Skip to content

ks-gen — remote-safe DISA STIG kickstart generator for AlmaLinux 9

ci License: GPL v3+ Python Latest release Open issues

ks-gen turns a small YAML file into a fully baked AlmaLinux 9 kickstart that:

  • Applies the upstream DISA STIG profile via scap-security-guide + oscap xccdf eval --remediate from a %post block.
  • Stays remote-safe by default — won't lock you out of a cloud or headless box.
  • Substitutes civilian text for DoD-specific banners, certificate bundles, time servers.
  • Emits an exceptions.md audit report naming every XCCDF rule it disables and why.

See MANUAL.md for the operator's reference.

Quickstart

pipx install .
ks-gen new --out ./build
# Walks you through a few prompts, writes ./build/<hostname>/{host.yaml,ks.cfg,tailoring.xml,exceptions.md}

ks-gen gen --config ./build/<hostname>/host.yaml --out ./build/<hostname>
ks-gen iso --src AlmaLinux-9-latest-x86_64-dvd.iso \
           --ks ./build/<hostname>/ks.cfg \
           --tailoring ./build/<hostname>/tailoring.xml \
           --out ./<hostname>-installer.iso

Delivery modes: HTTP (inst.ks=http://…/ks.cfg) or ISO (inst.ks=hd:LABEL=<volid>:/ks.cfg, with the ISO from ks-gen iso). Both run oscap remediation at install time; see MANUAL.md §5.4.

Subcommands

Command Purpose
ks-gen new Interactive wizard; produces the 4-file bundle
ks-gen gen Non-interactive re-render from host.yaml
ks-gen lint Validate a ks.cfg (ksvalidator + invariants)
ks-gen iso Repackage the AlmaLinux DVD ISO with kickstart embedded
ks-gen rules List the override rule catalog
ks-gen schema Emit JSON Schema for host.yaml
ks-gen verify --host <addr> --config <host.yaml> Re-run oscap on a deployed host, reconcile failures against host.yaml, report compliance + drift. Exits 0 on clean, 6 on failures, 7 on transport error. Pass --check-tailoring to also diff the deployed /root/tailoring.xml against your current host.yaml (exit 8 if drift is detected and compliance is otherwise clean). Use --capture-baseline <path> and --baseline <path> to reconcile against an operator-captured ARF instead of the install-time ARF. Defaults to passwordless sudo -n; pass --ask-sudo-pass to use password-based sudo (read from KSGEN_SUDO_PASSWORD, or prompted). Use --hosts <file> instead of --host/--config to verify a whole fleet in parallel (see §8.5 Fleet mode in the manual). Use --local --config <host.yaml> to run the check on the host itself with no SSH (requires root; suitable for a systemd timer) — local mode rejects the SSH flags and --apply (run --apply from the workstation). Add --format html (or --html-out <file>) to produce a self-contained HTML report; in --hosts fleet mode it is one page covering every host. Add --record <dir> to capture a slim per-run record for trend tracking; read it back with ks-gen verify-history.
ks-gen verify-history <dir> Load a --record history store and show per-host run timelines, persistent-failure streaks, and a since-last-run delta. --host NAME limits to one host; --format json emits the same data as JSON. Read-only: no SSH, no oscap, no host.yaml.

Exit codes

0 success · 1 usage · 2 config invalid · 3 rule conflict · 4 lint failure · 5 external tool missing · 6 verify failures · 7 verify transport error · 8 verify tailoring drift.

License

GPL-3.0-or-later, with an output exception for the kickstart files, tailoring XML, exception reports, and installer ISOs that ks-gen produces — operators retain full discretion over how to license and distribute their generated artifacts. See LICENSE for the full GPL text. Aligned with pykickstart (GPL-2.0-or-later), which ks-gen links against.

About

Remote-safe DISA STIG kickstart generator for AlmaLinux 9

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Used by

Contributors

Languages