ks-gen turns a small YAML file into a fully baked AlmaLinux 9 kickstart that:
- Applies the upstream DISA STIG profile via
scap-security-guide+oscap xccdf eval --remediatefrom a%postblock. - Stays remote-safe by default — won't lock you out of a cloud or headless box.
- Substitutes civilian text for DoD-specific banners, certificate bundles, time servers.
- Emits an
exceptions.mdaudit report naming every XCCDF rule it disables and why.
See MANUAL.md for the operator's reference.
pipx install .
ks-gen new --out ./build
# Walks you through a few prompts, writes ./build/<hostname>/{host.yaml,ks.cfg,tailoring.xml,exceptions.md}
ks-gen gen --config ./build/<hostname>/host.yaml --out ./build/<hostname>
ks-gen iso --src AlmaLinux-9-latest-x86_64-dvd.iso \
--ks ./build/<hostname>/ks.cfg \
--tailoring ./build/<hostname>/tailoring.xml \
--out ./<hostname>-installer.isoDelivery modes: HTTP (inst.ks=http://…/ks.cfg) or ISO
(inst.ks=hd:LABEL=<volid>:/ks.cfg, with the ISO from ks-gen iso).
Both run oscap remediation at install time; see MANUAL.md §5.4.
| Command | Purpose |
|---|---|
ks-gen new |
Interactive wizard; produces the 4-file bundle |
ks-gen gen |
Non-interactive re-render from host.yaml |
ks-gen lint |
Validate a ks.cfg (ksvalidator + invariants) |
ks-gen iso |
Repackage the AlmaLinux DVD ISO with kickstart embedded |
ks-gen rules |
List the override rule catalog |
ks-gen schema |
Emit JSON Schema for host.yaml |
ks-gen verify --host <addr> --config <host.yaml> |
Re-run oscap on a deployed host, reconcile failures against host.yaml, report compliance + drift. Exits 0 on clean, 6 on failures, 7 on transport error. Pass --check-tailoring to also diff the deployed /root/tailoring.xml against your current host.yaml (exit 8 if drift is detected and compliance is otherwise clean). Use --capture-baseline <path> and --baseline <path> to reconcile against an operator-captured ARF instead of the install-time ARF. Defaults to passwordless sudo -n; pass --ask-sudo-pass to use password-based sudo (read from KSGEN_SUDO_PASSWORD, or prompted). Use --hosts <file> instead of --host/--config to verify a whole fleet in parallel (see §8.5 Fleet mode in the manual). Use --local --config <host.yaml> to run the check on the host itself with no SSH (requires root; suitable for a systemd timer) — local mode rejects the SSH flags and --apply (run --apply from the workstation). Add --format html (or --html-out <file>) to produce a self-contained HTML report; in --hosts fleet mode it is one page covering every host. Add --record <dir> to capture a slim per-run record for trend tracking; read it back with ks-gen verify-history. |
ks-gen verify-history <dir> |
Load a --record history store and show per-host run timelines, persistent-failure streaks, and a since-last-run delta. --host NAME limits to one host; --format json emits the same data as JSON. Read-only: no SSH, no oscap, no host.yaml. |
0 success · 1 usage · 2 config invalid · 3 rule conflict · 4 lint failure · 5 external tool missing · 6 verify failures · 7 verify transport error · 8 verify tailoring drift.
GPL-3.0-or-later, with an output exception for the
kickstart files, tailoring XML, exception reports, and installer ISOs
that ks-gen produces — operators retain full discretion over how to
license and distribute their generated artifacts. See LICENSE
for the full GPL text. Aligned with pykickstart (GPL-2.0-or-later),
which ks-gen links against.