Proposal to make TOKEN mandatory

[Macleykun]

Heya!

I'm super happy to have found your project :) as a longterm portainer + watchtower user it was time to look for a solution that didn't only incoperate both, but also looks neat on phone's, works with podman (not that i'm using it.. yet at home!) and the visual upgrade! Also the general way how you develop and interract with the community is something i just wanted to thank you for!

The reason i did make this issue is as a (lazy) linux admin i deployed hawser and didn't bother with setting up a token, however after a day or so i notice i had a crypto-miner on my nas and was wondering how. I fresh reinstalled it and only ran 3 containers, hawser, qbitorrent and autobrr, and just a few hours ago i noticed in dockhand that i had the exact same one again!

I'm super happy to have dockhand as i probably wouldn't have ever noticed it, and that's withoud alerting! But the only entry they would've have was through qbitorrent, i noticed my docker engine is 9 months out of support and the NAS OS discourages using apt to update packages.. Given that i didn't configure a token on hawser i assume that everyone on my local network could request to make a container if they find that endpoint unauthenticated?

I've been rambeling to much... So TLDR!
Would not configuring the TOKEN in the agent make everyone in the network be able to create containers, given that the socket is r/w?

If so, is it an idea to force users to use the token option? It is less user friendly i know, but given the endpoint could do some harm, and users aren't always informed about the implications, it might be better for them in the end?

No matter the outcome, i'm ok with either outcome :) the option is always there to configure it or use edge!

[jotka]

hi @Macleykun well, thanks for the writeup. That's why we always recommend edge mode on th exposed nodes.

that said, we'll change Hawser to require a token by default in standard mode — the agent will refuse to start without one. Users who explicitly want to run without auth (e.g., isolated test networks) will be able to opt out with a flag, but the safe default will be auth-on.

[Macleykun]

hi @Macleykun well, thanks for the writeup. That's why we always recommend edge mode on th exposed nodes.

Yeah, I think bc of home lab I though why not use the normal agent, but in handsightl should’ve used edge instead :p
Thank you for taking my consideration!

[EDIflyer]

Sounds like a good plan. @Macleykun the other thing I've done to reduce the chances of attack is also to run Tailscale on each server and only allow connections via that route by binding the Hawser port to the Tailscale IP - for example:

services:
    hawser:
        image: 'ghcr.io/finsys/hawser:latest'
        environment:
            - TOKEN=myuniquetoken
        ports:
            - '100.22.123.456:2376:2376'
        volumes:
            - '/var/run/docker.sock:/var/run/docker.sock'
        restart: unless-stopped
        container_name: hawser

[Macleykun]

Sounds like a good plan. @Macleykun the other thing I've done to reduce the chances of attack is also to run Tailscale on each server and only allow connections via that route by binding the Hawser port to the Tailscale IP - for example:

services:
hawser:
image: 'ghcr.io/finsys/hawser:latest'
environment:
- TOKEN=myuniquetoken
ports:
- '100.22.123.456:2376:2376'
volumes:
- '/var/run/docker.sock:/var/run/docker.sock'
restart: unless-stopped
container_name: hawser

Handy! I opted to use the edge mode and didn't had to open any ports at all :) !

[EDIflyer]

Handy! I opted to use the edge mode and didn't had to open any ports at all :) !

Ah yes - I was looking at that but I'd locked my main Dockhand instance down to be bound to localhost (so only available when I have an SSH session active with port forwarding enabled) so there was nothing for the Edge agent to connect to 😂

[jotka]

the other thing I've done to reduce the chances of attack is also to run Tailscale on each server and only allow connections via that route by binding the Hawser port to the Tailscale IP

that is actually a very nice idea. Hope you don't mind @EDIflyer i will take it to the Dockhand online manual as an example :)

[EDIflyer]

Haha not at all, @jotka - thanks for everything you've done with Dockhand!