Server Configuration

The server reads config.yaml from its working directory at startup. Changes require a restart.

Full Example

server:
  host: "0.0.0.0"
  port: 8080
  session_key: "output-of-openssl-rand-hex-32"
  upload_path: "./uploads"
  wordlists_path: "/crack/wordlists"
  rulesets_path: "/crack/rules"
  hashmodes_path: "./hashmodes.txt"
  wordlist_mode: "push"

database:
  host: "localhost"
  port: 3306
  user: "hashtasker"
  password: "set-this"
  database: "hashtasker"

ldap:
  enabled: false
  host: "dc01.example.com"
  port: 389
  bind_dn: "[email protected]"
  bind_pass: "service-account-password"
  base_dn: "OU=Users,DC=example,DC=com"
  user_filter: "(sAMAccountName=%s)"
  admin_group: "CN=Cracking-Admins,OU=Groups,DC=example,DC=com"

admin:
  username: "admin"
  password: "set-a-strong-password"

server

Key	Default	Description
host		Listen address
port		Listen port
session_key		Required. Secret used to sign session cookies. Startup fails if empty or left at the example value.
upload_path		Uploaded custom wordlists, push-mode chunk files, generated potfiles
wordlists_path		Directory listed in the job form's wordlist dropdown. Also health-checked every 30 seconds.
rulesets_path		Directory listed in the ruleset dropdown
hashmodes_path		hashcat mode list used to populate the hash mode dropdown
wordlist_mode	push	push or nfs. See Wordlist Modes. Read once at startup.

static_path and template_path may appear in older configs. They are ignored because assets are embedded in the binary.

database

HashTasker always tries SQLite first (hashtasker.db in the working directory). These MySQL settings are used only if SQLite fails to open, and the failure is logged. password must be set to something other than the example value or the server will not start.

ldap

Key	Description
enabled	Turn LDAP authentication on
host, port	Directory server. Plain LDAP (no TLS).
bind_dn, bind_pass	Service account used to search for users. Read-only is sufficient.
base_dn	Subtree searched for users
user_filter	Search filter; %s is replaced with the escaped login name. AD: (sAMAccountName=%s). OpenLDAP: (uid=%s).
admin_group	Full DN of a group. Users whose memberOf contains this exact DN are admins.

See Authentication and Users for how logins are processed.

admin

The built-in local admin. Always works, even when LDAP is enabled or down. The password is bcrypt-hashed when the server starts. Startup fails if it is empty or changeme.

Files in the Working Directory

File	Purpose
config.yaml	This file
hashmodes.txt	Hash mode list
changelog.md	Rendered on the in-app Changelog page (read at request time)
hashtasker.db	SQLite database (created automatically)
uploads/	Server working files (created automatically)