Prerequisites
- Python 3.10+ on the machine running Kensa (the control host)
- SSH access to target hosts (key-based or password)
- Sudo privileges on target hosts for privileged checks (most compliance rules require root access)
Kensa runs entirely from the control host over SSH. Nothing is installed on target systems.
Installation
pip install git+https://github.com/Hanalyx/kensa.git
pip install "git+https://github.com/Hanalyx/kensa.git#egg=kensa[pdf]"
Download the RPM for your distribution from the latest release:dnf install ./kensa-1.2.2-1.el9.noarch.rpm
git clone https://github.com/Hanalyx/kensa.git
cd kensa
pip install -e ".[dev]"
SSH setup
Kensa needs SSH access to target hosts.
Key-based (recommended)
Password
# Ensure your SSH key can reach the target
ssh admin@192.168.1.10 "echo connected"
# Use -p to prompt securely for a password
kensa check -h 192.168.1.10 -u admin -p --sudo
-p flag without a value prompts interactively with hidden input. You can also pass a password inline with -p mypassword, but interactive prompting is more secure.# On the target host, grant passwordless sudo:
echo "admin ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/kensa
Your first scan
Detect host capabilities
kensa detect -h 192.168.1.10 -u admin --sudo
Run compliance checks
kensa check -h 192.168.1.10 -u admin --sudo
| Status | Meaning |
|---|
| PASS | Host meets the compliance requirement |
| FAIL | Host does not meet the requirement — remediation available |
| SKIP | Rule does not apply to this host |
| ERROR | Check could not complete |
508 rules: 312 pass, 142 fail, 48 skip, 6 error (45.2s)
Generate structured output
# JSON output
kensa check -h 192.168.1.10 -u admin --sudo -o json:results.json
# CSV for spreadsheets
kensa check -h 192.168.1.10 -u admin --sudo -o csv:results.csv
# Multiple formats in one run
kensa check -h 192.168.1.10 -u admin --sudo \
-o json:results.json -o csv:results.csv
# Evidence export (full command output for auditor verification)
kensa check -h 192.168.1.10 -u admin --sudo -o evidence:evidence.json
Filtering rules
You rarely need to run all 508 rules. Kensa provides several ways to focus your scan:
# By framework
kensa check -h 192.168.1.10 -u admin --sudo -f cis-rhel9-v2.0.0
# By specific control
kensa check -h 192.168.1.10 -u admin --sudo --control cis-rhel9-v2.0.0:5.1.12
# By severity
kensa check -h 192.168.1.10 -u admin --sudo -s high -s critical
# By category
kensa check -h 192.168.1.10 -u admin --sudo -c access-control
Scanning multiple hosts
Use an inventory file to scan multiple hosts in parallel:
[webservers]
web1.example.com
web2.example.com
[databases]
db1.example.com ansible_user=dbadmin
# Scan all hosts, 4 in parallel
kensa check -i hosts.ini --sudo -w 4
# Scan only the webservers group
kensa check -i hosts.ini --sudo -l webservers
Next steps
