Remote Access Security Tips

Remote Access Security Tips

Your link leads to a tool that can run commands on the machine behind it. Protect it like the key to your computer.

Use a strong, unique web console login

• Let XHack generate one for you: Generate new login in the app, or xhack tunnel --rotate-login on a server. Keep it in a password manager.
• Never reuse a password from another site.
• The web console login is separate from your xhack.io account. They should also be different from each other.

The link alone is not access, but treat it as sensitive

Opening your link lands on the web console's sign-in page. Without the password nobody gets in. Still:

• Do not post it publicly. A quiet link has a smaller target around it.
• Do not paste it into chat threads where you cannot delete or revoke.
• Do not share it with anyone you would not share a root password with.

Never share your pairing code

The code is read from your own device and typed into the website. XHack staff will never ask for it, or for your web console login.

Deny any request you did not start

If a new approval request appears on your account and you did not start it:

1. Deny it on xhack.io → Settings → Remote access.
2. Change your xhack.io password.
3. Turn on two-factor authentication if it is available.
4. Revoke approved devices you no longer use.

Rotate the login

Rotate the web console login on a schedule, and always after:

• an engagement ends;
• you shared the link with anyone, even briefly;
• a device goes missing;
• you suspect the address or password leaked.

In the app: Settings → Remote → Login → Rotate User. On a VPS: xhack tunnel --rotate-login.

Revoke devices you no longer use

Old laptops, destroyed VPSes, lost phones, test servers that outlived their engagement. A revoked device cannot bring your link online again without a fresh approval.

Turn Remote Access off when you do not need it

Turning it off also unticks Turn on automatically when XHack starts, so the link stays offline until you turn it on yourself. On a server: xhack tunnel stop.

Sign out on computers that are not yours

• Sign out of the web console when you leave the device.
• Never let the browser save the web console password there.
• Lock your own computer. Anyone at your unlocked machine can use XHack directly, settings and all.

Keep XHack updated

Updates ship security fixes. Keep the desktop app current, and run xhack --version on your servers from time to time to confirm you are not far behind.

On a VPS

• Use a dedicated user account with only the permissions XHack needs.
• Keep the server patched.
• Do not open the web console's port to the internet yourself. Remote Access already makes it reachable safely through your link.
• Destroy the server when the work is done. The safest console is one that no longer exists.

Related

• Remote Access overview
• Deploy Remote Access on a VPS
• Approve a device
• Manage your devices
• Troubleshooting