SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Windows C:\ProgramData\Netbird directory/files permissions #265

New Issue
Closed
opened 2025-11-20 05:08:48 -05:00 by saavagebueno · 7 comments
saavagebueno commented 2025-11-20 05:08:48 -05:00
Owner
Copy Link

Originally created by @rgl on GitHub (Jan 21, 2023).

Describe the problem

The Windows C:\ProgramData\Netbird directory (and contained files) permissions seems to be too wide.

The config.json file seems to have a private key (in the .PrivateKey and SSHKey properties), which should only be readable by the the netbird service (and probably SYSTEM and Administrators), but not by all the machine users (the Users group).

For reference, these are the current permissions that I can see in my machine, and they should not contain the BUILTIN\Users entry :

C:\> Get-Acl C:\programdata\Netbird\ | Format-List

Path   : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\Netbird\
Owner  : BUILTIN\Administrators
Group  : NT AUTHORITY\SYSTEM
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         CREATOR OWNER Allow  268435456
         BUILTIN\Users Allow  ReadAndExecute, Synchronize
         BUILTIN\Users Allow  Write
Audit  :
Sddl   : O:BAG:SYD:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIIOID;GA;;;CO)(A;OICIID;0x1200a9;;;BU)(A;CIID;DCLCRPCR;;;BU)


C:\> Get-Acl C:\programdata\Netbird\config.json | Format-List

Path   : Microsoft.PowerShell.Core\FileSystem::C:\programdata\Netbird\config.json
Owner  : BUILTIN\Administrators
Group  : NT AUTHORITY\SYSTEM
Access : NT AUTHORITY\SYSTEM Allow  FullControl
         BUILTIN\Administrators Allow  FullControl
         BUILTIN\Users Allow  ReadAndExecute, Synchronize
Audit  :
Sddl   : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)
Originally created by @rgl on GitHub (Jan 21, 2023). **Describe the problem** The Windows `C:\ProgramData\Netbird` directory (and contained files) permissions seems to be too wide. The `config.json` file seems to have a private key (in the `.PrivateKey` and `SSHKey` properties), which should only be readable by the the netbird service (and probably `SYSTEM` and `Administrators`), but not by all the machine users (the `Users` group). For reference, these are the current permissions that I can see in my machine, and they should not contain the `BUILTIN\Users` entry : ```console C:\> Get-Acl C:\programdata\Netbird\ | Format-List Path : Microsoft.PowerShell.Core\FileSystem::C:\ProgramData\Netbird\ Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM Access : NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl CREATOR OWNER Allow 268435456 BUILTIN\Users Allow ReadAndExecute, Synchronize BUILTIN\Users Allow Write Audit : Sddl : O:BAG:SYD:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIIOID;GA;;;CO)(A;OICIID;0x1200a9;;;BU)(A;CIID;DCLCRPCR;;;BU) C:\> Get-Acl C:\programdata\Netbird\config.json | Format-List Path : Microsoft.PowerShell.Core\FileSystem::C:\programdata\Netbird\config.json Owner : BUILTIN\Administrators Group : NT AUTHORITY\SYSTEM Access : NT AUTHORITY\SYSTEM Allow FullControl BUILTIN\Administrators Allow FullControl BUILTIN\Users Allow ReadAndExecute, Synchronize Audit : Sddl : O:BAG:SYD:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU) ```
saavagebueno commented 2025-11-20 05:08:48 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jan 24, 2023):

Thanks for submitting the issue @rgl; we will have to check that as we are using folder permissions equal to 0750, which on Linux/Unix should give RO permissions to the groups to which the user that created the file belongs to. And file permissions equal to 0600 which should give RW permissions to the user creating the files.

@mlsmaycon commented on GitHub (Jan 24, 2023): Thanks for submitting the issue @rgl; we will have to check that as we are using folder permissions equal to 0750, which on Linux/Unix should give RO permissions to the groups to which the user that created the file belongs to. And file permissions equal to 0600 which should give RW permissions to the user creating the files.
saavagebueno commented 2025-11-20 05:08:49 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Sep 8, 2024):

I reported this as an security issue: https://github.com/netbirdio/netbird/security/advisories/GHSA-pjm7-gvv8-7xwr

Summary

The config file containing the private key can be read / viewed by any unprivileged local user and doesn't require local admin permissions so the key seems to be not protected!

The Windows service runs as "Local System" and no one else should be able to read the file!

Details

Config file: $env:ProgramData\Netbird\config.json
The file has inherited permissions of c:\ProgramData which by default grands any user read access!

On macOS the file can't be read by normal users!

Impact

Unprivileged users or process can steal sensitive information like the private key.

Fix

Disable file system permission inheritance of %programdata% for the folder %programdata%\netbird
grant permissions only to: SYSTEM

@florian-obradovic commented on GitHub (Sep 8, 2024): I reported this as an security issue: https://github.com/netbirdio/netbird/security/advisories/GHSA-pjm7-gvv8-7xwr ### Summary The config file containing the private key can be read / viewed by any unprivileged local user and doesn't require local admin permissions so the key seems to be not protected! The Windows service runs as "Local System" and no one else should be able to read the file! ### Details Config file: $env:ProgramData\Netbird\config.json The file has inherited permissions of c:\ProgramData which by default grands any user read access! On macOS the file can't be read by normal users! ### Impact Unprivileged users or process can steal sensitive information like the private key. ### Fix Disable file system permission inheritance of %programdata% for the folder %programdata%\netbird grant permissions only to: SYSTEM
saavagebueno commented 2025-11-20 05:08:49 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Sep 8, 2024):

I fix this in my POC deployment scripts using PowerShell:

$directory = "$env:ProgramData\Netbird"

# Disable file system inheritance
$inheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None
$propagationFlag = [System.Security.AccessControl.PropagationFlags]::NoPropagateInherit
$acl = Get-Acl $directory
$acl.SetAccessRuleProtection($true, $inheritanceFlag)

# Grant SYSTEM full control to this folder, subfolders, and files
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl -Path $directory -AclObject $acl

# Grant users list directory permission
$group = "Users"
$permission = "ListDirectory"

$acl = Get-Acl -Path $directory
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($group, $permission, "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl -Path $directory -AclObject $acl

# Grant users read permission on client.log
$clientLog = "$env:ProgramData\Netbird\client.log"
$acl = Get-Acl -Path $clientLog
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Users", "Read", "None", "None", "Allow")
$acl.AddAccessRule($rule)
Set-Acl -Path $clientLog -AclObject $acl

CleanShot 2024-09-08 at 16 39 09@2x

@florian-obradovic commented on GitHub (Sep 8, 2024): I fix this in my POC deployment scripts using PowerShell: ``` $directory = "$env:ProgramData\Netbird" # Disable file system inheritance $inheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None $propagationFlag = [System.Security.AccessControl.PropagationFlags]::NoPropagateInherit $acl = Get-Acl $directory $acl.SetAccessRuleProtection($true, $inheritanceFlag) # Grant SYSTEM full control to this folder, subfolders, and files $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow") $acl.AddAccessRule($rule) Set-Acl -Path $directory -AclObject $acl # Grant users list directory permission $group = "Users" $permission = "ListDirectory" $acl = Get-Acl -Path $directory $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($group, $permission, "ContainerInherit,ObjectInherit", "None", "Allow") $acl.AddAccessRule($rule) Set-Acl -Path $directory -AclObject $acl # Grant users read permission on client.log $clientLog = "$env:ProgramData\Netbird\client.log" $acl = Get-Acl -Path $clientLog $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Users", "Read", "None", "None", "Allow") $acl.AddAccessRule($rule) Set-Acl -Path $clientLog -AclObject $acl ``` ![CleanShot 2024-09-08 at 16 39 09@2x](https://github.com/user-attachments/assets/008705bb-9409-4bd6-bf17-659ce6a74986)
saavagebueno commented 2025-11-20 05:08:49 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Sep 17, 2024):

resolved in 0.29.3 by the PR https://github.com/netbirdio/netbird/pull/2568.

@mlsmaycon commented on GitHub (Sep 17, 2024): resolved in 0.29.3 by the PR https://github.com/netbirdio/netbird/pull/2568.
saavagebueno commented 2025-11-20 05:08:49 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Sep 17, 2024):

I think it would be better to replace the permissions on every install / update.

I just checked two installations (MSI & EXE) and it won't fix already too open permissions

CleanShot 2024-09-17 at 18 28 48@2x

@florian-obradovic commented on GitHub (Sep 17, 2024): I think it would be better to replace the permissions on every install / update. I just checked two installations (MSI & EXE) and it won't fix already too open permissions ![CleanShot 2024-09-17 at 18 28 48@2x](https://github.com/user-attachments/assets/c91c0ee6-8015-49fe-ab4d-e28f87efb0ba)
saavagebueno commented 2025-11-20 05:08:49 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Sep 17, 2024):

@florian-obradovic Can you open a new issue for it?

we will need to have a look since the fix should be doing that when you upgrade the version

@mlsmaycon commented on GitHub (Sep 17, 2024): @florian-obradovic Can you open a new issue for it? we will need to have a look since the fix should be doing that when you upgrade the version
saavagebueno commented 2025-11-20 05:08:49 -05:00
Author
Owner
Copy Link

@florian-obradovic commented on GitHub (Sep 17, 2024):

@florian-obradovic Can you open a new issue for it?

we will need to have a look since the fix should be doing that when you upgrade the version

Done: #2614

@florian-obradovic commented on GitHub (Sep 17, 2024): > @florian-obradovic Can you open a new issue for it? > > we will need to have a look since the fix should be doing that when you upgrade the version Done: #2614
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#265
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?