On-premises deployment

4 min

, , , ,

Hacktron Enterprise runs as a single-VM appliance in your environment. This page covers first boot and the operator tasks that Whitebox pentests need. Before you start here, follow the version-specific install or import instructions supplied with your release package.

First boot

Boot the appliance

Start the delivered VM or complete the Enterprise installer. Keep an operator account with SSH access available for setup and maintenance.

Open the setup wizard

Desktop appliances open the wizard in Chromium. For a headless or remote VM, forward the wizard’s loopback port from your workstation:

ssh -L 8081:127.0.0.1:8081 <operator>@<vm-ip>

Open http://127.0.0.1:8081 while the tunnel is running. Do not expose port 8081 on the network, because the wizard stores appliance secrets and controls stack restarts.

Enter the configuration

Set the first admin account, the application URL, and the model provider. If the appliance must reach an internal Git server, add its hostname under Internal Git host(s). Add any private or inspection CA certificates under Trusted CA certificates.

Save and start

Select Save & Start. The appliance writes its configuration and starts the local services. Startup normally takes one to two minutes.

Open the application URL and sign in with the admin credentials from the wizard. On later boots, the configured stack starts automatically.

Allow an internal Git host

The appliance blocks private network destinations unless an operator allows the hostname. This protects server-side URL requests and still lets the appliance reach a GitHub Enterprise Server or self-hosted GitLab instance inside your network.

Open the setup wizard through the SSH tunnel.
Enter one or more comma-separated hostnames under Internal Git host(s), for example ghe.corp.internal,gitlab.corp.internal. Enter hostnames only, without a scheme or path.
If the server certificate uses a private CA or TLS inspection, paste or upload its PEM chain under Trusted CA certificates.
Select Save & Restart.

Allow only the hosts Hacktron needs. Adding a hostname does not turn off TLS certificate validation.

Test connected repositories and archives

An on-premises Whitebox pentest can use either an enabled connected repository or a source archive.

For GitHub Enterprise Server, finish the GitHub Enterprise Server connection first and enable the repository for the organisation. The repository then appears under Connected sources in the Whitebox scan wizard.

To upload source instead, open Upload archive in the repository step. The appliance accepts .zip, .7z, .tar.gz, and .tgz files up to 2 GiB. It stores the archive in its own local object storage, so the upload needs no external storage service.

Collect logs in an air-gapped environment

The appliance can build a diagnostic archive without contacting Hacktron. Run:

sudo /opt/enterprise/bin/support-bundle.sh

The command writes an archive that only its owner can read to:

/opt/enterprise/support-bundles/support-<version>-<UTCtimestamp>.tar.gz

The bundle includes service status, recent container logs, complete per-scan worker logs, host resource information, and migration state. It also includes the shape of each configuration file, with secret values masked. Review the archive for sensitive metadata, then send it to Hacktron Support through your organisation’s approved process.

Basic checks

If the application is still unavailable after the initial startup period, check the service state and the backend logs:

sudo docker compose -f /opt/enterprise/docker-compose.yml ps
sudo docker compose -f /opt/enterprise/docker-compose.yml logs --tail 100 enterprise-iva

If the wizard is unavailable, check its service, then reopen the SSH tunnel:

sudo systemctl status enterprise-setup-ui.service

Next steps

Connect GitHub Enterprise Server repositories for Whitebox pentests, or set the scope, estimate the credits, and start a pentest.

GitHub Enterprise Server Quickstart