Issue setting up encrypted share (untrusted server)

Support
1

Hi guys,

First of all, super happy with syncthing - it looks awesome. But I’m running into an issue.

I’m trying to set up a backup scenario where a client transmits its backup encrypted to an untrusted server. The backup is then stored in an encrypted way, which seems to be a recent addition, and is described here:

I run syncthing 1.12.0 and also tried 1.12.1-rc.1.

I figure the documentation is slightly out of date, since

<device id="CJBIJBJ-..." encryptionPassword="foo"></device>

should probably be

<device id="CJBIJBJ-...">
    <encryptionPassword>foo</encryptionPassword>
</device>

I tried the following:

  • Add client device to server and accept at server
  • At client: Edit config.xml, set server untrusted to true to prevent plaintext syncing. Restart service
  • At client: Create new share, pause syncing, while paused, enable sharing with server
  • At client: Edit config.xml, add EncryptionPassword to some random string. Restart service.
  • At client: resume syncing of share.
  • At server: Accept new share.

The result is an error at the client:

Failure checking encryption consistency with device my_untrusted_server for folder "test3" (tw4np-eacum): folder is configured to be encrypted but not announced thus

In the logs, I see: (some data censored with XXXX)

2020-12-23 13:06:28 Connection to L6MAI4L-XXXXXXX-XXXXXXX-XXXXXXX-XXXXXXX-XXXXXXX-XXXXXXX-XXXXXXX at [XXXX:XXXX:XXXX:XXXX:XXXX%enp0s3]:22000-[XXXX:XXXX:XXXX:XXXX:XXXX%enp0s3]:40693/tcp-client/TLS1.3-TLS_AES_128_GCM_SHA256 closed: receiving cluster config: folder is configured to be encrypted but not announced thus

Any idea what goes wrong? This code has been added recently, I’m not sure if this is me missing something or a bug in syncthing.

If requested, I can post my configuration files here

2

I assume you saw Early Testing for Untrusted (Encrypted) Devices?

v1.12.1-rc.1 should be fine, though ideally you’d still be using nightlies (I remember at least one untrusted-related bugfix since then). No starting to actually answer your post:

That’s the wrong order: You should never edit config.xml while Syncthing is running - it might save it’s in-ram config at any moment overwriting your changes.

That means that the folder on the untrusted device wasn’t added with as type “receive-encrypted”, i.e. the untrusted device acts as if it had the plain, not encrypted data (thus the “encrypton protocol” doesn’t work and there’s an error).

Suggestions on how to word this differently, so the meaning is more understandable, are very welcome!

3

Are you saying the untrusted device has to be flagged untrusted before the folder is shared withe it?

4

On the untrusted device, you need to choose “receive-encrypted” as folder-type when accepting/add the shared folder.

Looking at Untrusted (Encrypted) Devices — Syncthing v1 documentation, it becomes very clear that it is not ready for the testing call. Will update soon :slight_smile:

2 Likes
5

Okay, great! I indeed have not marked the share as ‘receive-encrypted’ on the receiving server. I will test this somewhere later this week and report my findings.

Cheers,

Mono

6

Actually the link you used for untrusted docs is outdated. The one in Early Testing for Untrusted (Encrypted) Devices points at https://deploy-preview-480--syncthing-docs.netlify.app/users/untrusted.html which already has a GUI section (and I now update the config.xml part).

1 Like
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.