CHAI DART™ — Assessment Prerequisites

Requirements for Running Discovery & Assessment · 2026 Edition · General Distribution

"Stop Modernizing in the Dark. Start with Truth."

At a Glance

Ensure the following are in place before starting a DART assessment project.

CHAI Host

CHAI appliance deployed & running
Reachable over HTTPS (port 443)
Valid CloudHedge license active

Source Hosts

Linux: SSH port 22 open
Windows: WinRM HTTPS port 5986 open
Outbound HTTPS (443) back to CHAI host
Supported OS version (see §3 & §4)

Credentials

SSH key or password (Linux)
Local/domain admin account (Windows)
Stored in CHAI Vault before discovery

1. CHAI Host

DART discovery runs from the CHAI appliance. The appliance must be fully deployed and operational before any assessment project is created.

Note: CHAI host installation and deployment prerequisites are covered in a separate document — CHAI Installation & Deployment Prerequisites. Ensure that document's checklist is complete before proceeding.

Hardware Requirements

Machine	OS	CPU & RAM	Disk Space
CHAI™ Appliance	Ubuntu 16+ / RHEL 7.6+, 8.x	4 cores · 16 GB RAM (minimum)	50 GB for `/opt` · 100 GB for `/var`

CHAI web UI must be accessible over HTTPS
A valid CloudHedge license key must be active
The CHAI host must have outbound network access to all source hosts being assessed

2. Linux Source Hosts

Supported Operating Systems

OS	Supported Versions
Red Hat Enterprise Linux	7.x, 8.x
Ubuntu	16.04 and above

Resource Requirements

Resource	Minimum
CPU	4 cores
RAM	8 GB
Disk — `/home`	> 500 MB
Disk — `/opt`	> 2 GB (must have executable permissions)

SSH & Access Requirements

Requirement	Detail
SSH daemon	SSHD must be running and accessible on port 22
Authentication	Username + SSH private key, or username + password
User privilege	The SSH user must have passwordless `sudo` access for DART tools (see below)
Callback	Outbound HTTPS port 443 must be open back to the CHAI appliance

Sudoers Configuration

Add the following two entries to /etc/sudoers (replace <ssh-user> with the actual SSH username):

# Allow DART tool execution without password
<ssh-user> ALL=(ALL) NOPASSWD:/opt/.ch-tools/*/*/*, /opt/.ch-tools/*/*, /bin/mkdir

# Disable requiretty — CHAI connects remotely without a real terminal
Defaults:<ssh-user>    !requiretty

Both entries are required. Missing the !requiretty line will cause discovery to fail even if sudo permissions are correct.

Supported Application Servers (Non-X-Ray Discovery)

For the following Java application servers, DART reads configuration directly — no X-Ray probes required:

Oracle WebLogic 12.1.3 / 12.2.1.4 IBM WebSphere 8.x / 9.x Apache Tomcat 7 / 8 / 9 / 10 JBoss EAP 6.1

3. Windows Source Hosts

Supported Operating Systems

OS	Supported Versions
Windows Server	2012 R2, 2016, 2019, 2022

Resource Requirements

Resource	Minimum
CPU	4 cores
RAM	8 GB
Disk (C:\)	> 20 GB free

Prerequisites Checklist

Requirement	Detail
PowerShell	Version 3 or above — verify with `$PSVersionTable.PSVersion`
Admin credentials	User account must have local Administrator or domain Administrator rights
Execution Policy	LocalMachine scope must be `RemoteSigned` (see below)
WinRM / port 5986	WinRM HTTPS enabled with self-signed SSL certificate on port 5986
UAC bypass	Required for local accounts only — not needed for domain/AD accounts (see below)
Antivirus	Add `winchtoolpy.exe` to the antivirus exclusion list
Callback	Outbound HTTPS port 443 must be open back to the CHAI appliance

Step 1 — Set Execution Policy

Run in PowerShell as Administrator. Check current policy first:

Get-ExecutionPolicy -List

If LocalMachine shows Undefined, set it to RemoteSigned:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

Step 2 — Configure WinRM

Download and run the CloudHedge-provided script as Administrator. It automatically enables PSRemoting, configures Basic authentication, generates a self-signed SSL certificate, and opens port 5986:

.\ConfigureRemoting.ps1

Step 3 — UAC Remote Restriction Bypass (local accounts only)

Skip this step if using domain or Active Directory accounts. For local administrator accounts, run as Administrator:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
  -Name "LocalAccountTokenFilterPolicy" -Value 1

Not required for domain accounts. Only apply this setting when using a local Windows administrator account.

4. Network & Ports

Required Connectivity

Direction	From	To	Port	Purpose
Outbound	CHAI Host	Linux source hosts	22 (SSH)	Discovery & X-Ray probes
Outbound	CHAI Host	Windows source hosts	5986 (WinRM HTTPS)	Discovery
Inbound	Linux source hosts	CHAI Host	443 (HTTPS)	Data callback
Inbound	Windows source hosts	CHAI Host	443 (HTTPS)	Data callback

Project limit: Each DART project supports up to 50 hosts (Linux and Windows combined). Plan projects accordingly for large estates.

5. Credentials & Vault

All credentials must be stored in the CHAI Vault before running discovery. Credentials are never stored in plaintext.

Credential Type	Used For	Details
SSH private key	Linux host access	Preferred over password auth; stored per project in Vault
SSH username/password	Linux host access	Alternative to key-based auth
WinRM credentials	Windows host access	Local or domain administrator account; stored in Vault

Credentials are added via CHAI UI → Project → Vault before initiating discovery. A single set of credentials can be shared across all hosts in a project, or set per-host.

Pre-Assessment Checklist

CHAI Host

[ ] CHAI appliance deployed and accessible over HTTPS
[ ] CloudHedge license key active

Linux Hosts

[ ] OS: RHEL 7.x/8.x or Ubuntu 16+ confirmed
[ ] Resources: 4 cores · 8 GB RAM · /home >500 MB · /opt >2 GB with executable permissions
[ ] SSHD running; port 22 open from the CHAI host
[ ] SSH user has passwordless sudo for /opt/.ch-tools/ paths
[ ] Defaults:<ssh-user> !requiretty added to /etc/sudoers
[ ] SSH key or password loaded into CHAI Vault
[ ] Outbound HTTPS port 443 open back to the CHAI host

Windows Hosts

[ ] OS: Windows Server 2012 R2 or later confirmed
[ ] Resources: 4 cores · 8 GB RAM · C:\ >20 GB free
[ ] PowerShell version 3+ confirmed ($PSVersionTable.PSVersion)
[ ] Execution Policy set to RemoteSigned at LocalMachine scope
[ ] ConfigureRemoting.ps1 script run — WinRM HTTPS on port 5986 active
[ ] LocalAccountTokenFilterPolicy set to 1 (local accounts only)
[ ] winchtoolpy.exe added to antivirus exclusion list
[ ] Administrator credentials loaded into CHAI Vault
[ ] Outbound HTTPS port 443 open back to the CHAI host

Project Setup

[ ] All host credentials loaded into CHAI Vault
[ ] DART project created with target cloud & region set
[ ] All hosts added to the project (via manual entry or CSV bulk upload)
[ ] Connectivity check run and passed for all hosts

For licensing, image registry credentials, or deployment assistance — contact your CloudHedge account team.
Migrate Anything. Modernize Everything. Break Nothing.