Note: This security entry has been retired since v2.3.0, and totally reimplemented in v3.0
In gui.config we have a function that allows to show unencrypted values of the yaml config file While this is practical, it should never be allowed on non compiled builds or with the default backup admin password

All these commands are run with npbackup held privileges. In order to avoid a potential attack, the config file has to be world readable only.

Password command is encrypted in order to avoid it's divulgation if config file is world readable. Password command is also not logged.

Partially covered with password_command feature, and alternative aes key management. We should have a central password server that holds repo passwords, so password is never actually stored in config. This will prevent local backups, so we need to think of a better zero knowledge strategy here.

Since viewer mode requires actual knowledge of repo URI and repo password, there's no need to manage local permissions. Viewer mode permissions are set to "restore-only".

Since v3.0.0, we insert permissions directly into the encrypted repo URI. Hence, update permissions should only happen in two cases:

• CLI: Recreate repo_uri entry and add permission field from YAML file
• GUI: Enter permission password to update permissions

Since encryption is symmetric, we need to protect our sensitive data. Best ways:

• Compile with alternative aes-key
• Use NPBACKUP_KEY_LOCATION or NPBACKUP_KEY_COMMAND to specify alternative AES keys

Using --show-config should hide sensitive data, and manager password.

When using --show-config or right click show unencrypted, we should only show unencrypted config if password is set.
Environment variable NPBACKUP_MANAGER_PASSWORD will be read to verify access, or GUI may ask for password. Also, when wrong password is entered, we should wait in order to reduce brute force attacks.

When using retention policies, we need to make sure that current system date is good, in order to avoid wrong retention deletions.
When set, an external NTP server is used to get the offset. If offset is high enough (10 min), we avoid executing the retention policies.
If the NTP server cannot be reached, retention policies are still applied by default, so anyone able to block NTP traffic can disable this check.
Setting abort_on_ntp_failure makes an unreachable NTP server prevent retention policies from being applied too.

Using obfuscation() symmetric function in order to not store the bare AES key.

The PRIVATE directory might contain alternative AES keys and obfuscation functions which should never be bundled for a PyPI release.

Sensitive environment variables aren't available for scripts / additional parameters and will be replaced by a given string from env.py

We need to replace REST / SFTP repository URIs with anonymous data for user/passwords

We need to make sure that sftp password never gets logged in debug mode

We need to make sure that adding keys never gets logged in debug mode.
A new key's password is never given on the command line, where every user of the machine can read it: --keys add reads it from --new-key-password-file, else asks for it, else reads it from stdin, and --keys add=<password> is refused.
It reaches restic through a pipe on restic's stdin, never through a shell or on restic's command line, and the JSON output never echoes it.

When registering a Windows scheduled task with user credentials, the generated PowerShell script contains a password.
The script content must never be logged, and passwords are redacted from PowerShell output before logging errors.
Credentials, task names and file paths are passed as base64 encoded expressions to the generated scripts, which also prevents PowerShell injection via crafted repo/group names and avoids quoting/encoding issues.

NPBackup 4.x cannot decrypt this configuration, whose key is compiled into this build: --export-for-4x <public key> hands it over, its secrets decrypted, but never in clear.
It is sealed with HPKE (RFC 9180: X25519, HKDF-SHA256, AES-256-GCM) for the one-time public key the 4.x installer makes for that migration, and only the sealed block is written, on stdout; there is no clear mode. Its header lines are bound to it, so a changed header does not open.
Only an administrator may export, and a manager password set on a repository or group must be given in NPBACKUP_MANAGER_PASSWORD, as with --show-config. 4.x is told that there was one, not the password; the file's own text goes as it is on disk, where npbackup keeps it encrypted.
The configuration file is read through a private copy, so it is never rewritten, and the log says what was exported for which key, never its content.