The information in this document applies to version 7.2 of Syhunt Hybrid.

Introduction

Starting with version 7.1.6 Syhunt Hybrid comes with a robust web user interface that can be enabled on Windows, Linux or Mac machines. While still evolving, the web UI allows to launch DAST, SAST and MAST scans, view results of scans (including those started through the GUI, CLI, REST API and scheduler if any), generate reports and exports, manage users, user permissions and active sessions, run console commands and more. The web interface and reports are currently available in 8 languages - English, German, Spanish, French, Italian, Japanese, Korean and Portuguese.

The Syhunt Hybrid web interface has been built on top of a robust web server - Openresty (Nginx + Lua), uses Bcrypt with a high factor for password hashing, secure session ID generation and implements login protection against brute force.

Enabling the Web UI

1. Open the command prompt or terminal and go to the location of the Syhunt CLI - the default location depends on your OS.
   1. On Linux: cd ${HOME}/syhunt-hybrid/carbon/
   2. On macOS: cd "/Applications/Syhunt Hybrid/carbon"
   3. On Windows:
      1. Open the Windows Start menu and type command in the search box. Right click Command prompt and click Run as administrator.
         
      2. Enter the command cd /d "%ProgramFiles%\Syhunt Hybrid\"
2. Setup the admin account.
   1. Execute the following command to generate and set the admin password: scancore -pwdgen:admin
      
   2. Save the generated password; you will need it later to log in.
3. Run the server:
   1. On Linux or Mac: Run syservicereg, followed by webui_utils --sslenable, and the web UI service will be installed and started.
   2. On Windows: Restart Windows, and the web UI will launch at startup, or, alternatively, run as Administrator scansched -restart if you don't want to reboot.
      
4. Now you can access the web UI.
   1. Open your web browser and navigate to: https://127.0.0.1:8018/syhunt/
   2. Enter the username: admin
   3. Enter the password: the password that has been generated.
      
   4. Click the Sign In button.

Additional Steps and Notes

• On Alma Linux: If the web UI service fails to properly start, you may need to permanently disable SELinux: sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config && sudo reboot. After that, the web UI service should run as expected.
• On Windows, once the admin password is set, the web UI is launched each time the Hybrid Scheduler service starts. This ensures that the web UI remains running even if the current user logs out. On Linux, the Syhunt Web UI service will do the same.

Creating additional user accounts

Execute the following command to set additional accounts: scancore -pwdgen:someusername

Changing the default UI language

If you want the web UI to use a different language, run the command: scancore -langset:CODE

See the available language codes

Password Policy

To strengthen security and ensure compliance, Syhunt 7.1 introduces a strict web UI password policy, enforcing the following requirements:

1. Minimum Password Length
   1. Non-admin accounts: Minimum 16 characters
   2. Admin accounts: Minimum 26 characters
2. Password Reuse Restrictions
   1. Admin accounts: Cannot reuse the last 24 passwords
   2. Non-admin accounts: Cannot reuse the last 10 passwords
3. Password Complexity Requirements
   1. Must not include the username or parts of the user's full name
   2. Must contain at least:
      1. One uppercase letter (A-Z)
      2. One lowercase letter (a-z)
      3. One digit (0-9)
      4. One non-alphabetic character (e.g., @, #, $, %)
   3. Must not contain:
      1. Three or more identical consecutive characters (e.g., AAA)
      2. Three consecutive ascending or descending characters (e.g., 123, 321, ABC, CBA)

With these enhanced security measures, Syhunt 7.1 ensures stronger protection against password-related threats while maintaining compliance with industry standards. When setting a new password, the above requirements will be observed. After upgrading, if any of these patterns are found in a previously set password at the moment of login, you will need to reset your password.

To simplify password generation, Syhunt 7.1 adds the -pwdgen:[username] parameter to the scancore command, which generates a password securely, sets it and prints the generated password to the output, but if you prefer to input it manually, you can still use the -pwdset parameter.

Configuring User Roles

When you are logged in as Administrator, you can change the role of any user to Operator, Restricted Operator or Viewer. The following are the existing roles:

• Administrator - The admin can launch and view results of all launched scans, edit user permissions and preferences and run console commands. Currently, just a single admin account is allowed.
• Operator - A user with this role can launch and view results of all launched scans.
• Restricted Operator - A user with this role can launch scans but only view the results of the scans launched by himself.
• Viewer - A user with this role can view results of all launched scans, but is not able to launch any scans.

Permissions (Each Role)

Role	Admin	Operator	Restricted Operator	Viewer
Administrative alerts at Home screen
Ability to Delete things (Scans/Targets/Users/Connectors)
User Access Control
Access to Users screen
Ability to create a new user
Ability to change the role of a user
Access to User profile		Only own	Only own	Only own
Permission to invalidate user sessions		Only own	Only own	Only own
Permission to change a user's password		Only own	Only own	Only own
Scans and Targets
Permission to launch scans
Access to Targets screen and preferences				(Read-Only)
Access to Scan info (logs/comparison/findings/summary/map/reports/exports/debug/list)			Depends*
Access to Action info (inc. preview)			Depends*
Administrative Screens
Access to Scheduled scan list
Access to individual Scheduled scan info
Access to Connectors screen
Access to Command Console
Access to Global Preferences/List screen (inc. Export)
Access to Scheduler log (if enabled)
Import Options
Import API specification
Insert/Update Product License

(*) Restricted Operator can only access this info for sessions started by himself/herself

Tips

Scheduler time mismatch

If the time shown on the Scan Scheduler screen does not match your operating system's time, run the following command to correct it:

• MacOS: sudo /usr/sbin/systemsetup -settimezone "Europe/Lisbon" (replace Europe/Lisbon with your zone)
• Linux: sudo timedatectl set-timezone Europe/Lisbon (replace Europe/Lisbon with your zone)

Scanning private repositories

• Before using the web UI to scan private GIT repositories, use the scancode CLI command instead to test launch the scan after properly configuring your repository credentials or SSH keys.

Limitations

• Direct connection to non-GIT Azure (TFS) repositories are not supported on Linux or Mac machines.