Dradis Community Edition - Pentest Reporting Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Dradis Community Edition is an open-source collaboration and reporting framework for security assessments and penetration tests. It has been actively developed for over a decade and integrates with widely used security tools including Nmap, Nessus, Burp Suite, OpenVAS, and Qualys. Testing teams use Dradis to import scanner output, organize findings on a shared project tree of nodes, issues, and evidence, manage methodologies and testing checklists, and generate consistent client reports. Under the hood, Dradis is a Ruby on Rails application backed by SQLite, with Redis and a background worker for long-running jobs. This AMI delivers Dradis installed, hardened, and secured so a working reporting platform is operational within minutes of launch.

## Why This Image vs. a Manual Install

Standing Dradis up by hand means installing a specific Ruby toolchain, building the application from source at a known-good release, precompiling assets, wiring up Redis and a background worker, generating the Rails secret key base, and putting an authenticated encrypted front door in front of it. This image completes every one of those steps at build time:

• Dradis is built from the official upstream source at a pinned release and runs under Puma bound to the loopback interface only
• An nginx reverse proxy terminates TLS on port 443 with a per-instance self-signed certificate
• The Rails secret key base and the single shared login password are generated on each instance's first boot
• The first-run setup is completed automatically so the instance boots straight to a login-gated dashboard with no open setup page

## Security Hardening

This image follows a defence-in-depth approach:

• No default or shared credentials: the shared login password and the Rails secret key base are generated uniquely on every instance's first boot and written to a root-only file
• No open setup page: the first-run setup is completed automatically at first boot, so the instance never exposes an unauthenticated privileged setup wizard
• Login-gated by default: every application route redirects an unauthenticated visitor to the login page; only the login form and an unauthenticated health probe are served without the shared password
• Encrypted front door: nginx terminates TLS on port 443 with a per-instance self-signed certificate; plain HTTP on port 80 redirects to HTTPS
• Network isolation: the application binds exclusively to the loopback interface behind nginx; the database is a local file, never a network service
• Dedicated data volume: the SQLite database and uploaded evidence attachments live on their own disk, surviving OS-disk changes and resizable independently

## Concrete Use Cases

• Centralize a penetration test: import scanner and tool output from across a team, organize every node, issue, and piece of evidence on one shared project tree, and keep the whole engagement in a single place instead of scattered spreadsheets
• Consistent client reporting: turn findings, methodologies, and evidence into a repeatable report using Dradis templates, so every assessment lands with the same structure and quality
• Team collaboration on findings: let assessors work the same project concurrently, tagging and prioritizing issues and reusing an issue library across nodes and engagements

## AWS Integration

Deploy on any EC2 instance type; the recommended size is m5.large. Terminate TLS at an Application Load Balancer with your own certificate, or keep the per-instance self-signed certificate. Back up the SQLite database and uploaded evidence using EBS snapshots or AWS Backup, and resize the dedicated data volume independently of the OS disk as your projects grow.

## Getting Started

Launch the AMI, wait for the instance to reach a running state, and navigate to the public IP over HTTPS. Retrieve the generated shared password from the root-only credentials file via SSH. From there, create your first project, import scanner output, and begin organizing findings. For a guided walkthrough of deployment options - including ALB termination with your own domain, per-user account setup, and EBS backup scheduling - contact cloudimg support.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, enabling per-user accounts, reverse-proxy termination with your own domain and certificate, importing scanner output, tuning report templates, and backup planning for your assessment data.