Overview

Installation
- cnquery
- cnspec
Scan your target platform
Package Information
Kubernetes

Status

Docker Containers:
Homebrew:
Install.sh:
Install.ps1:
macOS Pkg:
Arch Linux:

Installation

The easiest way to install cnquery & cnspec is to use the install scripts.

via Shell Script (Linux and macOS)

https://install.mondoo.com/sh

bash -c "$(curl -sSL https://install.mondoo.com/sh)"

via PowerShell (Windows)

https://install.mondoo.com/ps1

Set-ExecutionPolicy Unrestricted -Scope Process -Force;
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072;
iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'));
Install-Mondoo;

Scan your target platform

Scan your target platform:

# query system information with incident and inventory query pack
cnquery scan aws
# scan the platform for security vulnerabilities
cnspec scan aws

cnspec login -t 'eyJh...llZ4BW'

cnquery & cnspec support local and remote targets, including servers (Linux, Windows, macOS), Cloud (AWS, Azure, Google, VMware), Kubernetes (EKS, GKE, AKS, self-managed), containers, container registries, SaaS products (Google Workspace, MS365, GitHub, GitLab), and more.

Run a scan:

# scan your local host
cnspec scan local

# scan a cloud environment
cnspec scan aws
cnspec scan gcp
cnspec scan azure

# scan a kubernetes cluster
cnspec scan k8s

# scan a docker image from a remote registry
cnspec scan docker image debian:12

# scan a docker container (get ids from docker ps)
cnspec scan docker container 00fa961d6b6a

# scan a system over ssh
cnspec scan ssh ec2-user@54.76.229.223

Package Information

https://install.mondoo.com/package/cnspec/{platform}/{arch}/{filetype}/{version}/{method}

The arguments support the following values:

Argument	Values
`platform`	`linux`, `windows`, `darwin`
`arch`	`amd64`, `arm64`, `armv7`, `armv6`, `386`, `ppc64le`
`filetype`	`tar.gz`, `deb`, `rpm`, `zip`, `pkg`, `msi`
`version`	`latest` or specific number
`method`	`download`, `filename`, `version`, `sha256`

# Download the latest version
https://install.mondoo.com/package/cnspec/linux/arm64/rpm/latest/download

# Get the filename for the latest cnspec package
https://install.mondoo.com/package/cnspec/linux/arm64/rpm/latest/filename

# Get the version for the latest cnspec package
https://install.mondoo.com/package/cnspec/linux/arm64/rpm/latest/version

# Get the sha256 for the latest cnspec client
https://install.mondoo.com/package/cnspec/linux/arm64/rpm/latest/sha256

# Download a specific version of cnspec client
https://install.mondoo.com/package/cnspec/linux/arm64/rpm/5.21.1/download

# Get the sha256 for a specific version of cnspec Client
https://install.mondoo.com/package/cnspec/linux/arm64/rpm/5.21.1/sha256

Kubernetes

Kubernetes Manifests to install the operator

https://install.mondoo.com/k8s/operator

kubectl apply -f https://install.mondoo.com/k8s/operator

Kubernetes manifest to configure the MondooAuditConfig

https://install.mondoo.com/k8s/auditconfig?nodes=true&kubernetesResources=true

kubectl apply -f https://install.mondoo.com/k8s/auditconfig?nodes=true&kubernetesResources=true

To browse all releases, please visit https://releases.mondoo.com

References

Install Scripts Sources

install.sh - cnquery & cnspec Bash Installer
download.sh - cnquery & cnspec Bash Binary Downloader
install.ps1 - cnquery & cnspec PowerShell Installer
download.ps1 - cnquery & cnspec PowerShell Binary Downloader

Config Management

Docker Containers

Releases

Code Signature Verification

Mondoo signs Microsoft Windows executables, PowerShell scripts, Linux packages and code signs Apple macOS executables. The public code signing certificate and public GPG key ist store in the Installer Repo.

Public certificate for code signing public-code-signing.cer
Public GPG key for package signing public-package-signing.gpg

Microsoft

To verify the integrity of the cnquery or cnspec executable, please use Microsoft's Get-AuthenticodeSignature PowerShell command and compare the Thumbprint.

PS > $file = ".\mondoo_8.15.0_windows_amd64.msi"
PS > (Get-AuthenticodeSignature -FilePath $file).SignerCertificate | Format-List

Subject      : CN="Mondoo, Inc", O="Mondoo, Inc", L=Cary, S=North Carolina, C=US
Issuer       : CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Thumbprint   : EE97D1E3C6CD96E06C47B0233DD7C6CE2684FA50
FriendlyName :
NotBefore    : 7/26/2022 12:00:00 AM
NotAfter     : 8/23/2023 11:59:59 PM
Extensions   : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid,
               System.Security.Cryptography.Oid...}

To verify the integrity of the Mondoo PowerShell install.ps1 script, please use Microsoft's Get-AuthenticodeSignature PowerShell command and compare the SignerCertificate.

Get-AuthenticodeSignature .\install.ps1

SignerCertificate                         Status
-----------------                         ------
EE97D1E3C6CD96E06C47B0233DD7C6CE2684FA50  Valid

Apple macOS

To verify the integrity of the cnquery or cnspec executable, please use Apple's codesign utility and compare the TeamIdentifier field, which should match the one below.

codesign --verify -d --verbose=2 /usr/local/bin/cnspec
Executable=/Library/Mondoo/bin/cnspec
Identifier=cnspec
Format=Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=2124850 flags=0x10000(runtime) hashes=66396+2 location=embedded
Signature size=9054
Authority=Developer ID Application: Mondoo, Inc. (W2KUBWKG84)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=25. Apr 2023 at 19:47:53
Info.plist=not bound
TeamIdentifier=W2KUBWKG84
Runtime Version=11.0.0
Sealed Resources=none
Internal requirements count=1 size=168

Current & Previous PGP Public Keys

Current Key

The current PGP public key from Mondoo has ID 00E1C42B / fingerprint 4CE909E26AE7439C39CE7647AC69C65100E1C42B and is:

Previous Keys

Key ID 00E1C42B / fingerprint 4CE909E26AE7439C39CE7647AC69C65100E1C42B:

You can download Mondoo's public PGP key from (both are identical):

mondoohq / installer

readme