.WriteLine(" install-certs:\r\n Generates and installs TLS certificates, then restarts the service");
|
|
Console.WriteLine(" remove-certs:\r\n Removes TLS certificates, then restarts the service");
|
|
Console.WriteLine(" set-init-password:\r\n Sets the initial API password (if not already set), then restarts the service");
|
|
Console.WriteLine(" lock-service-key:\r\n Recreates the hardened Duplicati service registry key");
|
|
Console.WriteLine(" secure-datafolder:\r\n Restricts the permissions on the data folder to SYSTEM and Administrators only, then restarts the service");
|
|
Console.WriteLine();
|
|
Console.WriteLine("It is possible to pass arguments to Duplicati.Server.exe, simply add them to the commandline:");
|
|
Console.WriteLine(" Duplicati.WindowsService.exe install --webservice-interface=loopback --log-retention=3M");
|
|
Console.WriteLine();
|
|
Console.WriteLine("To see supported options, run Duplicati.Server.exe:");
|
|
Console.WriteLine(" Duplicati.Server.exe help");
|
|
Console.WriteLine();
|
|
Console.WriteLine("To debug the WindowsService setup, add the --debug-service:");
|
|
Console.WriteLine(" Duplicati.WindowsService.exe install --debug-service");
|
|
}
|
|
else if (install || uninstall)
|
|
{
|
|
// Remove the install and uninstall flags if they are present
|
|
var commandline = Library.Utility.Utility.WrapAsCommandLine(args.Where(x => !(string.Equals("install", x, StringComparison.OrdinalIgnoreCase) || string.Equals("uninstall", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only", x, StringComparison.OrdinalIgnoreCase))).ToArray());
|
|
var selfexec = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "Duplicati.WindowsService.exe");
|
|
|
|
// --uninstall + --install = reinstall
|
|
if (uninstall)
|
|
{
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service stop failed, a reboot may be required. Exception: {0}", ex.Message);
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.DeleteService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Duplicati service delete succeeded.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service delete failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
if (install)
|
|
{
|
|
//The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\my share\myservice.exe" should be specified as ""d:\my share\myservice.exe"".
|
|
//The path can also include arguments for an auto-start service. For example, "d:\myshare\myservice.exe arg1 arg2". These arguments are passed to the service entry point (typically the main function).
|
|
try
|
|
{
|
|
ServiceInstaller.InstallService(ServiceControl.SERVICE_NAME, ServiceControl.DISPLAY_NAME, ServiceControl.SERVICE_DESCRIPTION, "\"" + selfexec + "\"" + " SERVER " + commandline);
|
|
Console.WriteLine("Duplicati service installation succeeded.");
|
|
if (!args.Any(x => string.Equals("install-only", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Duplicati service started.");
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service installation failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
else if (install_agent || uninstall_agent)
|
|
{
|
|
// Remove the install and uninstall flags if they are present
|
|
var commandline = Library.Utility.Utility.WrapAsCommandLine(
|
|
args.Where(x => !(string.Equals("install-agent", x, StringComparison.OrdinalIgnoreCase) || string.Equals("uninstall-agent", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only-agent", x, StringComparison.OrdinalIgnoreCase)))
|
|
.Prepend("run")
|
|
);
|
|
var selfexec = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "Duplicati.WindowsService.exe");
|
|
|
|
// --uninstall + --install = reinstall
|
|
if (uninstall_agent)
|
|
{
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME_AGENT);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service stop failed, a reboot may be required. Exception: {0}", ex.Message);
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.DeleteService(ServiceControl.SERVICE_NAME_AGENT);
|
|
Console.WriteLine("Duplicati service delete succeeded.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service delete failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
if (install_agent)
|
|
{
|
|
//The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\my share\myservice.exe" should be specified as ""d:\my share\myservice.exe"".
|
|
//The path can also include arguments for an auto-start service. For example, "d:\myshare\myservice.exe arg1 arg2". These arguments are passed to the service entry point (typically the main function).
|
|
try
|
|
{
|
|
ServiceInstaller.InstallService(ServiceControl.SERVICE_NAME_AGENT, ServiceControl.DISPLAY_NAME_AGENT, ServiceControl.SERVICE_DESCRIPTION_AGENT, "\"" + selfexec + "\"" + " AGENT " + commandline);
|
|
Console.WriteLine("Duplicati agent service installation succeeded.");
|
|
if (!args.Any(x => string.Equals("install-only-agent", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME_AGENT);
|
|
Console.WriteLine("Duplicati agent service started.");
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati agent service installation failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
else if (set_init_password)
|
|
{
|
|
// Used by the MSI installer to atomically:
|
|
// 1. Wipe the entire Service subkey
|
|
// 2. Recreate the Service key with the locked-down DACL
|
|
// 3. Write InitPassword into the just-created key
|
|
// handle in the same process, before any other
|
|
// thread/process can see the key exist.
|
|
|
|
var password = Environment.GetEnvironmentVariable("DUPLICATI__INIT_PASSWORD");
|
|
Environment.SetEnvironmentVariable("DUPLICATI__INIT_PASSWORD", null);
|
|
|
|
if (string.IsNullOrWhiteSpace(password))
|
|
{
|
|
Console.WriteLine("Refusing to set init password: DUPLICATI__INIT_PASSWORD environment variable is not set.");
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.INIT_REGISTRY_VALUE, password, RegistryValueKind.String);
|
|
|
|
Console.WriteLine("Init password written to locked-down service registry key.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to write init password: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
else if (lock_key)
|
|
{
|
|
try
|
|
{
|
|
ServiceRegistryKey.RecreateLockedDown();
|
|
Console.WriteLine("Service registry key recreated locked down.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to lock down service registry key: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
else if (secure_datafolder)
|
|
{
|
|
try
|
|
{
|
|
// Create a locked-down key before we restart the service
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.SECURE_DATAFOLDER_REGISTRY_VALUE, "apply", RegistryValueKind.String);
|
|
|
|
Console.WriteLine("Secure-datafolder instruction written to registry.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine($"Failed to write secure-datafolder instruction to registry: {ex.Message}");
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service stopped.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to stop service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service started. Waiting for secure-datafolder operation to complete...");
|
|
|
|
// Poll registry up to 30 seconds to ensure the service processed the command
|
|
using (var view = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64))
|
|
{
|
|
for (int i = 0; i < 30; i++)
|
|
{
|
|
using (var key = view.OpenSubKey(ServiceControl.INIT_REGISTRY_KEY, writable: false))
|
|
{
|
|
if (key == null || key.GetValue(ServiceControl.SECURE_DATAFOLDER_REGISTRY_VALUE) == null)
|
|
break;
|
|
}
|
|
System.Threading.Thread.Sleep(TimeSpan.FromSeconds(1));
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to start service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine("Secure-datafolder operation complete.");
|
|
}
|
|
else if (reset_password)
|
|
{
|
|
var password = Utility.ReadSecretFromConsole("Enter new password (leave empty to auto-generate): ");
|
|
|
|
if (string.IsNullOrEmpty(password))
|
|
{
|
|
password = GenerateRandomPassword(32);
|
|
Console.WriteLine("Generated password: {0}", password);
|
|
}
|
|
else
|
|
{
|
|
var confirm = Utility.ReadSecretFromConsole("Confirm password: ");
|
|
if (password != confirm)
|
|
{
|
|
Console.WriteLine("Passwords do not match.");
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
try
|
|
{
|
|
// Create a locked-down key before we restart the service
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.RESET_REGISTRY_VALUE, password, RegistryValueKind.String);
|
|
|
|
Console.WriteLine("Password written to registry.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to write password to registry: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service stopped.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to stop service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service started.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to start service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine("Password reset complete.");
|
|
}
|
|
else if (install_certs || remove_certs)
|
|
{
|
|
var val = install_certs ? "install" : "uninstall";
|
|
try
|
|
{
|
|
// Create a locked-down key before we restart the service
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.TLS_CERTS_REGISTRY_VALUE, val, RegistryValueKind.String);
|
|
|
|
Console.WriteLine($"TLS certs mode '{val}' written to registry.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine($"Failed to write TLS certs mode to registry: {ex.Message}");
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service stopped.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to stop service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service started. Waiting for TLS certs operation to complete...");
|
|
|
|
// Poll registry up to 15 seconds to ensure the service processed the command
|
|
using (var view = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64))
|
|
{
|
|
for (int i = 0; i < 30; i++)
|
|
{
|
|
using (var key = view.OpenSubKey(ServiceControl.INIT_REGISTRY_KEY, writable: false))
|
|
{
|
|
if (key == null || key.GetValue(ServiceControl.TLS_CERTS_REGISTRY_VALUE) == null)
|
|
break;
|
|
}
|
|
System.Threading.Thread.Sleep(500);
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to start service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine("TLS certs operation complete.");
|
|
}
|
|
else
|
|
{
|
|
if (args != null && args.Take(1).Any(x => string.Equals("agent", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
args = args.Skip(1).ToArray();
|
|
ServiceBase.Run([new ServiceControl(args, PackageHelper.NamedExecutable.Agent)]);
|
|
}
|
|
else if (args != null && args.Take(1).Any(x => string.Equals("server", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
args = args.Skip(1).ToArray();
|
|
ServiceBase.Run([new ServiceControl(args, PackageHelper.NamedExecutable.Server)]);
|
|
}
|
|
else
|
|
{
|
|
// Legacy install fallback
|
|
ServiceBase.Run([new ServiceControl(args, PackageHelper.NamedExecutable.Server)]);
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Generates a cryptographically random alphanumeric password.
|
|
/// </summary>
|
|
private static string GenerateRandomPassword(int length)
|
|
=> System.Security.Cryptography.RandomNumberGenerator.GetString("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", length);
|
|
}
|
|
}
|