AES-256 encryption at rest and TLS in transit protect data across the network, but local storage is often the weakest link. Strong cloud encryption offers little defense if local malware or an unprivileged user on a shared system can read your SQLite server database, extract session tokens, or inspect backup configurations.

Duplicati guards against this local attack vector by enforcing strict Access Control Lists (ACLs) and file ownership rules on its data directory before performing any backup operations.

Why Lax Directory Permissions Are a Critical Risk

Your local Duplicati data folder contains SQLite databases, local logs, and configuration files such as preload.json. These files hold vital metadata: backup target paths, remote storage credentials, and field-level encryption settings. If directory permissions allow standard local accounts read or write access, unauthorized users can:

• Harvest target credentials: Read stored cloud access keys or API tokens.

  
  

• Tamper with backup metadata: Corrupt or manipulate local SQLite state tables, causing sync failures or compromised restores.

  
  

• Expose system topography: Map internal file structures, exclude lists, and file names.

  
  

To mitigate this, Duplicati inspects its data folder upon startup and refuses to launch if it detects overly permissive access rights.

Remediation with ConfigureTool secure-datafolder

If an existing data folder fails the permission check, usually after migrating servers or copying profiles across system accounts, you don't need to manually struggle with complex OS-level ACL commands. Duplicati includes a built-in utility designed specifically to align local directory security with strict OS best practices.

Run the following command in your terminal or command prompt:

duplicati-configure-tool secure-datafolder

duplicati-configure-tool secure-datafolder

duplicati-configure-tool secure-datafolder

(On Windows systems, invoke ConfigureTool.exe secure-datafolder.)

This utility analyzes the host environment and applies explicit boundary rules:

• Windows: Strips broad user groups, locking down ACLs strictly to the active user account running Duplicati, Administrators, and SYSTEM.

  
  

• Linux & macOS: Enforces strict 700 directory permissions and 600 file modes assigned exclusively to the owning daemon or user account.

  
  

Hardening Multi-User Environments

In multi-tenant or enterprise environments, hardening extends beyond folder permissions:

• Protecting preload.json: Ensure startup configuration files residing in the installation directory carry restricted rights so environment defaults are readable only by designated users.

  
  

• Hiding Encryption Keys from Process Scrapers: Passing --settings-encryption-key as a command-line argument leaves secrets visible to any local user running ps aux or inspecting Task Manager. Use the secret providers for sensitive values or inject sensitive keys via environment variables (e.g., SETTINGS_ENCRYPTION_KEY)

  
  

• Container Isolation: In Docker setups where host volume mounts prohibit permission modification, isolate the volume at the host level or explicitly pass DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true only within a sandboxed container environment.