Release: 2.1.2.0 (Beta) 2025-08-20

[kenkendk]

@ts678

I’m not sure how much it increases security, given the two posted ways to bypass.

The two ways to “bypass” both require that you have administrator privileges.
If you have administrator privileges you are expected to be responsible or deal with the consequences.

I will argue that this is not a bypass or security risk, as elevating to administrator must be secure, or the entire system security is non-existing.

@ts678

is this blocking casual admins? Is that a good idea?

I can see arguments for and against. Arguably, it is more secure the less people have access, but preventing system admins from completing tasks is counter productive.

@ts678

Could we take the usual path, and let elevated administrators in?

That seems like a safe way to do it. I have created an issue for this.

@ts678

I asked recently.

I missed that detail.

[ts678]

@kenkendk

Arguably, it is more secure the less people have access, but preventing system admins from completing tasks is counter productive.

My “bypass” word referred to the latter, as visible in my reposted quote. It only bypasses security to the extent that the current plan adds it by impeding access by system admins.

I agree that a system admin is very powerful, and can gain access if they really want that.
icacls (on system already) is a one-line way for elevated admin to grant admin access.

I do support the idea of impediment against accidents, e.g. on Linux don’t type as root all day long. On Windows, the privilege system allows privileged programs even more power upon request, but reduces risk of accidents (and maybe attack), due to need of a request.

Reducing risk of accidental credential viewing is achieved by asterisks. Passwords might sometimes be simple words (bad idea), so memorable immediately upon accidental view.

Above is GUI accidental view where one might be working something else on the screen. Server datafolder view seems like it would require a more deliberate action to even begin.

Thanks for considering a change to allow elevated administrators in without extra hurdles. Security always has some tradeoffs, but here I’m not sure the minor gains outweigh pains.

[mezcalf]

@kenkendk

We should update the documentation when the stable release is out, but this is a way to get what you want without using PsExec:

1. Right click the folder
2. Adjust permissions to include the Administrator (or your local user)
3. Run Duplicati.CommandLine.ServerUtil.exe in the appropriate context

If you remove the file insecure-permissions.txt Duplicati will reset the folder permissions when it restarts, but you can also manually change the permissions back.

Thank you for explaining. That makes sense.

A simple bat for changing the password.

@echo off
REM --- Elevation check (must run as Administrator) ---
net session >nul 2>&1
if %errorlevel% neq 0 (
  echo This script must be run as Administrator. Requesting elevation...
  powershell -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
  exit /b
)

REM --- Variables ---
set TARGETDIR=C:\ProgramData\Duplicati
set SQLITE=%TARGETDIR%\Duplicati-server.sqlite
for /f "delims=" %%I in ('%SystemRoot%\System32\whoami.exe') do set "USER_IDENT=%%I"

REM --- Permission settings ---
icacls "%TARGETDIR%" /grant "%USER_IDENT%:(F)" >nul 2>&1
icacls "%SQLITE%" /grant "%USER_IDENT%:(F)" >nul 2>&1

REM --- Change password ---
"C:\Program Files\Duplicati 2\Duplicati.CommandLine.ServerUtil.exe" --server-datafolder "%TARGETDIR%" change-password

REM --- Restart Duplicati, restore permissions ---
net stop duplicati
net start duplicati