KBFS Broken After Update

[zQueal]

Keybase GUI Version: 1.0.14-20160303171223+229c1f1

After installing the newest version, even after executing keybase login manually I can't seem to get Windows to enable and connect the KBFS. Using the GUI to click Open KBFS Folder does nothing.

λ keybase version
Client:  1.0.14
Service: 1.0.14

---

keybase status

KBFS:
    status:    not running
    version:
    log:       C:\Users\zqueal\AppData\Roaming\Keybase\keybase.kbfs.log

keybase ctl restart does not restart the KBFS service. I noticed that my keyring was locked, so I ran keybase unlock which successfully unlocked my keyring, but the service still will not restart. I do not have any antivirus or any other security tools which would stop the service from running. Additionally %appdata%\Roaming\Keybase\keybase.kbfs.log does not exist.

[zanderz]

I would be interested to know where you got that version The latest one is:

https://s3.amazonaws.com/prerelease.keybase.io/windows/keybase_setup_gui_1.0.14-20160321110615%2Bc914ea6.386.exe

It should show up if you issue "keybase update check". Do we have a stale link somewhere?

Thanks, Steve

On Mon, Mar 21, 2016 at 11:52 PM, Zach Queal notifications@github.com wrote:

Keybase GUI Version: 1.0.14-20160303171223+229c1f1

After installing the newest version, even after executing keybase login manually I can't seem to get Windows to enable and connect the KBFS. Using the GUI to click Open KBFS Folder does nothing.

λ keybase version Client: 1.0.14 Service: 1.0.14

— You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub https://github.com/keybase/client/issues/2418

[zQueal]

Because I've had issues with the updater before, I just grab the newest versions from here. But I can see that's a bad habit.

I uninstalled the previous version and installed the one from your link. Upon doing that I was advised I needed to restart my PC to complete the installation--after doing so I was met with this;

Since then, I've tried re-re-installing to actually install the service after enabling unsigned drivers (really insecure...), but absolutely no luck.

---

The actual issue was because the Dokan service is not digitally signed, and by default Windows 7 x64 requires all drivers to be digitally signed. I had to use "Driver Signature Enforcement Overrider" to digitally "sign" the Dokan driver and disable enforcement mode. So the way it makes sense to me is now any program which is installed on my PC can install any driver it wants, now. Which isn't very cool at all. I can't really account as to why Keybase was working perfectly before, but now requires me to disable driver signing.

Any thoughts?

After signing the driver and restarting KBFS is working again.

[cjb]

We should be signing the driver, so it looks like something's gone wrong there.

[zanderz]

The most recent versions have updated drivers, which didn't give this problem in all our windows 10 testing. I have updated the server to issue this, one of the last builds before the driver update: https://s3.amazonaws.com/prerelease.keybase.io/windows/keybase_setup_gui_1.0.14-20160311105636%2Bdb6fb08.386.exe

On Tue, Mar 22, 2016 at 3:58 AM, Chris Ball notifications@github.com wrote:

We should be signing the driver, so it looks like something's gone wrong there.

— You are receiving this because you commented. Reply to this email directly or view it on GitHub https://github.com/keybase/client/issues/2418#issuecomment-199754026

[zanderz]

Weirdly, these drivers do seem to be signed:

:\work\bin\dokan-dev\dokan-v1.0.0-RC2>signtool verify /pa C:\work\bin\dokan-dev\dokan-v1.0.0-RC2\x64\Win7Release\dokan1.sys File: C:\work\bin\dokan-dev\dokan-v1.0.0-RC2\x64\Win7Release\dokan1.sys

Index Algorithm Timestamp

0 sha1 Authenticode

Successfully verified: C:\work\bin\dokan-dev\dokan-v1.0.0-RC2\x64\Win7Release\dokan1.sys

On Tue, Mar 22, 2016 at 6:02 AM, Steve Sanders steve@keyba.se wrote:

The most recent versions have updated drivers, which didn't give this problem in all our windows 10 testing. I have updated the server to issue this, one of the last builds before the driver update:

https://s3.amazonaws.com/prerelease.keybase.io/windows/keybase_setup_gui_1.0.14-20160311105636%2Bdb6fb08.386.exe

On Tue, Mar 22, 2016 at 3:58 AM, Chris Ball notifications@github.com wrote:

We should be signing the driver, so it looks like something's gone wrong there.

— You are receiving this because you commented. Reply to this email directly or view it on GitHub https://github.com/keybase/client/issues/2418#issuecomment-199754026

[zanderz]

Adding Taru On Mar 22, 2016 6:45 AM, "Steve Sanders" steve@keyba.se wrote:

Weirdly, these drivers do seem to be signed:

:\work\bin\dokan-dev\dokan-v1.0.0-RC2>signtool verify /pa C:\work\bin\dokan-dev\dokan-v1.0.0-RC2\x64\Win7Release\dokan1.sys File: C:\work\bin\dokan-dev\dokan-v1.0.0-RC2\x64\Win7Release\dokan1.sys

Index Algorithm Timestamp

0 sha1 Authenticode

Successfully verified: C:\work\bin\dokan-dev\dokan-v1.0.0-RC2\x64\Win7Release\dokan1.sys

On Tue, Mar 22, 2016 at 6:02 AM, Steve Sanders steve@keyba.se wrote:

The most recent versions have updated drivers, which didn't give this problem in all our windows 10 testing. I have updated the server to issue this, one of the last builds before the driver update:

https://s3.amazonaws.com/prerelease.keybase.io/windows/keybase_setup_gui_1.0.14-20160311105636%2Bdb6fb08.386.exe

On Tue, Mar 22, 2016 at 3:58 AM, Chris Ball notifications@github.com wrote:

We should be signing the driver, so it looks like something's gone wrong there.

— You are receiving this because you commented. Reply to this email directly or view it on GitHub https://github.com/keybase/client/issues/2418#issuecomment-199754026

[taruti]

Unsigned drivers should not be needed.

Also no issue from an unsigned driver on Windows 7 x64 after installing @zanderz link. However the installer might not succeed in replacing dokan1.sys with the correct version if there is a invalid one already installed?

@zQueal can you confirm Windows version (Windows 7 x64?), C:\windows\system32\drivers\dokan1.sys size and SHA1 (or another checksum), what various properties tabs from dokan1.sys say?

[zQueal]

At first I thought it was an unsigned driver, which caused me to use "Driver Signature Enforcement Overrider" which actually worked. After using it, KBFS was working fine for me but I felt really insecure using it. I looked around and found where installing a Windows update fixed the issue for some Windows users while using Dokan. I tried it and it borked my bootloader. I was able to fix it, but ended up opting to reformat while I was already having a terrible day.

I'm still installing programs, but I'll install KBFS and see if it works out of the box now. If it does it was obviously just my old environment.

[zanderz]

Again, based on that scary dialog and Max's suggestion, I rolled back the server configuration to a version prior to the Dokany driver update. Should it be changed back to the newer one? On Mar 22, 2016 11:55 AM, "Zach Queal" notifications@github.com wrote:

At first I thought it was an unsigned driver, which caused me to use "Driver Signature Enforcement Overrider" which actually worked. After using it, KBFS was working fine for me but I felt really insecure using it. I looked around and found where installing a Windows update fixed the issue for some Windows users while using Dokan. I tried it and it borked my bootloader. I was able to fix it, but ended up opting to reformat while I was already having a terrible day.

I'm still installing programs, but I'll install KBFS and see if it works out of the box now. If it does it was obviously just my old environment.

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/keybase/client/issues/2418#issuecomment-200048682

[zQueal]

Sorry Steve, I must have skipped over your post.

I installed 1.0.14-20160311105636+db6fb08 over the current version, and it immediately works fine. After the install I was prompted to unlock my key ring and I'm back on KBFS with no issues.

Not sure what you want to make of that.

However the installer might not succeed in replacing dokan1.sys with the correct version if there is a invalid one already installed?

This sounds perfectly reasonable, however, I installed the newest version of keybase on a freshly formatted system. So there's no chance of that happening, although it could have been the original problem before the format. Unfortunately there's no way to know for sure, now.