Security Hardening

Security Hardening

A HashTasker server holds hashes and cleartext credentials from your engagements. Treat it accordingly.

Know the Trust Model

• The worker API (/api/worker/*) has no authentication. Any host that can reach the server can register as a worker, receive job assignments (including hashes), download wordlist chunks, and submit fake results.
• The server speaks plain HTTP. Session cookies and passwords cross the wire in cleartext without a TLS proxy.
• LDAP is plain LDAP. The service account and user passwords are sent unencrypted to the directory server.

Recommendations

1. Isolate the cracking network. Put the server and workers on a dedicated VLAN that end users cannot reach directly.
2. Restrict the worker API to worker IPs. For example, with nginx in front of the server:

   location /api/worker/ {
       allow 10.50.0.0/24;   # worker subnet
       deny  all;
       proxy_pass http://127.0.0.1:8080;
   }

   Or bind the server to localhost and only expose it through the proxy.
3. Terminate TLS at a reverse proxy for the web UI.
4. Keep LDAP on a trusted segment, or tunnel it, since LDAPS/StartTLS are not supported.
5. Use a least-privilege LDAP service account with read-only access to the user subtree.
6. Generate a real session_key (openssl rand -hex 32) and a strong admin.password. Rotating session_key logs everyone out.
7. Protect the files: config.yaml contains the LDAP bind password and hashtasker.db contains every cracked password.

   chmod 600 /opt/HashTaskerGo/config.yaml /opt/HashTaskerGo/hashtasker.db

8. Run as a dedicated user rather than root by changing User= in the unit files (the account needs write access to the working directory and temp_path).
9. Rely on retention. Jobs are purged after 45 days; delete engagement jobs sooner if your SOW requires it.

Before Publishing a Fork

The repository .gitignore excludes config.yaml, worker.json, *.db, uploads, and binaries. Before pushing, double-check you have not committed real hostnames, IPs, directory DNs, or credentials in examples or docs.