Deployment guide

Dradis

Overview

Dradis Community Edition is an open-source collaboration and reporting framework for security assessments and penetration tests. It gives a team one place to import scanner output (Nmap, Nessus, Burp Suite, OpenVAS, Qualys and more), organize findings on a shared project tree, and generate consistent reports.

This SecureAnyCloud image installs Dradis CE v5.2.0 from the official dradis/dradis-ce repository (GPL-2.0) on a hardened Ubuntu 24.04 base, patched at build time. It runs Dradis as a Ruby on Rails 8 application under Puma, fronted by nginx.

There is no default login. Dradis CE uses a single shared password, and each VM generates that password and the Rails SECRET_KEY_BASE uniquely on first boot. Nothing is baked into the image.

What you get:

Dradis Community Edition v5.2.0 at /home/dradis/dradis-ce
Ruby 3.4.6 built with rbenv/ruby-build (the tag's pinned .ruby-version)
Rails 8.0 on Puma 7, bound to 127.0.0.1:3000 and reverse-proxied by nginx on :80
A SQLite production database, plus Redis and a Resque background worker
Precompiled assets (sprockets, importmap and mini_racer), so Node.js is not needed
dradis-firstboot.service, which generates the per-VM shared password and SECRET_KEY_BASE and completes the CE setup wizard non-interactively
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet.

Standard_B2s (2 vCPU, 4 GB RAM) is the recommended size for evaluation and small teams. Move to D2s_v5 or larger for bigger teams or heavy scanner imports.

Deploy from the Azure Marketplace

Search the Azure Marketplace for "Dradis Community Edition on Ubuntu 24.04 LTS", click Get It Now, then click Create.

Choose your resource group, region, VM size (Standard_B2s recommended) and SSH public key. In the network security group, allow inbound port 80 (HTTP) and port 22 (SSH).

SSH into the VM

Connect to the VM over SSH:

ssh azureuser@<vm-ip>

The first boot takes 30-60 seconds. During that time the VM generates its per-VM secrets, prepares the database, seeds the setup and starts the services. Wait for the first-boot sentinel before you browse to the site:

while [ ! -f /var/lib/sac/data/dradis-firstboot.done ]; do echo "waiting..."; sleep 5; done; echo "READY"

Verify the services

Check that the four services are active and that the expected ports are listening:

sudo systemctl is-active redis-server dradis dradis-resque nginx
sudo ss -tlnp | grep -E ':80 |:3000 '

All four services report active. nginx listens on :80, and Puma listens on 127.0.0.1:3000.

Read the per-VM shared password

Read the credentials file as root:

sudo cat /root/dradis-credentials.txt

Note DRADIS_SHARED_PASSWORD and DRADIS_URL from the file. Treat both as secrets. The file is mode 0600 root:root.

Confirm the version

Print the first line of the application changelog:

head -1 /home/dradis/dradis-ce/CHANGELOG

The command prints the Dradis release line, for example v5.2.0 (July 2026).

Confirm secure-by-default access

Dradis ships with no usable default credentials. The site is gated behind the login, and the per-VM shared password is the only way in. Run the bundled check to see a wrong password rejected and the correct one accepted:

sudo /usr/local/sbin/dradis-authcheck.sh

A correct password lands on the authenticated project view (HTTP 200), and a wrong password is bounced back to /login.

Every application page requires the shared password, so there is no open interface. Confirm it with these requests:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/
# 302 -> /login
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/login
# 200 (public login form)

Log in

Browse to http://<vm-ip>/login. Enter any user name to identify yourself, and enter the DRADIS_SHARED_PASSWORD from Step 4 as the password.

Explore the project overview

After you log in, you land on the project overview. The node tree is on the left, and the Overview, Issues, Methodologies, Upload, Export and QA tabs run across the top.

Manage issues

Open the Issues view, where your findings live. Create issues by hand or generate them from imported scanner output. You can tag and prioritize them, and reuse them across nodes.

Import scanner output

Open the Upload manager to ingest output from the supported tools (Nmap, Nessus, Burp, OpenVAS, Qualys and others). Dradis turns the output into nodes, issues and evidence on the project tree.

Components

These are the key components and their paths:

Dradis install: /home/dradis/dradis-ce/
SQLite database: /home/dradis/dradis-ce/storage/production.sqlite3
Environment file: /etc/dradis/dradis.env (holds SECRET_KEY_BASE)
Puma service: dradis.service (127.0.0.1:3000)
Resque worker: dradis-resque.service
nginx site: /etc/nginx/sites-available/dradis
First-boot script: /usr/local/sbin/dradis-firstboot.sh
Credential round-trip check: /usr/local/sbin/dradis-authcheck.sh
Credentials: /root/dradis-credentials.txt (mode 0600 root:root)
Ruby (rbenv): /home/dradis/.rbenv/shims/ruby (3.4.6)

Change the shared password

After you sign in, open Configuration > Manage (the gear icon at the top right). There you can change the shared password, enable per-user accounts and adjust the session timeout.

Rotate the initial per-VM password before you add your team.

Back up your data

Back up two things: the SQLite database and any uploaded attachments. This example copies the database:

sudo systemctl stop dradis dradis-resque
sudo cp /home/dradis/dradis-ce/storage/production.sqlite3 /root/dradis-db-$(date +%Y%m%d).sqlite3
sudo systemctl start dradis dradis-resque

Support

SecureAnyCloud provides 24/7 support for this image. For Dradis usage and integrations, see the upstream documentation at https://dradis.com/ce/.

Deploy on Azure

Launch Dradis Community Edition on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Dradis Community Edition is an open-source collaboration and reporting framework for security assessments and penetration tests. It gives a testing team one place to import output from the tools they already use (Nmap, Nessus, Burp Suite, OpenVAS, Qualys and more). You can organize findings on a shared project tree of nodes, issues and evidence, manage methodologies and testing checklists, and generate consistent client reports.

This SecureAnyCloud image builds Dradis from the official upstream dradis/dradis-ce source at a pinned release. It runs as a Ruby on Rails application under Puma, bound to the loopback interface only, behind an nginx reverse proxy that terminates TLS on port 443. Security is enforced from first boot, and no shared password is baked into the image.

What you get:

Dradis Community Edition v5.2.0, the GPL-2.0 licensed reporting framework, built from the official upstream source at the pinned tag
Ruby 3.4.6 built with rbenv/ruby-build (the tag's pinned .ruby-version)
Rails on Puma bound to 127.0.0.1:3000, behind nginx over TLS on port 443 with a per-instance self-signed certificate, and plain HTTP on port 80 redirecting to HTTPS
A SQLite production database and all uploaded evidence attachments on a dedicated data volume at /var/lib/dradis, so your assessment data survives OS-disk changes and the volume can be resized independently
Redis and a Resque background worker for long-running jobs
A single shared login password, the Rails secret key base and the per-instance TLS certificate, all generated for the individual instance on first boot before the application is reachable
The first-run setup completed automatically, so the instance boots straight to a login-gated dashboard with no open setup page
redis-server.service, dradis.service, dradis-resque.service and nginx.service as systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an AWS account, an EC2 key pair in the target region, and a VPC with a public subnet.

m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type for evaluation and small teams. Move to a larger instance for bigger teams or heavy scanner imports.

Configure the security group to allow inbound 22/tcp from your management network for SSH and 443/tcp for the web interface.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, then launch an instance from the AMI into your VPC with the security group described above. Choose the m5.large instance type and attach your EC2 key pair.

The first boot takes 30-60 seconds. During that time the instance generates its per-instance secrets and TLS certificate, prepares the database and completes the setup.

Step 2 - Connect to your instance

Connect over SSH as the default login user for the operating system variant you launched. The login user differs per OS:

Ubuntu 24.04: SSH login user ubuntu, for example ssh -i your-key.pem ubuntu@<instance-public-ip>

ssh -i your-key.pem ubuntu@<public-ip>

Wait for the first-boot sentinel before you browse to the site:

while [ ! -f /var/lib/sac/data/dradis-firstboot.done ]; do echo "waiting..."; sleep 5; done; echo "READY"

Step 3 - Read your unique credentials

On first boot, the instance generates a single shared login password. It writes the password and the resolved web URL to a root-only file. Read it with sudo:

sudo cat /root/dradis-credentials.txt

The file lists DRADIS_URL, DRADIS_LOGIN_EMAIL and DRADIS_SHARED_PASSWORD for this instance. No default or shared login is baked into the image. The password is unique to this instance, and the file is mode 0600 root:root.

Step 4 - Verify services and the security model from the command line

Confirm that all four services are running and that the application listens on loopback behind nginx:

sudo systemctl is-active redis-server dradis dradis-resque nginx
sudo ss -tlnp | grep -E ':443 |:3000 '

Confirm the version from the application's changelog:

head -1 /home/dradis/dradis-ce/CHANGELOG

Dradis ships with no usable default credentials. Every application route redirects an unauthenticated visitor to the login page, and plain HTTP redirects to HTTPS. Only the login form is served without the shared password.

Run the bundled check to see a wrong password rejected and the correct one accepted:

sudo /usr/local/sbin/dradis-authcheck.sh

A correct password lands on the authenticated project view (HTTP 200), and a wrong password is bounced back to /login.

You can also check the front door directly. The instance uses a self-signed certificate, so curl -k skips verification:

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/
# 302 -> /login
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/login
# 200 (public login form)
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/
# 301 -> https

Step 5 - Sign in to the web interface

Browse to https://<instance-public-ip>/login. The instance uses a per-instance self-signed TLS certificate, so accept the browser certificate warning, or front it with your own domain and certificate.

Enter any user name to identify yourself, and enter the DRADIS_SHARED_PASSWORD from Step 3 as the password.

Step 6 - Explore the project overview

After you log in, you land on the project overview. The node tree is on the left, and the Overview, Issues, Methodologies, Upload, Export and QA tabs run across the top.

The overview summarizes findings by rating and lists recent activity.

Step 7 - Manage issues

Open the Issues view, where your findings live. Create issues by hand or generate them from imported scanner output. You can tag and prioritize them, and reuse them across nodes.

Each row shows the finding, its tags, the affected hosts and its review state.

Step 8 - Review issue and evidence detail

Open a finding to edit its title, rating and description. You can attach evidence that links the finding to specific hosts.

Track review with the CVSS, DREAD and MITRE scoring tabs and a comment thread.

Step 9 - Import scanner output

Open the Upload view to ingest output from the supported tools (Nmap, Nessus, Burp, OpenVAS, Qualys and others). Dradis turns the output into nodes, issues and evidence on the project tree.

Pick the tool, choose the state for the imported records, and upload the file.

Step 10 - Components

These are the key components and their paths:

Dradis install: /home/dradis/dradis-ce/
SQLite database: /var/lib/dradis/storage/production.sqlite3 (dedicated data volume)
Uploaded evidence: /var/lib/dradis/attachments/ (dedicated data volume)
Environment file: /etc/dradis/dradis.env (holds SECRET_KEY_BASE)
TLS certificate: /etc/dradis/tls/ (per-instance, generated on first boot)
Puma service: dradis.service (127.0.0.1:3000)
Resque worker: dradis-resque.service
nginx site: /etc/nginx/sites-available/dradis (TLS on :443, :80 redirects to HTTPS)
First-boot script: /usr/local/sbin/dradis-firstboot.sh
Credential round-trip check: /usr/local/sbin/dradis-authcheck.sh
Credentials: /root/dradis-credentials.txt (mode 0600 root:root)
Ruby (rbenv): /home/dradis/.rbenv/shims/ruby (3.4.6)

Step 11 - Change the shared password and enable per-user accounts

After you sign in, open Configuration > Manage (the gear icon at the top right). There you can change the shared password, enable per-user accounts and adjust the session timeout.

Rotate the initial per-instance password before you add your team.

Step 12 - Backup

Back up two things: the SQLite database and any uploaded attachments. Both live on the dedicated data volume, so an EBS snapshot of that volume captures everything. This example copies the database:

sudo systemctl stop dradis dradis-resque
sudo cp /var/lib/dradis/storage/production.sqlite3 /root/dradis-db-$(date +%Y%m%d).sqlite3
sudo systemctl start dradis dradis-resque

For a point-in-time backup of the whole assessment dataset, take an EBS snapshot of the /var/lib/dradis volume or use AWS Backup.

Support

SecureAnyCloud provides 24/7 support for this image by email and live chat at sales@secureanycloud.com. For Dradis usage and integrations, see the upstream documentation at https://dradis.com/ce/.

Deploy on AWS

Launch Dradis Community Edition with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS