Dradis Community Edition on AWS User Guide

Overview

Dradis Community Edition is an open source collaboration and reporting framework for security assessments and penetration tests. It gives a testing team one place to import output from the tools they already use (Nmap, Nessus, Burp Suite, OpenVAS, Qualys and more), organize findings on a shared project tree of nodes, issues and evidence, manage methodologies and testing checklists, and generate consistent client reports.

This cloudimg image builds Dradis from the official upstream dradis/dradis-ce source at a pinned release and runs it as a Ruby on Rails application under Puma, bound to the loopback interface only. A host nginx reverse proxy terminates TLS on port 443 with a per-instance self-signed certificate; plain HTTP on port 80 redirects to HTTPS. Redis and a background worker handle long-running jobs, and the SQLite database plus all uploaded evidence attachments live on a dedicated data volume mounted at /var/lib/dradis, so your assessment data survives OS-disk changes and is resizable independently.

Security is enforced from first boot. Dradis CE authenticates with a single shared login password: this image never bakes one in. Before the application is reachable, the shared password, the Rails secret key base and the per-instance TLS certificate are all generated for the individual instance, and the first-run setup is completed automatically so the instance boots straight to a login-gated dashboard with no open setup page. Backed by 24/7 cloudimg support.

What is included:

• Dradis Community Edition v5.2.0, the GPL-2.0 licensed reporting framework, built from the official upstream source at the pinned tag
• Ruby 3.4.6 built with rbenv/ruby-build (the tag's pinned .ruby-version)
• Rails on Puma bound to 127.0.0.1:3000, behind nginx over TLS on port 443
• SQLite production database and uploaded evidence on a dedicated data volume at /var/lib/dradis
• Redis and a Resque background worker for long-running jobs
• A single shared login password, the Rails secret key base and the per-instance TLS certificate generated on first boot
• The first-run setup completed automatically so no open setup page is exposed
• redis-server.service, dradis.service, dradis-resque.service and nginx.service as systemd units
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type for evaluation and small teams; move to a larger instance for bigger teams or heavy scanner imports. Security group inbound: allow 22/tcp from your management network for SSH and 443/tcp for the web UI.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI into your VPC with the security group described above. Choose the m5.large instance type and attach your EC2 key pair. The first boot takes 30-60 seconds while the instance generates its per-instance secrets and TLS certificate, prepares the database and completes the setup.

Step 2 - Connect to your instance

Connect over SSH as the default login user for the operating system variant you launched. The login user differs per OS, so use the row for your variant:

ssh -i your-key.pem ubuntu@<public-ip>

Wait for the first-boot sentinel before browsing:

while [ ! -f /var/lib/cloudimg/dradis-firstboot.done ]; do echo "waiting..."; sleep 5; done; echo "READY"

Step 3 - Read your unique credentials

On first boot the instance generates a single shared login password and writes it, along with the resolved web URL, to a root-only file. Read it with sudo:

sudo cat /root/dradis-credentials.txt

You will see DRADIS_URL, DRADIS_LOGIN_EMAIL and DRADIS_SHARED_PASSWORD for this instance. There is no default or shared login baked into the image; the password is unique to this instance and the file is mode 0600 root:root.

Step 4 - Verify services and the security model from the command line

Confirm all four services are running and that the application listens on loopback behind nginx:

sudo systemctl is-active redis-server dradis dradis-resque nginx
sudo ss -tlnp | grep -E ':443 |:3000 '

Confirm the version from the application's own changelog:

head -1 /home/dradis/dradis-ce/CHANGELOG

Dradis ships with no usable default credentials. Every application route redirects an unauthenticated visitor to the login page, plain HTTP redirects to HTTPS, and only the login form is served without the shared password. Prove the reject-versus-accept behaviour with the bundled check:

sudo /usr/local/sbin/dradis-authcheck.sh

A correct password lands on the authenticated project view (HTTP 200); a wrong password is bounced back to /login. You can see the front door directly (the instance uses a self-signed certificate, so curl -k skips verification):

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/          # 302 -> /login
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/login     # 200 (public login form)
curl -s  -o /dev/null -w '%{http_code}\n' http://127.0.0.1/           # 301 -> https

Step 5 - Sign in to the web UI

Browse to https://<instance-public-ip>/login. The instance uses a per-instance self-signed TLS certificate, so accept the browser certificate warning (or front it with your own domain and certificate). Enter any user name to identify yourself, plus the DRADIS_SHARED_PASSWORD from Step 3.

Step 6 - The project overview

After login you land on the project overview, with the node tree on the left and the Overview, Issues, Methodologies, Upload, Export and QA tabs across the top. The overview summarizes findings by rating and lists recent activity.

Step 7 - Issues

The Issues view is where findings live. Create issues by hand or generate them from imported scanner output, tag and prioritize them, and reuse them across nodes. Each row shows the finding, its tags, the affected hosts and its review state.

Step 8 - Issue and evidence detail

Open a finding to edit its title, rating and description, attach evidence linking it to specific hosts, and track review with the CVSS, DREAD and MITRE scoring tabs and a comment thread.

Step 9 - Import scanner output

The Upload view ingests output from the supported tools (Nmap, Nessus, Burp, OpenVAS, Qualys and others) and turns it into nodes, issues and evidence on the project tree. Pick the tool, choose the state for the imported records, and upload the file.

Step 10 - Components

Step 11 - Change the shared password and enable per-user accounts

Once signed in, open Configuration > Manage (the gear icon, top-right) to change the shared password, enable per-user accounts, and adjust the session timeout. Rotate the initial per-instance password before adding your team.

Step 12 - Backup

The two things to back up are the SQLite database and any uploaded attachments - both live on the dedicated data volume, so an EBS snapshot of that volume captures everything:

sudo systemctl stop dradis dradis-resque
sudo cp /var/lib/dradis/storage/production.sqlite3 /root/dradis-db-$(date +%Y%m%d).sqlite3
sudo systemctl start dradis dradis-resque

For a point-in-time backup of the whole assessment dataset, take an EBS snapshot of the /var/lib/dradis volume, or use AWS Backup.

Support

cloudimg provides 24/7 support for this image by email and live chat at support@cloudimg.co.uk. For Dradis usage and integrations, see the upstream documentation at https://dradis.com/ce/.