Add instructions for allow BHCE deployment WITHOUT forcing admin password change

[7MinSec]

Hello,

I learned a wonderful tidbit in your Slack about how BHCE could be deployed without forcing an admin password change (handy when you're going to run tools/queries against a BH instance on a headless system).

If you run this:

./bloodhound-cli config set default_admin.expire_now False

And then run a fresh BHCE deployment, you're good to go! Here's the full chat context if it helps:

This would be great to add to your documentation please!

[superlinkx]

Just to note for future discussion: this was intentionally left undocumented due to it and setting a default password directly being security concerns. I think it's come up enough times to warrant proper documentation, but we will want to make sure the documentation gives appropriate warnings for these more sensitive fields. There are valid use cases for automated deployments, but I want us to be up front about the potential risks if they're going to be more user facing.

[3isenHeiM]

It could be nice to have the bloodhound-cli tool packages within the BloodHound docker image in order to have this low-level control on the application at runtime. What do you think ? Is it worth an issue ?

[superlinkx]

bloodhound-cli was primarily designed as a wrapper around the docker image. Ultimately, it's just modifying config/env vars to toggle functionality in the container before starting the container. Modifying these parameters while the application is running isn't really possible, since the application only checks config file/env vars at startup

[3isenHeiM]

Fair enough ;)

Is it possible to put this variable inside an env var ? Something like bhe_default_admin_expire_now=false ? I don't see any docs on env vars...

For now, I'm able to achieve this by bind-mounting (read-only) the bloodhound.config.json file with this content

  "default_admin": {
    "expire_now": false
  }

[superlinkx]

You should be able to set it with that env var. There's some documentation here on the wiki for how to format env vars, and all config options are parsed from env vars as long as they're formatted correctly

[3isenHeiM]

For posterity, here is the link to the doc.

The variable to set in the compose file is

      - bhe_default_admin_expire_now=${bhe_default_admin_expire_now}

And in the .env

bhe_default_admin_expire_now=false