Note on the AFF4 datastore deprecation
Starting from the version 18.104.22.168 GRR uses a new datastore format by default - REL_DB. REL_DB is backwards-incompatible with the now-deprecated AFF4 datastore format (even though they both use MySQL as a backend).
Use of AFF4-based deployments is now discouraged. REL_DB is expected to be much more stable and performant. Please see these docs if you’re upgrading an older GRR version and would like to try out the new datastore.
Installing from a release server deb (recommended)¶
This is the recommended way of installing the GRR server components. GRR server debs are built for Ubuntu 18.04 Bionic. They may install on Debian or other Ubuntu versions, but compatibility is not guaranteed.
MySQL is GRR’s default database backend, and should be up and running before installing GRR. The database framework can be run alongside GRR on the same machine, or on a remote machine. Here’s how you would install the community edition of MySQL from Ubuntu repositories:
apt install -y mysql-server
If you have never installed MySQL on the machine before, you will be prompted for a password for the ‘root’ database user. After installation completes, you will typically want to create a new database user for GRR and give that user access an empty database that the GRR server installation will use:
mysql -u root -p
mysql> SET GLOBAL max_allowed_packet=41943040; mysql> CREATE USER 'grr'@'localhost' IDENTIFIED BY 'password'; mysql> CREATE DATABASE grr; mysql> GRANT ALL ON grr.* TO 'grr'@'localhost';
Please note: GRR is senstive to the MySQL’s
max_allowed_packetsetting. Make sure it’s not lower than 20971520. Creation of a new user is optional though since GRR can use the credentials of the root user to connect to MySQL.
Download the latest server deb from https://github.com/google/grr/releases:
Install the server deb, along with its dependencies, like below:
sudo apt install -y ./grr-server_3.4.2-3_amd64.deb
The installer will prompt for a few pieces of information to get things set up. After successful installation, the
grr-serverservice should be running:
root@grruser-bionic:/home/grruser# systemctl status grr-server ● grr-server.service - GRR Service Loaded: loaded (/lib/systemd/system/grr-server.service; enabled; vendor preset: enabled) Active: active (exited) since Wed 2017-11-22 10:16:39 UTC; 2min 51s ago Docs: https://github.com/google/grr Process: 10404 ExecStart=/bin/systemctl --no-block start grr-server@admin_ui.service email@example.com firstname.lastname@example.org email@example.com (code=exited, status=0/SUCCESS) Main PID: 10404 (code=exited, status=0/SUCCESS) Tasks: 0 Memory: 0B CPU: 0 CGroup: /system.slice/grr-server.service Nov 22 10:16:39 grruser-bionic systemd: Starting GRR Service... Nov 22 10:16:39 grruser-bionic systemd: Started GRR Service.
In addition, administrative commands for GRR, e.g
grr_config_updatershould be available in your PATH.