The Duplicati 2.4 release introduces key security updates to protect local backup configurations and databases. To defend against unauthorized local access, Duplicati now enforces strict data folder permission checks at startup. If a data folder has lax or unexpected permissions, Duplicati will refuse to run until the issue is resolved.

This update changes how upgraded installations and containerized environments interact with host storage.

What Changed in Version 2.4?

Previously, Duplicati attempted to silently lock down data folder permissions or allowed simple opt-out files like insecure-permissions.txt inside the data folder.

With version 2.4, security validation is stricter:

• Permission Enforcement: Duplicati requires that the data folder is strictly accessible only by the service owner.On Linux/macOS, access is restricted to the current process user; on Windows, access is limited to the running user, SYSTEM, and Administrators.

  
  

• Deprecated Opt-Outs: Legacy insecure-permissions.txt files placed inside data folders are no longer supported.

  
  

• Trusted Preload Paths: Preload configurations (preload.json) are only accepted if stored inside binary directories or explicitly designated via the DUPLICATI_PRELOAD_SETTINGS environment variable.

  
  

Who Is Affected?

While standard native installs created from scratch automatically apply correct permissions, three primary operational setups will encounter breaking changes:

How to Resolve: Fixing Permissions with ConfigureTool

For native OS installations and persistent bare-metal hosts, fixing the folder permissions directly is the recommended fix. Duplicati includes a tool to automatically re-secure data directories.

Linux / macOS:

Run the duplicati-configure CLI tool using the secure-datafolder command:

duplicati-configure secure-datafolder --data-folder /path/to/data

duplicati-configure secure-datafolder --data-folder /path/to/data

duplicati-configure secure-datafolder --data-folder /path/to/data

Windows / Windows Service:

When running as a Windows Service, execute the service executable in an elevated context to apply system-level ACLs:

Duplicati.WindowsService.exe secure-datafolder --data-folder C:\ProgramData

Duplicati.WindowsService.exe secure-datafolder --data-folder C:\ProgramData

Duplicati.WindowsService.exe secure-datafolder --data-folder C:\ProgramData

Using duplicati-server-util safely

For users that rely on duplicati-server-util, the recommended solution is to use the native secret provider to store the access password, and then securely retrieve it when invoking the server util.

To set the password, first invoke the duplicati-secret-tool to set the password, then use that when invoking the duplicati-server-util:

duplicati-secret-tool libsecret:// set duplicati-api-key
duplicati-server-util list --secret-provider=libsecret:// --password=$duplicati-api-key

For Windows, the equivalent is:

Duplicati.CommandLine.SecretTool.exe wincred:// set duplicati-api-key
Duplicati.CommandLine.ServerUtil.exe list --secret-provider=wincred:// --password=$duplicati-api-key

The options to add the secret provider and pass the password can be added to preload.json so you do not have to type it on the commandline each time:

{
  "args": {
    "serverutil": [ 
      "--secret-provider=wincred://", 
      "--password=$duplicati-api-key" 
    ]
  }
}

Bypassing Checks Safely (Container & Homelab Workarounds)

In specific environments like Docker, Unraid, or Synology NAS mounts, enforcing POSIX file permissions on host-bound mounts may not be supported by the host filesystem driver.

If adjusting permissions on the host filesystem is not feasible, bypass the check using one of two options:

• Environment Variable (Recommended for Docker):

  Add the environment variable to your docker-compose.yml or container definition:

  
  

  environment:
    - DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true

  environment:
    - DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true

  environment:
    - DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true

• CLI Startup Flag:

  Append the parameter when launching the server binary:

  
  

  duplicati-server --allow-insecure-datafolder

  duplicati-server --allow-insecure-datafolder

  duplicati-server --allow-insecure-datafolder

• Bypass marker file:

  Place an empty file named insecure-permissions.txt in the folder where the Duplicati binaries are installed.

Security Warning: Bypassing this check means unprivileged local users with host access could potentially read backup metadata or local keys. Only apply bypass flags inside isolated container environments or dedicated single-tenant (virtual) machines.