Permissions

Signotaur runs as a Windows Service under a designated service account. For Signotaur to function correctly, this account needs permissions for accessing files, certificate stores, library DLLs and network resources.

The installer grants the service account access to the server data directory and removes access for other local accounts. The server applies the same permissions every time it starts. You do not normally need to set these by hand.

1. Service Control Permissions

  • Permission: Log on as a Service
  • Purpose: Allows the account to run Signotaur as a Windows Service.
  • See 'Log on as a Service' permission guide

This is the only Windows right the service account requires. It does not need to be an administrator.

The installer assigns this right. You only need to assign it manually if you change the service account after installation.

2. Data Directory Access

  • Folder: C:\ProgramData\VSoft\Signotaur\Server
  • Purpose: Contains the server configuration, SQLite database, uploaded PFX files (under Files), certificate-management data and backups.

The service account has full access to this folder, as do SYSTEM and the local Administrators group. Access for the built-in Users group is removed, preventing ordinary local accounts from reading server data.

The Logs subfolder remains readable so that users diagnosing problems on the host can inspect the logs. You can place logs elsewhere using LogFileLocation in the configuration file.

The new account will not have access to the data directory. Either re-run the installer, or run the following from an elevated command prompt in the Signotaur installation folder:

VSoft.Signotaur.Server.exe configure

Backups Held Outside the Data Directory

If BackupDirectory in the configuration file points outside the data directory, Signotaur cannot apply the protections described above to that folder and writes a warning to the log at start-up.

The backup directory contains the installer's pre-upgrade copy of the server configuration. Its encryption key can decrypt the backup passphrase and therefore the archives stored alongside it.

Restrict this folder to the service account, SYSTEM and Administrators, or clear BackupDirectory to keep backups inside the protected data directory.

3. Certificate Store Access

Signotaur can access both user and system certificate stores to retrieve certificates (including those with private keys).

  • User Certificate Store:
    • Access is automatically granted to each user account for its own certificates.
  • System Certificate Store:
    • Grant Read access to the certificate and Read Key access to the private key for any certificates required by Signotaur. See System Certificate Store Permissions for details.

4. PKCS#11 Library Loading

To access certificates on PKCS#11 hardware devices, Signotaur loads required library DLLs from device-specific directories.

  • Example Folders:

    • YubiKey: %ProgramFiles%\Yubico\Yubico PIV Tool\bin\
    • SafeNet eToken: %SystemRoot%\System32\

  • Permissions Needed: Read and Execute

  • Purpose: Grants Signotaur access to load and execute the required PKCS#11 libraries, such as libykcs11.dll and eTPKCS11.dll.

5. Event Log Access

  • Permission: Write access to Event Log
  • Purpose: Allows Signotaur to log errors or warnings to the Event Log.
  • See Event Log permission guide

6. Network and Internet Access

To download a trial licence or check for updates, Signotaur makes HTTP requests to:

  • https://www.finalbuilder.com
  • https://downloads.finalbuilder.com

Ensure network access is available to these URLs through any firewall or proxy to enable this functionality..

Following this guide will ensure that Signotaur has all the necessary permissions to run smoothly. For any additional support, please contact our technical support team.