No instructions on how to work with GRR installed using Docker Compose

[bogdan77604]

Environment

• What GRR version are you running?: [3.4.7.3]
• What operating system does the GRR server run on? [e.g. Ubuntu 24.04]
• What operating system does the affected GRR client run on, if applicable? [Windows 10]

Describe the issue
I installed GRR using the docker composer from the official gitHub.
I pulled it up and then went to the GUI. I was not prompted for authentication, but was automatically logged in as gui_user. Moreover, to enter the database settings, I had to search for the .env file to find the default authorisation data.

root@grr:/grr/grr# docker compose ps
WARN[0000] /grr/grr/compose.yaml: `version` is obsolete 
NAME                      IMAGE                              COMMAND                  SERVICE                   CREATED         STATUS                             PORTS
fleetspeak-admin          ghcr.io/google/fleetspeak:latest   "server -components_…"   fleetspeak-admin          2 minutes ago   Up 43 seconds                      4444/tcp
fleetspeak-frontend       ghcr.io/google/fleetspeak:latest   "server -components_…"   fleetspeak-frontend       2 minutes ago   Up 43 seconds                      4443/tcp, 10000/tcp
grr-admin-ui              ghcr.io/google/grr:latest          "/bin/bash -c '/conf…"   grr-admin-ui              2 minutes ago   Up 42 seconds (healthy)            0.0.0.0:8000->8000/tcp, :::8000->8000/tcp
grr-client                ubuntu:22.04                       "/bin/bash -c '/conf…"   grr-client                2 minutes ago   Up 11 seconds (health: starting)   
grr-db                    mysql:8.2                          "docker-entrypoint.s…"   db                        2 minutes ago   Up About a minute (healthy)        0.0.0.0:3306->3306/tcp, :::3306->3306/tcp, 33060/tcp
grr-fleetspeak-frontend   ghcr.io/google/grr:latest          "grr_server -compone…"   grr-fleetspeak-frontend   2 minutes ago   Up 43 seconds                      11111/tcp
grr-worker                ghcr.io/google/grr:latest          "grr_server -compone…"   grr-worker                2 minutes ago   Up 43 seconds                      

I wanted to run the command "grr_config_updater show_user", but I tried to enter different containers and none of them executed without an error

I also don't have clients installed properly...

Could someone please explain how to work with this utility in the docker compose

Error logs

Copy-and-paste logs from the command you executed, GRR server log files, or flow logs.

Additional context
Add any other context about the problem here.

[s-westphal]

Hello bogdan77604, thank you for opening this issue.

To enable the authentication prompt in the UI you can update the server configuration file by adding AdminUI.webauth_manager: BasicWebAuthManager.

To add another user, that can then be used in the authentication you would connect to e.g. the grr-admin-ui container and add the user:

docker exec -it grr-admin-ui /bin/bash
root@admin-ui:/usr/src/grr# grr_config_updater --config /configs/server/grr.server.yaml add_user <new-user-name>

(grr_config_updater assumes the configuration to be in a different location than where is mounted in the docker compose configuration, which is why the --config command line option needs to be set, I will update the documentation with that.

The docker compose stack has a grr-client container running that can be examined as an example. You should be able to find this client by searching for "." in the "Collect from client" tab in the UI. To make it more interesting, you can mount a local directory in it, or install/run some applications in it.

I hope this helps, let us know if you have further questions!

[victorle-sec]

Hi @bogdan77604
I also encountered this issue when setting up GRR with docker compose. When running command grr_config_updater show_user on container of grr_admin_ui, it showed a lot of error messages related to database. Then I've found that the grr_config_updater loads configurations from the file located at /usr/src/grr/grr/core/install_data/etc/server.local.yaml, though it doesn't exist in reality. After trying copy /configs/server/grr.server.yaml to the file named server.local.yaml, the previous command actually worked and I could add another user with admin role. However, when accessing the AdminUI website again, it still logged me in automatically with user gui_user. Hope this problem could be addressed soon 🙏

[bogdan77604]

Hi, @victorle-sec
I don't remember how, but I added a new user with the admin role. But the problems didn't end there. Fleetspeak still doesn't set up properly, clients won't deploy to the host client machines, and I don't understand why.
I was writing my thesis on the use of GRR, and I encountered a lot of problems. The program is really for very advanced users... But I don't understand why it is impossible to perform a basic function such as deploying GRR clients.

[mbushkov]

@bogdan77604 we would appreciate if you could share a bit more information and the logs, so that we could look into the problem:

Fleetspeak still doesn't set up properly

Do you mean Fleetspeak server? Does it happen when you turn up the docker compose? Could you please share the logs?

clients won't deploy to the host client machines, and I don't understand why.

Please describe what exactly you were trying to do so that we could try to reproduce the issue. Also, if you have any log files, we would appreciate them as well.