Failed to download the configuration file from the storage

[TheBestPessimist]

Can this issue be somehow related to OneDrive token file?

Not sure, but i expect this would give another error message.

the password was placed into password manager

Can you please try and write it by hand?

What you can also try is: go to an already initialized repository and do a duplicacy list -reset-passwords. With this, it will ask you to write the password by hand. Try now to write it by hand, not by pasting from the password manager. (maybe there’s a weird character while pasting, idk)

[Droolio]

This is probably completely unrelated to your problem, but I did come across an issue where PowerShell didn’t like pasting the password from the clipboard (from KeePass on Windows). I had to use the Ctrl-V shortcut from KeePass which slowed-typed the password into the PS window, to get a proper matching password.

Another thing to bare in mind, if you manipulated the preferences file to store a password directly instead of relying on the OS keyring system (not generally a good idea, but hey…), they’re stored in json format and backslashes escape to other characters.

[duginov]

I already tried typing password by hand; that doesn’t work either. So, to be productive, lets accept that regardless of the root cause, I don’t have correct storage password.
I have normally working jobs, each of them has keyring file with encrypted token and password; they all point to the same storage. Is it possible to decrypt password or I have to abandon that storage and start again from scratch?

[saspus]

already tried typing password by hand; that doesn’t work either. So, to be productive, lets accept that regardless of the root cause, I don’t have correct storage password.

Can you please run duplicacy with the -d flag and check output?

It is possible that while you have correct password in your password manager duplicacy is using wrong one from another place. There are a bunch of places where the password could cached and/or specified. We’d want to confirm that it is actually using the password you are providing.

[duginov]

-d is just an option. Which command you want me to run with it? If I run >duplicacy_win_x64_2.1.1.exe -d it only lists all available commands and options

[towerbr]

cipher: message authentication failed

See Gilbert’s comment on this problem I had, which showed the same error message::

Failed to decrypt snapshots

I have a project that was being backed up to a bucket in B2, with just one snapshot-id, and had about 20 revisions and ~30 Gb. This project was renamed, and I decided, to get everything organized, also rename the backup. As B2 doesn’t accept renames, I used a cloud VM and Rclone to create a copy of the bucket to another bucket with the new name, and also a new name in the snapshots subfolder. After the copy I compared the buckets with Rclone and they were 100% identical, that is, chunks, snap…

Maybe, just as I had problems renaming the snapshot, you’re having trouble configuring the second machine (something with the nomenclature used).

[saspus]

I meant add that option to the whatever operation that fails for you.

e.g.

duplicacy -d backup

[duginov]

Thanks, but no, not the case. I never renamed storage folder.

[duginov]

Here’s GUI “verbose logging” (includes -d as requested) - I was trying to add a new, first job on a second machine

23:51:08.000    Command: duplicacy -background -log -d init -storage-name gui1 -e "AAPLUS- Administrator-TheBatMailExport" "one://z-duplicacy-backups"
23:51:08.355    Reading the environment variable DUPLICACY_GUI1_ONE_TOKEN
23:51:08.361    Reading one_token from keychain/keyring
23:51:08.361    GET https://api.onedrive.com/v1.0/drive/root:/z-duplicacy-backups?select=id,name,size,folder
23:51:08.667    GET https://api.onedrive.com/v1.0/drive/root:/z-duplicacy-backups/chunks? select=id,name,size,folder
23:51:08.757    GET https://api.onedrive.com/v1.0/drive/root:/z-duplicacy-backups/fossils?select=id,name,size,folder
23:51:08.870    GET https://api.onedrive.com/v1.0/drive/root:/z-duplicacy-backups/snapshots?select=id,name,size,folder
23:51:08.986    Reading the environment variable DUPLICACY_GUI1_PASSWORD
23:51:08.987    Reading password from keychain/keyring 
23:51:08.987    GET https://api.onedrive.com/v1.0/drive/root:/z-duplicacy-backups/config?select=id,name,size,folder
23:51:09.219    GET https://api.onedrive.com/v1.0/drive/items/root:/z-duplicacy-backups/config:/content
23:51:09.696    Using 16384 iterations for key derivation

[saspus]

Reading one_token from keychain/keyring

Indeed, it seems that it takes both token and password from the keyring.

I’ll try to go through the same steps and see if the issue reproduces for me

P.S.

TheBatMail

Now this is something I haven’t seen for a looong time Good to know it is alive and well

[Christoph]

TheBatMail

Now this is something I haven’t seen for a looong time Good to know it is alive and well

Oh man, yeah! I used that for years until… uh, until what? I can’t even remember what it was. I think I was disagreeing with some changes they implemented.

[saspus]

I guess it will have to wait until I get home. From work I don’t seem to connect to OneDrive at all for some reason:

myimac:test_one_drive me$ duplicacy init -e test01 one://test-bucket
Enter the path of the OneDrive token file (downloadable from https://duplicacy.com/one_start):/Users/me/Downloads/one-token.json
Failed to load the OneDrive storage at one://test-bucket: Get https://api.onedrive.com/v1.0/drive/root:/test-bucket?select=id,name,size,folder: write tcp xxx.xxx.xxx.xxx:61469->204.79.197.213:443: write: broken pipe

[towerbr]

Thanks, but no, not the case. I never renamed storage folder.

Ok, but it’s not about the name of the storage, but the names of the snapshots stored in the storage …

AAPLUS- Administrator-TheBatMailExport is the same name used on both machines, right? Is this space after AAPLUS- correct?

And you see a folder with this name above in the snapshots folder, using Onedrive web interface?

[gchen]

Try this command:

duplicacy -d list -reset-passwords

The -reset-passwords option will instruct Duplicacy to ignore passwords stored in keyring/keychain and instead to prompt for new ones.

ERROR Failed to download the configuration file from the storage: Failed to retrieve the config file: cipher: message authentication failed

This error is definitely caused by a wrong storage password. If it is macOS, you can check what password is stored in KeyChain on machines where the backups are working. It is much harder on Windows, but it is possible.

[duginov]

Same here. This is an archive. I stopped using TheBat! eight, maybe ten years ago…

[duginov]

First machine added few repositories to the storage, this was not one of them. TheBatMailExport folder exists only on the second machine - “AAPLUS”. There’s no such snapshot in OneDrive because init fails. Exactly the same is happening on first machine - trying to add new repository to existing storage - getting “failed to download configuration”. Am I making this clear now?

[duginov]

There’s no space, I checked. It sneaked in somehow when I was pasting log here.

[duginov]

-d list -reset-passwords says
Repository has not been initialized

Both machines are Windows. I’d like to try to recover password if possible. Can you provide instructions, please?

[saspus]

Could it be that the config file got corrupted?

If you login to OneDrive’s web interface and right-click on the config file in the storage folder you might be able to see the OneDrive’s maintained versions of the file and restore it to a previous version.

[saspus]

So, I have init the same repo from the windows machine and it all worked just fine.

then I went to OneDrive and damaged the config file. Just modified a bunch of numbers there (it’s a text file).
And then tried to access the storage again:

mymbp:test02 me$ duplicacy backup
Storage set to one://test-bucket
Failed to download the configuration file from the storage: Failed to retrieve the config file: cipher: message authentication failed

So, this message is not only result of a wrong password, but also config file corruption. Which makes sense totally – in both cases decryption will fail and there is no way to distinguish bad password from bad data.

How could the file get corrupted? Easy. OneDrive is very flaky. When I said it did not work from work earlier ? Well, I eventually SSHed home and it did not work from there either. It started working after several attempts with intermittent dropped connections. In the evening it started working reliably every time.

Perhaps indeed in one of the backup runs the config file upload got interrupted. What is the size of your config file? (mine is always around 830 bytes)

@gchen – are there any safeguards in place when uploading the config file to ensure atomicity? ie. rename the existing one and if upload of a new config file fails/gets interrupted/ to restore the previous one?
Also, would it be possible to sign the config file in addition to encrypting it to validate its integrity before attempting to decrypt it? Config file is the only file that get re-written and is the Achilles heel here.