Hardened Syncovery 12.10 Release Notes

Syncovery 12.10 is a security release. We have reviewed every way in which Syncovery can be reached or controlled: the web GUI, the cloud sign-ins, TLS connections, the communication between the Windows service and the program, the Linux daemon, and the way jobs start external programs and scripts. Each of them has been hardened. Web GUI passwords are stored as salted hashes, sessions expire, logins from the Internet always need a second factor (now also with an authenticator app), certificate checks can no longer be switched off globally, and the bundled third-party components are up to date. New installations are secure by default: there is no default password, and the configuration gets restricted permissions from the start. Existing installations are updated with as little disruption as possible, but some setups that other users of the same computer or network could misuse are now refused, or need a decision by the administrator.

Before you update: changes that may affect existing setups

The most important points are summarised here; the complete list is in 3. Behaviour changes below.

If you have problems logging into the web GUI, please see our new Web GUI Login Help page.
Linux and NAS devices, Syncovery running as root: Syncovery no longer uses a configuration that other users can change. “Configuration for all users” is switched off, root takes over the configuration folder and sets it to 0700 (files 0600). The folder’s name must contain “Syncovery” (for example /root/.SyncoveryRoot), and a configuration in a shared folder such as /tmp is refused. If the configuration cannot be secured, no jobs run and an error is shown. Scripts started by jobs must belong to root and must not be writable by others, and external commands are limited to an allow-list. Where possible, consider running the service under its own account (new: Program Settings > “Service Account…”).
Web GUI login from the computer itself: when Syncovery runs as root (Linux, macOS, NAS), and on Windows when it runs as a service, elevated or with a protected configuration, the web GUI always requires a login, also from localhost, so that other users of the computer cannot use the web GUI with root or administrator rights.
Windows, scheduler running as a service: limited users who may not edit the configuration can no longer start, stop or control jobs in the service, and only administrators can change jobs that run programs or scripts through the service. Existing installations keep their configuration folder permissions until an administrator chooses “Harden” in the new security review (Program Settings > Security); Syncovery shows a warning until then. After “Harden”, only elevated administrators can change the configuration. If non-administrators need to keep editing jobs, add them as trusted editors in the security review.
Web GUI rights: only administrators can change scripts, Execute Before/After, run-as settings, the log folder, the rclone and gcloud settings, and user accounts.
No default web GUI password: after an update without a stored password, create the login on the “Create the Login” page.
Scripts and integrations that use the web GUI interface must send logins as a POST form body and the session token in the X-Syncovery-Token header.
rclone is started only from a folder that only administrators (or the account Syncovery runs as) can change, for example next to Syncovery.
Linux, service running under another account: sudo SyncoveryCL (for example to run a job from the command line) also switches to the service account; jobs no longer run as root this way. For jobs that need root, use a separate root configuration given with /INI=.
Linux: a web GUI address of localhost now really means this computer only, and automatic updates need signed version information.

1. Security

Web GUI login and sessions

Passwords and login codes are sent only in the body of POST requests, never in the address. The session token travels in a request header; links built by the server use single-use tickets valid for 60 seconds.
Web GUI passwords are stored as salted PBKDF2-SHA256 hashes (600,000 iterations) and compared in constant time; older hashes are upgraded at the next successful login.
Failed logins are limited per login name and per client address (10 per 15 minutes, with increasing delays).
Sessions end after 12 hours without use and after 7 days at most, and at once when the login’s password or rights change or the login is removed.
Stored passwords (connections, e-mail, database server, ZIP, accounts and more) are never sent to the browser; the eye icon shows one value on explicit request, only to users allowed to change it. Read-only logins can no longer change shared storage accounts or download the configuration.
There is no default web GUI password any more. The old default login is no longer accepted; a new installation shows a “Create the Login” page instead.
The first login can be created from this computer at any time, and from the local network only within 60 minutes after the web server starts. From the Internet it needs the recovery password.
When the first login is created on the computer itself, the page shows the account Syncovery runs as and the addresses it listens on, and offers “Listen on this computer only” and “Require a login from this computer too”.
Protection against DNS rebinding: access from this computer without a login, and the first-login page from the local network, require that the browser addresses the device by its IP address, its own name or a local-only name (such as .local). For other names the page links to the IP address. Requests through a proxy never count as coming from this computer, and the temporary preview server needs a valid token from other computers.
The fixed recovery password is gone; login recovery works only through a file written into a protected recovery folder. The recovery password works only once and only for setting a new login; it is forgotten as soon as a new login is saved. Recovery with user management on now sets or creates an administrator account.
Login recovery files on NAS shares and on Linux are only accepted from folders that other users cannot change, and are created safely (no symbolic links followed). Works on Synology without root, including DSM folder ACLs.
Rights are checked on every remaining web GUI function: job export, preview, logs, scheduler start/stop, storage account passwords, imports, certificates, TLS settings and more follow the user’s rights; a few functions that worked without a valid session now require one.
Only administrators can manage user accounts; the separate right “can edit users” is gone. Accounts that had it are listed once in WebGUI.log.
Only administrators can change Execute Before/After, the run-as user and password, job and global PascalScripts, the log folder, and the rclone and gcloud program paths. Other users see these settings read-only.
The web GUI menu, toolbar and double-click actions now match the rights the server grants.
Passwords, codes and tokens no longer appear in web GUI logs and request logs; session tokens are shown only as a short hash, and WebGUI.log records when a session opens and logs out. Permanent API tokens are stored only as SHA-256 hashes (existing entries are converted automatically) and compared in constant time.
A web GUI password set with SyncoveryCL SET /WEBPASS= is stored as a hash, and SET /WEBSERVER= no longer sets a default password. New passwords need at least 8 characters and must not be trivial or equal to the user name; logins with shorter passwords are asked to change them.
Stored values (job names, paths, account names, e-mail addresses) are encoded everywhere they are shown in the web GUI, the preview page and the status pages.
Security headers on every reply (Content-Security-Policy, X-Frame-Options, nosniff, Referrer-Policy and others); error replies no longer contain internal details; unauthenticated requests get 401, unsupported methods 405, and cross-origin requests are accepted only from the GUI’s own origin.
“Enforce TLS” now really closes the plain HTTP port for other computers (redirect for page requests, refusal for everything else).
Job import files are limited to the supported file types and removed after the import; settings imports are refused from public Internet addresses. File and log downloads cannot leave the web GUI and log folders (path traversal), and symbolic links and junctions inside them are not served.
The progress window “in the browser” uses a view-only link for that one job, which can only be opened on this computer.

Two-step verification

Second factor for web GUI logins: an e-mailed code or, new, an authenticator app (TOTP, set up with a QR code). Codes are single-use and limited in time and attempts; trusted public addresses and reverse proxies can be configured.
Login codes go to the e-mail address of the login that signs in (the admin login, the read-only login, or the user account’s own address), and only over TLS.
Logins from public Internet addresses always need a second factor, also the read-only login.
Replacing or removing an authenticator app needs a valid code from the current app; changes are logged with the client address.
New on Linux and macOS: sudo SyncoveryCL SETUP2FA sets up the second factor in the terminal, for servers reachable only from the Internet.
Authenticator secrets and the second-factor SMTP password are stored under the machine key.

OAuth and TLS

Google Drive and Google Cloud Storage sign-in uses a random, single-use state value and PKCE (S256). The local callback listens on 127.0.0.1 only, on a random port, and closes after the sign-in, on cancel or after 10 minutes. The relay used for some other cloud sign-ins only hands out a code for the matching sign-in attempt.
Web GUI on a NAS or server: after signing in with Google in a browser on another computer, you can paste the final 127.0.0.1 address into Syncovery.
Authorization codes, tokens, client secrets and Authorization headers are masked in all logs.
Certificate verification can no longer be switched off globally. For SSL-inspection firewalls an administrator can name a trusted CA file.
OpenSSL security level 2 by default; it can be lowered only for your own FTP, WebDAV and HTTP servers.
Cloud APIs never accept a certificate automatically (“accept all”, “self-signed”, /ACCEPTSERVER and job scripts do not apply).
Amazon S3 and Azure public endpoints always get a strict certificate check.
Accepted certificates are remembered for that host and port only (SHA-256); “accept all” and “accept self-signed” no longer store anything.
Notification e-mails, SMTP/POP3, implicit FTPS, SecureBlackbox connections and Azure Blob now verify certificates and host names on all platforms. With the new e-mail option “Require TLS”, a missing or failed STARTTLS ends the connection before any password is sent.
pCloud sends its access token only in the Authorization header, not in the address; download hosts no longer receive it.

Windows service, local communication and configuration folder permissions

The scheduler’s named pipes are local-only, fail closed and cannot be taken over by another process.
Every local request is checked against the caller’s identity: anyone may read status; controlling or changing jobs needs an administrator, the service account or a trusted editor of the configuration.
Limited users may still start their own login/logout/shutdown jobs through the service, with their own folders only. They can hand over the settings encryption password only while the scheduler does not know it yet and it is correct (wrong attempts are limited).
Changes to jobs that run programs or scripts are accepted over the pipe only from administrators; all changes are written to SecurityAudit.log and the event log.
New security review (Program Settings > Security): harden the configuration folder, choose trusted editors, see the current state. Administrators get a start-up notice while the folder is still open to all users.
In service mode the configuration can be protected so that only elevated administrators can change what the service runs; Syncovery elevates itself when an administrator makes a change. After the service is uninstalled, Syncovery offers to return to personal mode.
New installations, and configuration folders Syncovery creates itself, get restricted permissions from the start. Existing installations keep their permissions until you choose “Harden”.
The shadow copy (VSS) service accepts only Syncovery’s own helpers, validated volumes and per-user limits.
The built-in status page listens on this computer only (unless it was already used on the network), and every page except a minimal health line needs its key, entered in a form.
Run-as jobs never fall back to the scheduler’s own account when the logon fails.
The MEGA library is loaded only from the program folder by full path.

Linux: running as root, service account, signed updates

A daemon running as root never uses a configuration that other users can change: it switches “configuration writable for all users” off, sets the folder to 0700 and the files to 0600, and takes over a folder of another user. If that is not possible, no jobs or external commands run and an error is shown.
As root, the web GUI always requires a login, also from this computer.
New: choose an account other than root for the Syncovery service (web GUI dialog, Program Settings > “Service Account…”, or sudo SyncoveryCL SERVICEUSER=<account>|root), optionally with read access to all files.
The switch to another account is refused, and the service keeps running as root, if that account could not get into the program folder or the folders above Syncovery’s own folders (for example a configuration in /root/.Syncovery). A new account is checked before it is created.
A separate root configuration (given with /INI=, owned by root) runs as root when the service uses another account.
Root jobs never write through a symbolic link below the job’s folders; such items are skipped and logged.
Automatic updates on Linux check an Ed25519 signature of the version information, refuse older versions, and unpack in a private folder without a shell.
/etc/SyncoveryCL.conf is written only by root, and root ignores it if others can change it. When switching to another user, root drops all of its groups; any failure stops instead of continuing as root.
Files and folders created by the daemon are private (umask 077, or 027 with “for all users”), backups, journals and lock files included. Running as root is reported in syslog.
Local sockets go to /var/run/syncovery where possible; sockets of other users are never removed.

Command execution and allow-list

On Linux and macOS, external commands are limited to an allow-list when Syncovery runs as root or as the daemon with the web GUI. The program folder is excluded from jobs in that mode.
As root, an allowed program, its interpreter and its scripts must belong to root and must not be writable by others.
Command lines that Syncovery builds itself (rclone, sub-jobs, elevation, SecGate, PowerShell log view, batch files, gcloud) quote every value.
rclone: the daemon starts with a clean environment and an explicit configuration file, and the rclone login is sent only to a daemon of the expected account. Program, configuration, cache, temporary folders and remote-control login can only be changed by administrators; remote names must be plain rclone names.
The rclone program is started only if nobody but the administrators, the system and the account Syncovery runs as can replace it or its folders (on Windows also no network paths or junctions; the file is held open until rclone has started). A program path that fails this check is refused when it is saved and when rclone is started.
Windows: Syncovery now warns when a program or script started by “Execute before/after”, a PascalScript or SecGate could be replaced by users other than the administrators (and the account the job runs as) – in the job log (once a day per job and file), when the job is saved (desktop program, web GUI, SyncoveryCL) and in the security review in the Program Settings. The commands still run. The desktop program offers to protect the folder, or to copy a script to the protected folder C:\ProgramData\SyncoveryScripts and adjust the job; each change is shown first and logged.
Windows: the system programs Syncovery starts itself (SHUTDOWN, NET, icacls, cmd, PowerShell, Notepad) are started from the Windows system folder with their full path, never from another folder.
Temporary folders are validated (no links, no folders of other users, no shell characters) and created with private permissions.
Passwords and other secrets in command lines are masked in every log, ChangeLog, the event log and exception reports.

Logs, exports and diagnostic files

The diagnostic file for support contains no passwords, keys or tokens, and no registration code; logs inside it are masked. Exports without passwords also leave out Execute Before/After commands.
The central-management password is shown and logged only as a fingerprint (also in the Monitoring Tool).
The configuration export (administrators only) is complete and leaves no temporary copies behind.
The web GUI’s log (WebGUI.log) shows line breaks and other control characters from requests, for example in a login name, in escaped form, so they cannot add fake log lines.

Cryptography

Salts, padding, tokens and certificate serial numbers come from the system’s secure random generator; Syncovery stops instead of using a weak fallback.
ZIP encryption writes AES-256 only; “Classic ZIP Password” (ZIP 2.0) is offered only for jobs that already use it, marked as insecure.
SSH key pairs are generated inside Syncovery (RSA 2048, PPK v3); the passphrase is no longer written to a temporary file.

Third-party components

Windows: OpenSSL 4.0.3 (OpenSSL 3 is no longer shipped), SQLite 3.54.1, 7-Zip 26.05, rclone 1.75.2, SFTP library TGPuttyLib based on PuTTY 0.85.
MEGA connector rebuilt on MEGA SDK 10.22.0 with its libraries linked in; libcurl.dll, cares.dll and libsodium.dll are no longer shipped.
The PuTTYgen command-line tool and debug runtime libraries are no longer shipped; the setup removes PuTTYgen.

2. New features and improvements

rclone 1.76 is supported (the remote-control daemon and its web GUI are started with the options of the installed version).
Web GUI: links to log files can be right-clicked (“Save target as”, “Copy link”) and get their own single-use ticket; a used-up or missing ticket now gives a clear message instead of “Session expired”.
Linux: sudo SyncoveryCL /UPDATE checks for and installs an update from the command line (/REINSTALL installs the current build again). It uses the same signed update information as the web GUI and restarts the service if it was running.
Messages of the command-line program and the web server can now be translated.
Faster encryption: AES-256 and PBKDF2 for ZIP and .sz use OpenSSL when available (much faster on ARM NAS devices); the job log says which is used. TLS connections load the CA bundle only once.
Google Drive: “avoid re-reading cloud folders” is on by default for new jobs; changes-based listing is switched back on after a month off; API calls are counted per method in the log.
Dropbox: moves and renames check for conflicts, case-only renames work, and folders are re-read after a failed move.
rsync: unreadable subfolders are reported individually instead of failing the whole scan; “Verify uploads” is available for rsync connections.
Web GUI Email Settings: reworked SMTP tab with Gmail, Outlook, Microsoft 365 and Exchange presets and a Send Test Email button.
Two-step verification: new per-login settings in the desktop and web GUI (General and Advanced tabs), and the web GUI dialog is now called “Two-Step Verification”.
Web GUI on Windows and desktop Program Settings: “Require logins on this computer” checkbox.
Simultaneous copying of a running job can be changed reliably from the web GUI and the desktop; a reduction is no longer undone.
The scheduler tells the user when it refuses a request (also in the tray icon and the Monitoring Tool), and users who may not edit the configuration see the job list from the service.
Read-only web logins can export jobs (without passwords) and use Diagnose Activity.
Selection logging names the mask that excluded an item.
Windows services have descriptions in the Services control panel.
The background service uses the language chosen in the program; timer log file names include the user name.
More web GUI texts can be translated, and web GUI dialogs size themselves to their content.

3. Behaviour changes (please read before updating)

All platforms

The rclone program must be in a folder that only administrators (or the account Syncovery runs as) can change. A copy in a user-writable folder (for example C:\rclone, or an installation outside Program Files) is no longer started; install it next to Syncovery or protect the folder.
The web GUI has no default password, and the fixed recovery password no longer exists. After an update without a stored password, create the login on the “Create the Login” page.
Scripts and integrations that use the web GUI interface must send logins as a POST form body and the session token in the X-Syncovery-Token header. Permanent tokens in the address work only with WebServer\AllowTokenInURL=Y (set automatically where permanent tokens were already configured).
Web GUI sessions expire after 12 hours idle or 7 days; after 10 failed logins, further attempts for that name or address are refused for 15 minutes. Passwords changed in 12.10 use a new hash format that older versions cannot verify.
Logins from public Internet addresses always need a second factor, including the read-only login.
Non-administrators can no longer change scripts, Execute Before/After, run-as settings, the log folder, rclone settings or gcloud paths, and can no longer edit users.
E-mail “Require TLS”: on for new settings; existing settings stay as they are but log a warning for every unencrypted connection. With it on, a server without STARTTLS is refused at once (no retries).
New ZIP archives are always AES-256; jobs set to AES-128/192 now write AES-256, and ZIP 2.0 (“Classic ZIP Password”) is not offered for new jobs. Old archives still restore.
Amazon S3 and Azure public endpoints: certificate exceptions (accept all, self-signed, /ACCEPTSERVER, scripts) no longer apply. Other remembered certificate exceptions are bound to host and port (older entries at first use).
OpenSSL security level 2: very old servers may need the level lowered for your own servers in the settings.
“Enforce TLS” closes the plain HTTP port for other computers. Scripts that used the plain port from another computer must switch to HTTPS.
The built-in status page: only on this computer unless used on the network before; the key is entered in a form (?key= in the address no longer works).
First login from the local network: use the device’s IP address if the page says the name cannot be verified.
A configured temporary folder that has disappeared (for example in /tmp after a reboot) is created again, one level only and checked; folders with links, foreign owners or shell characters are refused and the default is used.
rclone remote names must be plain rclone names (no connection strings); the rclone daemon always gets an explicit configuration file.
Profiles API: mixedProgress is now HTML-encoded; use lastResult/currentProgress for plain text.
E-mail digest: with “send important e-mails immediately” off, errors wait for the digest time like other entries.

Windows

Saving a job whose “Execute before/after” command uses a program or script in a folder that other users can change now shows a warning (with “Save anyway”); the job log shows a matching warning. Nothing is blocked. A later version will refuse such commands in the service with a protected configuration.
Limited users who may not edit the configuration can no longer start, stop or control jobs in the service; their background jobs run in their own program.
After “Harden” in service mode, only elevated administrators can change the configuration; SyncoveryCL refuses changes with exit code 5.
In the service, an elevated process or with a protected configuration, the web GUI requires a login from this computer too.
Run-as jobs: if the logon fails, the job fails (no fallback to the scheduler’s account).
The main setup no longer installs the Guardian and the Remote Service on new installations; they have their own setups. Existing installations are updated.

Linux and macOS

The allow-list of external commands applies when running as root or as the daemon with the web GUI. PascalScript Execute now splits parameters (quote arguments with blanks).
A configuration in a shared folder such as /tmp is refused.

Linux

As root, the configuration folder’s name must contain “Syncovery” (e.g. /root/.SyncoveryRoot); otherwise no jobs run.
As root, “configuration for all users” is switched off, and the configuration folder is taken over by root.
As root, scripts started by jobs must belong to root and must not be writable by others.
As root, jobs do not write through symbolic links inside the job’s folders.
As root, the web GUI always needs a login from this computer.
When the service runs under another account, sudo SyncoveryCL also runs as that account, not as root, so jobs started this way run with the service account’s rights. Jobs that need root can use a separate root configuration given with /INI= (owned by root, in a folder whose name contains “Syncovery”).
Automatic updates need signed version information; earlier builds cannot be reinstalled through the update.
A web GUI address of localhost now really listens on this computer only. Existing configurations with localhost are converted once to all interfaces, as they behaved before; restrict with SyncoveryCL SET /WEBSERVER=127.0.0.1.
Default Database and Logs folders are now in the working folder; an existing folder in the home folder is linked.
SyncoveryCL SET without a setting ends instead of starting the scheduler.

4. Bug fixes

Web GUI: passwords with characters the browser encodes could not log in; after an update, browsers could keep outdated scripts.
Web GUI: password fields showed *** without a stored password; an empty field stored a password.
Web GUI: renaming a job by changing only the case of its name could delete it.
Web GUI: a download link that had already been used or had expired now says so, instead of “SESSION REQUIRED”.
Web GUI: a user without the right to see the Program Settings no longer gets script errors in the browser after the refusal.
Web GUI: testing a cloud account name that does not exist no longer creates an entry and a log file for it; the test answers that the account was not found.
Web GUI: progress on status.php for users with per-job rights.
Web GUI: stability under heavy parallel load (crashes, hangs and memory errors fixed; concurrent exports no longer mix).
Crash with several parallel TLS e-mails (e.g. test mails).
With “use the system vault” on, exporting a diagnostic file could empty vault entries, and SyncoveryCL ADD/CHANGE/IMPORT crashed.
Windows: SMTP settings could be replaced by old registry values.
E-mail: Cancel during a retry was reported as sent; retries reconnect properly; a test mail shows TLS errors.
SyncoveryCL reports when the configuration cannot be read (exit code 5) instead of showing no jobs.
A malformed registration code no longer breaks user management.
Internet protocol logging no longer runs out of file handles.
Restoring Info-ZIP archives with Unix permissions failed with a range check error.
Linux/macOS: command-line values containing " hid later parameters; job processes now use the configured log folder (/LOGPATH).
File names derived from job names: backslashes and reserved names handled on all platforms.
Restoring .sz files no longer depends on the random generator.
Crashes fixed: on exit after TLS transfers using SecureBlackbox; when closing the main window repeatedly while the web server stops; in the folder chooser after creating a folder.
Background jobs of read-only users no longer cause unexpected UAC prompts.
Locks held by ended threads are released (“Critical Section Hang”); the auth log no longer grows without limit.
Database open errors caused by permissions are reported at once instead of retried.
Hidden or System target files (e.g. on pCloud Drive) can be overwritten.
S3: job splitting could exclude a folder whose name is a prefix of another.
SMB: folder deletion on Samba servers checked properly.
SMB (built-in client): copying many files into a large folder is much faster; checking one file no longer lists the whole folder.
Copying to network and cloud destinations: the timestamp of a copied file is read back only when needed (timestamp logging, double-check, or SmartTracking with server-side change detection), and the remembered destination time is reset for every file.
rsync over SSH: a chroot base folder “/” was reported as a file.
Azure: a clear error when the Account ID is missing, instead of retries.
A refused connection was sometimes taken as connected.
JSON parser range check error.
Background scheduler after setup runs elevated only if it was before; correct “Scheduler is running as” text.
Linux: job processes could stay alive after their run and exhaust file handles.
Linux: a UNC path was sometimes treated as a local path (“Run when available” started too early).
Exception reports name the module correctly.

5. Platform notes

Linux

Service account: see Security. Also available in the ASUSTOR package; QNAP packages run as root, because their configuration is kept in the program folder.
rclone’s remote control listens on the same addresses as the web GUI plus 127.0.0.1; only on 127.0.0.1 when the rclone login is off.
The shared temporary folder is created with the sticky bit (1777).
After a crash the daemon writes a journal line and restarts in place.

NAS (QNAP, ASUSTOR, Synology)

QNAP and ASUSTOR packages correct the permissions of their folders at every start (configuration 0600, no write access for others) and write SyncoveryCL.conf themselves.
Login recovery works on Synology without root.

macOS

The allow-list is kept in /Library/Application Support/Syncovery.
MEGA connector on Apple Silicon (ARM64); OpenSSL libraries are loaded consistently.