Dradis Community Edition - Security Reporting

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Dradis Community Edition is an open source collaboration and reporting framework for security assessments and penetration tests. It gives a testing team one place to import output from the tools they already use (Nmap, Nessus, Burp Suite, OpenVAS, Qualys and more), organize findings on a shared project tree of nodes, issues and evidence, manage methodologies and testing checklists, and generate consistent client reports. Under the hood Dradis is a Ruby on Rails application backed by SQLite, with Redis and a background worker for long-running jobs. This AMI delivers Dradis installed, hardened and secured so a working reporting platform is operational within minutes of launch.

## Why This Image vs a Manual Install

Standing Dradis up by hand means installing a specific Ruby toolchain, building the application from source at a known-good release, precompiling assets, wiring up Redis and a background worker, generating the Rails secret key base, and putting an authenticated, encrypted front door in front of it so the reporting tool is not left open on the internet. This image completes every one of those steps at build time. Dradis is built from the official upstream source at a pinned release and runs under Puma bound to the loopback interface only; an nginx reverse proxy terminates TLS on port 443 with a per-instance self-signed certificate; the Rails secret key base and the single shared login password are generated on each instance's first boot; and the first-run setup is completed automatically so the instance boots straight to a login-gated dashboard with no open setup page.

## Security Hardening

This image follows a defence in depth approach:

• No default or shared credentials: the shared login password and the Rails secret key base are never baked into the image; a unique value for each is generated on every instance's first boot and written to a root-only file
• No open setup page: the first-run setup is completed automatically at first boot, so the instance never exposes an unauthenticated privileged setup wizard
• Login-gated by default: every application route redirects an unauthenticated visitor to the login page; only the login form and an unauthenticated health probe are served without the shared password
• Encrypted front door: nginx terminates TLS on port 443 with a per-instance self-signed certificate; plain HTTP on port 80 redirects to HTTPS
• Network isolation: the application binds exclusively to the loopback interface behind nginx; the database is a local file, never a network service
• Dedicated data volume: the SQLite database and uploaded evidence attachments live on their own disk, surviving OS-disk changes and resizable independently

## Concrete Use Cases

• Centralize a penetration test: import scanner and tool output from across a team, organize every node, issue and piece of evidence on one shared project tree, and keep the whole engagement in a single place instead of scattered spreadsheets
• Consistent client reporting: turn findings, methodologies and evidence into a repeatable report using Dradis templates, so every assessment lands with the same structure and quality
• Team collaboration on findings: let assessors work the same project concurrently, tagging and prioritizing issues and reusing an issue library across nodes and engagements

## AWS Integration

Deploy on any EC2 instance type; the recommended size is m5.large. Terminate TLS at an Application Load Balancer with your own certificate, or keep the per-instance self-signed certificate. Back up the SQLite database and uploaded evidence using EBS snapshots or AWS Backup, and resize the dedicated data volume independently of the OS disk as your projects grow.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, enabling per-user accounts, reverse-proxy termination with your own domain and certificate, importing scanner output, tuning report templates, and backup planning for your assessment data.