Kenneth Skovhede
025f25711e
The logic is now that there is a `Service` registry key that is locked down and used to communicate with the service. The service will refuse to use the key if it does not have the correct permissions. Another key, `InstallState` is user readable and is used to keep track of what is installed with the MSI, and also communicates back if the initial password was applied.
367 lines
19 KiB
C#
367 lines
19 KiB
C#
// Copyright (C) 2026, The Duplicati Team
|
|
// https://duplicati.com, hello@duplicati.com
|
|
//
|
|
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
// copy of this software and associated documentation files (the "Software"),
|
|
// to deal in the Software without restriction, including without limitation
|
|
// the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
|
// and/or sell copies of the Software, and to permit persons to whom the
|
|
// Software is furnished to do so, subject to the following conditions:
|
|
//
|
|
// The above copyright notice and this permission notice shall be included in
|
|
// all copies or substantial portions of the Software.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
|
// DEALINGS IN THE SOFTWARE.
|
|
using System;
|
|
using System.IO;
|
|
using System.Linq;
|
|
using System.Reflection;
|
|
using System.ServiceProcess;
|
|
using Duplicati.Library.AutoUpdater;
|
|
using Duplicati.Library.Utility;
|
|
using Microsoft.Win32;
|
|
|
|
namespace Duplicati.WindowsService
|
|
{
|
|
public class Program
|
|
{
|
|
[STAThread]
|
|
public static int Main(string[] args)
|
|
{
|
|
PreloadSettingsLoader.ConfigurePreloadSettings(ref args, PackageHelper.NamedExecutable.WindowsService);
|
|
|
|
if (!OperatingSystem.IsWindows())
|
|
throw new NotSupportedException("Unsupported Operating System");
|
|
var install = args != null && args.Any(x => string.Equals("install", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only", x, StringComparison.OrdinalIgnoreCase));
|
|
var uninstall = args != null && args.Any(x => string.Equals("uninstall", x, StringComparison.OrdinalIgnoreCase));
|
|
var install_agent = args != null && args.Any(x => string.Equals("install-agent", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only-agent", x, StringComparison.OrdinalIgnoreCase));
|
|
var uninstall_agent = args != null && args.Any(x => string.Equals("uninstall-agent", x, StringComparison.OrdinalIgnoreCase));
|
|
var reset_password = args != null && args.Any(x => string.Equals("reset-password", x, StringComparison.OrdinalIgnoreCase));
|
|
var install_certs = args != null && args.Any(x => string.Equals("install-certs", x, StringComparison.OrdinalIgnoreCase));
|
|
var remove_certs = args != null && args.Any(x => string.Equals("remove-certs", x, StringComparison.OrdinalIgnoreCase));
|
|
var set_init_password = args != null && args.Any(x => string.Equals("set-init-password", x, StringComparison.OrdinalIgnoreCase));
|
|
var lock_key = args != null && args.Any(x => string.Equals("lock-service-key", x, StringComparison.OrdinalIgnoreCase));
|
|
var help = args != null && HelpOptionExtensions.IsArgumentAnyHelpString(args);
|
|
|
|
if (help)
|
|
{
|
|
Console.WriteLine("This is a Windows Service wrapper tool that hosts the Duplicati.Server.exe process, letting it run as a windows service.");
|
|
Console.WriteLine("|To run from a console, run the Duplicati.Server.exe instead of Duplicati.WindowsService.exe");
|
|
Console.WriteLine();
|
|
Console.WriteLine("Supported commands (Must be run as Administrator):");
|
|
Console.WriteLine(" install:\r\n Installs and starts the service");
|
|
Console.WriteLine(" install-only:\r\n Installs the service");
|
|
Console.WriteLine(" uninstall:\r\n Uninstalls the service");
|
|
Console.WriteLine(" install-agent:\r\n Installs and starts the agent service");
|
|
Console.WriteLine(" install-only-agent:\r\n Installs the agent service");
|
|
Console.WriteLine(" uninstall-agent:\r\n Uninstalls the agent service");
|
|
Console.WriteLine(" reset-password:\r\n Sets a new API password and restarts the service");
|
|
Console.WriteLine(" install-certs:\r\n Generates and installs TLS certificates, then restarts the service");
|
|
Console.WriteLine(" remove-certs:\r\n Removes TLS certificates, then restarts the service");
|
|
Console.WriteLine(" set-init-password:\r\n Sets the initial API password (if not already set), then restarts the service");
|
|
Console.WriteLine(" lock-service-key:\r\n Recreates the hardened Duplicati service registry key");
|
|
Console.WriteLine();
|
|
Console.WriteLine("It is possible to pass arguments to Duplicati.Server.exe, simply add them to the commandline:");
|
|
Console.WriteLine(" Duplicati.WindowsService.exe install --webservice-interface=loopback --log-retention=3M");
|
|
Console.WriteLine();
|
|
Console.WriteLine("To see supported options, run Duplicati.Server.exe:");
|
|
Console.WriteLine(" Duplicati.Server.exe help");
|
|
Console.WriteLine();
|
|
Console.WriteLine("To debug the WindowsService setup, add the --debug-service:");
|
|
Console.WriteLine(" Duplicati.WindowsService.exe install --debug-service");
|
|
}
|
|
else if (install || uninstall)
|
|
{
|
|
// Remove the install and uninstall flags if they are present
|
|
var commandline = Library.Utility.Utility.WrapAsCommandLine(args.Where(x => !(string.Equals("install", x, StringComparison.OrdinalIgnoreCase) || string.Equals("uninstall", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only", x, StringComparison.OrdinalIgnoreCase))).ToArray());
|
|
var selfexec = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "Duplicati.WindowsService.exe");
|
|
|
|
// --uninstall + --install = reinstall
|
|
if (uninstall)
|
|
{
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service stop failed, a reboot may be required. Exception: {0}", ex.Message);
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.DeleteService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Duplicati service delete succeeded.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service delete failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
if (install)
|
|
{
|
|
//The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\my share\myservice.exe" should be specified as ""d:\my share\myservice.exe"".
|
|
//The path can also include arguments for an auto-start service. For example, "d:\myshare\myservice.exe arg1 arg2". These arguments are passed to the service entry point (typically the main function).
|
|
try
|
|
{
|
|
ServiceInstaller.InstallService(ServiceControl.SERVICE_NAME, ServiceControl.DISPLAY_NAME, ServiceControl.SERVICE_DESCRIPTION, "\"" + selfexec + "\"" + " SERVER " + commandline);
|
|
Console.WriteLine("Duplicati service installation succeeded.");
|
|
if (!args.Any(x => string.Equals("install-only", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Duplicati service started.");
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service installation failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
else if (install_agent || uninstall_agent)
|
|
{
|
|
// Remove the install and uninstall flags if they are present
|
|
var commandline = Library.Utility.Utility.WrapAsCommandLine(
|
|
args.Where(x => !(string.Equals("install-agent", x, StringComparison.OrdinalIgnoreCase) || string.Equals("uninstall-agent", x, StringComparison.OrdinalIgnoreCase) || string.Equals("install-only-agent", x, StringComparison.OrdinalIgnoreCase)))
|
|
.Prepend("run")
|
|
);
|
|
var selfexec = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), "Duplicati.WindowsService.exe");
|
|
|
|
// --uninstall + --install = reinstall
|
|
if (uninstall_agent)
|
|
{
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME_AGENT);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service stop failed, a reboot may be required. Exception: {0}", ex.Message);
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.DeleteService(ServiceControl.SERVICE_NAME_AGENT);
|
|
Console.WriteLine("Duplicati service delete succeeded.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati service delete failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
if (install_agent)
|
|
{
|
|
//The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, "d:\my share\myservice.exe" should be specified as ""d:\my share\myservice.exe"".
|
|
//The path can also include arguments for an auto-start service. For example, "d:\myshare\myservice.exe arg1 arg2". These arguments are passed to the service entry point (typically the main function).
|
|
try
|
|
{
|
|
ServiceInstaller.InstallService(ServiceControl.SERVICE_NAME_AGENT, ServiceControl.DISPLAY_NAME_AGENT, ServiceControl.SERVICE_DESCRIPTION_AGENT, "\"" + selfexec + "\"" + " AGENT " + commandline);
|
|
Console.WriteLine("Duplicati agent service installation succeeded.");
|
|
if (!args.Any(x => string.Equals("install-only-agent", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME_AGENT);
|
|
Console.WriteLine("Duplicati agent service started.");
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Duplicati agent service installation failed. Exception: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
}
|
|
else if (set_init_password)
|
|
{
|
|
// Used by the MSI installer to atomically:
|
|
// 1. Wipe the entire Service subkey
|
|
// 2. Recreate the Service key with the locked-down DACL
|
|
// 3. Write InitPassword into the just-created key
|
|
// handle in the same process, before any other
|
|
// thread/process can see the key exist.
|
|
|
|
var password = Environment.GetEnvironmentVariable("DUPLICATI__INIT_PASSWORD");
|
|
Environment.SetEnvironmentVariable("DUPLICATI__INIT_PASSWORD", null);
|
|
|
|
if (string.IsNullOrWhiteSpace(password))
|
|
{
|
|
Console.WriteLine("Refusing to set init password: DUPLICATI__INIT_PASSWORD environment variable is not set.");
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.INIT_REGISTRY_VALUE, password, RegistryValueKind.String);
|
|
|
|
Console.WriteLine("Init password written to locked-down service registry key.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to write init password: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
else if (lock_key)
|
|
{
|
|
try
|
|
{
|
|
ServiceRegistryKey.RecreateLockedDown();
|
|
Console.WriteLine("Service registry key recreated locked down.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to lock down service registry key: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
}
|
|
else if (reset_password)
|
|
{
|
|
var password = Utility.ReadSecretFromConsole("Enter new password (leave empty to auto-generate): ");
|
|
|
|
if (string.IsNullOrEmpty(password))
|
|
{
|
|
password = GenerateRandomPassword(32);
|
|
Console.WriteLine("Generated password: {0}", password);
|
|
}
|
|
else
|
|
{
|
|
var confirm = Utility.ReadSecretFromConsole("Confirm password: ");
|
|
if (password != confirm)
|
|
{
|
|
Console.WriteLine("Passwords do not match.");
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
try
|
|
{
|
|
// Create a locked-down key before we restart the service
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.RESET_REGISTRY_VALUE, password, RegistryValueKind.String);
|
|
|
|
Console.WriteLine("Password written to registry.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to write password to registry: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service stopped.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to stop service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service started.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to start service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine("Password reset complete.");
|
|
}
|
|
else if (install_certs || remove_certs)
|
|
{
|
|
var val = install_certs ? "install" : "uninstall";
|
|
try
|
|
{
|
|
// Create a locked-down key before we restart the service
|
|
using (var key = ServiceRegistryKey.RecreateLockedDown())
|
|
key.SetValue(ServiceControl.TLS_CERTS_REGISTRY_VALUE, val, RegistryValueKind.String);
|
|
|
|
Console.WriteLine($"TLS certs mode '{val}' written to registry.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine($"Failed to write TLS certs mode to registry: {ex.Message}");
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StopService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service stopped.");
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to stop service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
try
|
|
{
|
|
ServiceInstaller.StartService(ServiceControl.SERVICE_NAME);
|
|
Console.WriteLine("Service started. Waiting for TLS certs operation to complete...");
|
|
|
|
// Poll registry up to 15 seconds to ensure the service processed the command
|
|
using (var view = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64))
|
|
{
|
|
for (int i = 0; i < 30; i++)
|
|
{
|
|
using (var key = view.OpenSubKey(ServiceControl.INIT_REGISTRY_KEY, writable: false))
|
|
{
|
|
if (key == null || key.GetValue(ServiceControl.TLS_CERTS_REGISTRY_VALUE) == null)
|
|
break;
|
|
}
|
|
System.Threading.Thread.Sleep(500);
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Console.WriteLine("Failed to start service: {0}", ex.Message);
|
|
return 1;
|
|
}
|
|
|
|
Console.WriteLine("TLS certs operation complete.");
|
|
}
|
|
else
|
|
{
|
|
if (args != null && args.Take(1).Any(x => string.Equals("agent", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
args = args.Skip(1).ToArray();
|
|
ServiceBase.Run([new ServiceControl(args, PackageHelper.NamedExecutable.Agent)]);
|
|
}
|
|
else if (args != null && args.Take(1).Any(x => string.Equals("server", x, StringComparison.OrdinalIgnoreCase)))
|
|
{
|
|
args = args.Skip(1).ToArray();
|
|
ServiceBase.Run([new ServiceControl(args, PackageHelper.NamedExecutable.Server)]);
|
|
}
|
|
else
|
|
{
|
|
// Legacy install fallback
|
|
ServiceBase.Run([new ServiceControl(args, PackageHelper.NamedExecutable.Server)]);
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/// <summary>
|
|
/// Generates a cryptographically random alphanumeric password.
|
|
/// </summary>
|
|
private static string GenerateRandomPassword(int length)
|
|
=> System.Security.Cryptography.RandomNumberGenerator.GetString("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", length);
|
|
}
|
|
}
|