Prerequisites

It is recommended that you use a dedicated server or VM to run the Kenna Agent. Please make sure that your firewall rules allow the Kenna Agent to talk to your internal connectors as well as reach out to Kenna.

These scanners are currently supported:

• Nexpose
• Nessus
• Sonatype
• BlackDuck

Important: The machine must have network access to your scanner and the Kenna Security API.

Recommended specifications:

Note: HTTP/S proxying is supported. Refer to the Proxy for Agent section.

Windows server-based installs are not supported at this time. If you are interested, please let us know.

Important: When using a proxy or firewall, you will need to whitelist the following addresses:

• api.kennasecurity.com
• packages.kennasecurity.com
• app.kennasecurity.com
• api.us.kennasecurity.com
• app.us.kennasecurity.com

Important: Please open a support ticket to ask that the Agent UI feature flag be turned on. This will enable the checkbox for the agent to be shown on the connector setup page.

Install the Agent

Tip: You can execute the commands as Root if you do not wish to use sudo.

In the Command Prompt, create a new "kenna.repo" file using

$ sudo touch /etc/yum.repos.d/kenna.repo

Edit the newly created kenna.repo file; enter and save the following content:

[kennasecurity]
name=Kenna Security
baseurl=https://packages.kennasecurity.com/rpm/
enabled=1
gpgkey=https://packages.kennasecurity.com/rpm/kenna_security_packages.gpg.public
repo_gpgcheck=1
gpgcheck=0

Next, you are ready to begin the install process. Based on your OS, enter the appropriate command. 

Fedora 28+

$ sudo dnf install kenna-agent

RHEL 7+, CentOS 7+

$ sudo yum install kenna-agent

When prompted, enter "y" to confirm to accept the key.

Enter "y" again to confirm to download the agent.

Connector Setup

You must first select a connector if you have no existing connector before proceeding with the connector setup.  Log in to your Kenna Account, click the Connectors tab to select a connector. 

Once you have selected a connector, the connector-specific setup page opens as shown below.

Click the Use Kenna Agent checkbox. If there is no checkbox visible, open a support ticket and request that the feature flag for Agent UI be enabled.

Fill in Username, Password, Host information as well as select the desired Schedule, if not already completed.

Note: You can make changes to your cron as required. Changes to the Schedule change the config snippet as shown. 

Important: The connector ID is blank initially and only populates after the connector is saved.

Note: All times are in UTC.

Click Save to confirm your changes. 

Important: By clicking Save, the Run and Upload & Run buttons are clickable but their functionality will be disabled.

Any previously set schedule will not work and all new connector runs will be completed using the Kenna Agent.

Configure the Agent

Note: A connector must be added, as shown in the pervious section, before proceeding configuring the agent.

Important: You require your Kenna API token to configure and use the Kenna Agent.

Log into Kenna and navigate to API keys menu option.

Locate your API key and click the Copy button to copy the API token.

Edit the "/etc/kenna-agent/kenna-agent.toml" file. 

In the kenna-agent.toml file, complete and save the following information:

To manually kick-off the connector outside of the scheduled window, you must log into the agent console and run the following command:

kenna-agent oneshot

Multiple Connectors Setup

The Kenna-Agent allows for multiple connectors to be set up simultaneously by simply editing the kenna-agent.toml file as shown.

[kenna]
url = "https://api.kennasecurity.com"
token = "your token"

[connector.nexpose]
id = 12345
type = "nexpose"
url = "https://nexpose.example.com"
username = "user"
password = "pass"
schedule = "*45 23 * * *"

[connector.blackduck]
id = 12346
type = "blackduck"
url = "https://blackduck.example.com"
username = "user"
password = "pass"
schedule = "55 23 * * *"

Kenna-Agent runs each connector when the schedule is set.
Important: Ensure that schedules are spread out to avoid encountering memory errors.

Directory Connector

A directory connector gathers all files inside a specified directory, uploads them to conduit, and starts a connector run. To set up a directory connector, you need to create a connector to which you upload files.

Important: Agent will pick up all files in the given directory for each run.

[kenna]
url = "https://api.kennasecurity.com"
token = "your token"

[connector.directory.nexpose]
id = 
type = "directory"
url = "file:/home/kenna/Downloads/nexpose"
username = ""
password = ""
schedule = "*45 23 * * *"

Start and Enable the Agent

Once installation is complete, you are ready to run the agent. Enter to start the agent.

$ sudo systemctl enable kenna-agent

In the Command Prompt, enter "kenna-agent check" to check the configuration details of the Kenna Agent. Use this command to troubleshoot issues by reviewing the Check Summary.

Updating the Agent

When a new version is available, you can upgrade/update the Kenna Agent using the appropriate command for your OS:

Fedora 28+

$ sudo dnf update kenna-agent

RHEL 7+, CentOS 7+

$ sudo yum update kenna-agent

When an update or upgrade is available, running the info kenna-agent command results in system notification detailing the current version and the new version that is available.

Fedora 28+

$ sudo dnf info kenna-agent 

RHEL 7+, CentOS 7+

$ sudo yum info kenna-agent 

Proxy for Agent

When a proxy is used, the agent is capable of working with HTTP and HTTPS settings. 

In the command prompt, enter the following command: 

$ sudo systemctl edit kenna-agent.service

In the editor, create/add an environment variable override.

Note: For different proxy settings, multiple environment variables can be added.

[Service]
Environment=HTTPS_PROXY=https://myproxy:4566(replace the URL with your proxy)
Environment=HTTP_PROXY=https://myproxy:4566

Enter the following command to restart the Kenna Agent. After adding or creating the variables, save the changes and exit the editor.

$ sudo systemctl restart kenna-agent.service 

Helpful commands

Start agent:

$ sudo systemctl start kenna-agent

Enable agent:

$ sudo systemctl enable kenna-agent

Stop agent:  

$ sudo systemctl stop kenna-agent

Agent process status:

$ sudo systemctl status kenna-agent

Check config details:

$ kenna-agent check 

Run connector from the terminal:

To manually kick-off the connector outside of the scheduled window, you must log into the agent console and run the following command:

$ kenna-agent oneshot