mondoohq / cnspec Goto Github PK

Asset: i-0b5f....
==========================
Controls:
✕ Fail:  F   0  /etc exists
  Query:
    file("/etc").exists == true

  Result:
    [ok] value: true



Summary (1 assets)
==================

Target:     i-0b5f87....
Score:      A   100/100     (100% completed)
✓ Passed:   0% (0)
✕ Failed:   ███████████████ 100% (1)
! Errors:   0% (0)
» Skipped:  0% (0)

Policies:
A 100  My First Simple Test

cnspec> asset.vulnerabilityReport
asset.vulnerabilityReport: {
  platform: {
    arch: "x86_64"
    name: "ubuntu"
    release: "22.04"
    title: "Ubuntu 22.04.1 LTS, bare metal"
  }
  published: "2022-11-10T14:11:31+01:00"
  stats: {
    advisories: {}
    cves: {}
    exploits: {}
    packages: {
      total: 2315.000000
    }
  }
}
cnspec> asset.title
asset.title: "Ubuntu 22.04.1 LTS, bare metal"

[jdiaz@fedora cnspec (main %=)]$ ./cnspec scan k8s --discover deployments --namespace kube-system --config ~/Downloads/mondoo.json 
→ loaded configuration from /home/jdiaz/Downloads/mondoo.json using source --config
→ using service account credentials
→ discover related assets for 1 asset(s)
→ namespace filter has been set to "kube-system"
→ use cluster name from kube config cluster-name=minikube
→ resolved assets resolved-assets=1
→ connecting to asset kube-system/coredns (k8s-object)

███████████████████████████████████████████████████████████████████████████ 100% kube-system/coredns


Asset: kube-system/coredns
==========================
Data queries:
mondoo.version: "unstable"
platform.title: "Kubernetes Deployment, Kubernetes Cluster"
platform.release: ""
mondoo.jobEnvironment: {
  id: "client.mondoo.com"
  name: "Mondoo Client"
}
platform.arch: ""

Controls:


Summary (1 assets)
==================

Target:     kube-system/coredns
Datapoints: 5

Policies:
.  ..  Platform Overview Information by Mondoo

Report URL: https://console.mondoo.com/space/fleet/2IgUu43unL7aRsy7TC8Haye1vzq?spaceId=exciting-kare-592956

To get more information, please run this scan with "-o full".
[jdiaz@fedora cnspec (main %=)]$              <---- HERE I TYPED 'asdfasdfasdfasdf' AND NOTHING ON THE SCREEN
bash: asdfasdfasdfasdf: command not found...
[jdiaz@fedora cnspec (main %=)]$ 

ports.listening{
  port
  process {
    executable
    pid
  }
  user.name
}

ports.listening{
  port
  process {
    executable
    pid
  }
  user.name
}

cnquery> ports.listening {}
Query encountered errors:
could not detect suitable ports manager for platform: macos
ports.listening: []

cnspec scan terraform ~/workspace/mondoo/github.com/mondoo-operator/.github/terraform/aws --policy-bundle ../cnspec-policies/core/mondoo-terraform-aws-security.mql.yaml 
→ loaded configuration from /home/christian/workspace/mondoo/examples/google-prod-local.yaml using source $MONDOO_CONFIG_PATH
→ using service account credentials
! Scanning with local policy bundles will switch into --incognito mode by default. Your results will not be sent upstream.
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
→ connecting to asset Terraform Static Analysis aws (code)

cnspec scan terraform ~/workspace/mondoo/github.com/mondoo-operator/.github/terraform/aws 
→ loaded configuration from /home/christian/workspace/mondoo/examples/google-prod-local.yaml using source $MONDOO_CONFIG_PATH
→ using service account credentials
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
→ connecting to asset Terraform Static Analysis aws (code)

███████████████████████████████████████████████████████████████████████████ 100% Terraform Static Analysis aws


Asset: Terraform Static Analysis aws
====================================
Data queries:
...
Controls:
. Skipped: Ensure that the API Gateway uses a secure SSL/TLS configuration
...
✓ Pass:  Providers should not contain hard-coded credentials


Summary (1 assets)
==================

Target:     Terraform Static Analysis aws
Score:      A   100/100     (100% completed)
✓ Passed:   ███ 18% (3)
✕ Failed:   0% (0)
! Errors:   0% (0)
» Skipped:  ████████████ 82% (14)

Policies:
.  ..  Platform Overview Information by Mondoo
A 100  Terraform HCL Security Static Analysis for AWS by Mondoo
...

cnspec scan k8s -f ../../cnspec-policies/core/mondoo-kubernetes-security.mql.yaml
→ loaded configuration from /Users/chris/.config/mondoo/mondoo.yml using source default
! Scanning with local policy bundles will switch into --incognito mode by default. Your results will not be sent upstream.
! invalid github token via environment variable, ignoring it
→ discover related assets for 1 asset(s)
→ use cluster name from kube config cluster-name=minikube
→ resolved assets resolved-assets=11
→ connecting to asset K8S Cluster minikube (api)
→ connecting to asset kube-system/coredns (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXKk5iHVE91HlS3VTuesypL3
→ connecting to asset kube-system/coredns-64897985d-b7t87 (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXO8uDDyIl0kV1yJGuCNmopG
→ connecting to asset kube-system/etcd-minikube (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXOU0ibh3ysBgIRmpVZsGxcc
→ connecting to asset kube-system/kube-apiserver-minikube (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXN84ugoY5TIyG9n1TuFPW6Z
→ connecting to asset kube-system/kube-controller-manager-minikube (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXOd9Td7XCgaWYpHtajibRuE
→ connecting to asset kube-system/kube-proxy-f4djp (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXP3754Klh2cTx8UzdInG0nJ
→ connecting to asset kube-system/kube-scheduler-minikube (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXP28wfPDZiWG8kYbb1EVSMR
→ connecting to asset kube-system/storage-provisioner (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXOAOISkLFkSFf6XS5931MAs
→ connecting to asset kube-system/kube-proxy (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXQqJelKFwylrWhLJdEhp4K3
→ connecting to asset kube-system/coredns-64897985d (k8s-object)
→ client> send all results asset=//policy.api.mondoo.com/assets/2FlOXKseCVFsEDkjFfBMjyF62uT
FTL failed to run scan error="1 error occurred:\n\t* rpc error: code = InvalidArgument desc = asset does not match any of the activated policies\n\n"

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0x637d5b0]

goroutine 1 [running]:
go.mondoo.com/cnspec/policy/scan.(*LocalScanner).distributeJob(0xc0007fc780, 0xc001319bd0, {0x86ee748?, 0xc0011d4f60}, {{0x0, 0x0}, {0xc00116af80, 0x35}, {0xc0000c2120, 0x19}, ...})
	/home/benr/actions-runner/_work/cnspec/cnspec/policy/scan/local_scanner.go:180 +0xf50
go.mondoo.com/cnspec/policy/scan.(*LocalScanner).Run(0xc0007fc780, {0x86ee748?, 0xc0011d4f00?}, 0xc0009bfbd0)
	/home/benr/actions-runner/_work/cnspec/cnspec/policy/scan/local_scanner.go:100 +0x12c
go.mondoo.com/cnspec/apps/cnspec/cmd.RunScan(0xc0010f7e00)
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cmd/scan.go:515 +0x317
go.mondoo.com/cnspec/apps/cnspec/cmd.glob..func18(0x0?, {0xc00031fb90?, 0x0?, 0x0?}, 0x0?, 0x0?)
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cmd/scan.go:347 +0xc5
go.mondoo.com/cnquery/apps/cnquery/cmd/builder.dockerImageProviderCmd.func1(0xc000f4d200?, {0xc00031fb90?, 0x7?, 0x7?})
	/home/benr/go/pkg/mod/go.mondoo.com/[email protected]/apps/cnquery/cmd/builder/builder.go:387 +0x2e
github.com/spf13/cobra.(*Command).execute(0xc000f4d200, {0xc00031fab0, 0x7, 0x7})
	/home/benr/go/pkg/mod/github.com/spf13/[email protected]/command.go:920 +0x847
github.com/spf13/cobra.(*Command).ExecuteC(0xbb18a40)
	/home/benr/go/pkg/mod/github.com/spf13/[email protected]/command.go:1044 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
	/home/benr/go/pkg/mod/github.com/spf13/[email protected]/command.go:[96](https://github.com/mondoohq/actions/actions/runs/3376068206/jobs/5603368838#step:6:97)8
go.mondoo.com/cnspec/apps/cnspec/cmd.Execute()
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cmd/root.go:70 +0x25
main.main()
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cnspec.go:6 +0x17

Digest: sha256:f9350303514e8b16af624304215318a2f9ef4ff74b28a64cdc9e6e850f6393a5
Status: Downloaded newer image for mondoo/cnspec:latest

→ syncing assets
DBG got assets details assets=1
DBG asset mapping asset=//assets.api.mondoo.app/spaces/mondoo-github-actions/assets/2Gz67q8Woe5MsAztNXK8RwwC8hf platform-mrn=//platformid.api.mondoo.app/runtime/cicd/actions.github.com/mondoohq-actions/ref/refs-pull-40-merge/run/3376068206/job/docker-build-scan-push/action/__self/hash/3e84d63b07343b5fa4fbf5dbf6fbf41fefd7aa76b4c06ebcfeb1ebde31d072ff
DBG update asset asset=index.docker.io/library/ubuntu@7cfe75438fc7 platform-ids=["//platformid.api.mondoo.app/runtime/docker/images/7cfe75438fc77c9d7235ae502bf229b15ca86647ac01c844b272b56326d56184"]

/usr/bin/docker run ... mondoo/cnspec  "scan" "docker" "image" "mondoo-test:0.1.0" "--output" "compact" "--score-threshold" "0" "--log-level" "debug" ""

...
Status: Downloaded newer image for mondoo/cnspec:latest
Error: accepts 1 arg(s), received 2
Usage:
...

→ loaded configuration from /Users/tsmith/.config/mondoo/mondoo.yml using source default
→ discover related assets for 1 asset(s)
! WARNING: you are using an early access feature feature=GITHUB status=experimental
→ resolved assets resolved-assets=1
→ connecting to asset Tim Smith (api)
! WARNING: you are using an early access feature feature=GITHUB status=experimental
FTL failed to run scan error="1 error occurred:\n\t* rpc error: code = InvalidArgument desc = asset does not match any of the activated policies\n\n"

 ~/d/cnspec   $  cnspec scan github -h
Scan a GitHub organization or repository

Usage:
  cnspec scan github SUBCOMMAND [flags]
  cnspec scan github [command]

Available Commands:
  org
  repo        Scan a GitHub repository
  user        Scan a GitHub user

Flags:
      --annotation stringToString        annotation for asset (default [])
      --ask-pass                         ask for connection password
  -t, --connection string                set the method used to connect to the asset. supported connections are 'local://', 'docker://' and 'ssh://'
      --detect-cicd                      tries to detect CI/CD environments and sets the asset category to 'cicd' if detected (default true)
      --discover string                  enable the discovery of nested assets. Supported are 'all|instances|host-instances|host-machines|container|container-images|pods|cronjobs|statefulsets|deployments|jobs|replicasets|daemonsets'
      --discover-filter stringToString   additional filter for asset discovery (default [])
  -h, --help                             help for github
      --id-detector string               user-override for platform id detection mechanism, supported are hostname, machine-id, aws-ec2, cloud-detect, ssh-host-key, transport-platform-id
  -i, --identity-file string             selects a file from which the identity (private key) for public key authentication is read
      --incognito                        incognito mode. do not report scan results to the Mondoo platform.
      --insecure                         disable TLS/SSL checks or SSH hostkey config
      --inventory-ansible                set inventory format to ansible
      --inventory-domainlist             set inventory format to domain list
      --inventory-file string            path to inventory file
      --no-pager                         disable interactive scan output pagination
      --option stringToString            addition connection options, multiple options can be passed in via --option key=value (default [])
  -o, --output string                    set output format: json, junit, csv, compact, summary, full, report, yaml (default "compact")
      --pager string                     enable scan output pagination with custom pagination command. default is 'less -R'
  -p, --password string                  password e.g. for ssh/winrm
      --path string                      path to a local file or directory that the connection should use
      --policy strings                   list of policies to be executed (requires incognito mode), multiple policies can be passed in via --policy POLICY
  -f, --policy-bundle strings            path to local policy bundle file
      --score-threshold int              if any score falls below the threshold, exit 1
      --sudo                             run with sudo

Global Flags:
      --config string      config file (default is $HOME/.config/mondoo/mondoo.yml)
      --log-level string   set log-level: error, warn, info, debug, trace (default "info")
  -v, --verbose            verbose output

Use "cnspec scan github [command] --help" for more information about a command.

 ~/d/cnspec   $  cnspec scan github org foo --incognito
→ loaded configuration from /Users/tsmith/.config/mondoo/mondoo.yml using source default
! invalid github token via environment variable, ignoring it
→ discover related assets for 1 asset(s)
! WARNING: you are using an early access feature feature=GITHUB status=experimental
→ resolved assets resolved-assets=0
x could not resolve asset error="a valid GitHub token is required, pass --token '<yourtoken>' or set GITHUB_TOKEN environment variable" asset=
FTL failed to run scan error="failed to resolve multiple assets"

docker run -ti --entrypoint=sh mondoo/cnspec                                                                                                                                                                                            / # id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

x could not resolve asset error="Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?" asset=ddb24f700640
FTL failed to run scan error="failed to resolve multiple assets"

$ cnspec scan container ddb24f700640
→ no configuration file provided
! No credentials provided. Switching to --incogito mode.
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=0
x could not resolve asset error="could not find the container reference: cannot list repo index.docker.io/library/ddb24f700640:latest due to missing container registry credentials" asset=ddb24f700640
FTL failed to run scan error="failed to resolve multiple assets"

Summary (11 assets)
===================

Target:     K8s Cluster minikube
✕ Errors:   rpc error: code = InvalidArgument desc = asset does not match any of the activated policies

Target:     kube-system/coredns
✕ Errors:   rpc error: code = InvalidArgument desc = asset does not match any of the activated policies

Target:     kube-system/coredns-565d847f94
✕ Errors:   rpc error: code = InvalidArgument desc = asset does not match any of the activated policies

Target:     kube-system/coredns-565d847f94-l7gxx
Score:      A   100/100     (100% completed)
✓ Passed:   ███████████████ 100% (1)
✕ Failed:   0% (0)
! Errors:   0% (0)
» Skipped:  0% (0)

cnspec scan local --policy cnspec-policies/core/mondoo-linux-security.mql.yaml 
→ loaded configuration from /home/chris/.config/mondoo/mondoo.yml using source default
→ using service account credentials
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x40 pc=0x63136ee]

goroutine 1 [running]:
go.mondoo.com/cnspec/policy.(*Bundle).FilterPolicies(0x0, {0xc000f541a0, 0x1, 0xc000fd1918?})
	/home/benr/actions-runner/_work/cnspec/cnspec/policy/bundle.go:222 +0x12e
go.mondoo.com/cnspec/policy/scan.(*LocalScanner).distributeJob(0xc000863320?, 0xc000fd1b58, {0x8ba2c28?, 0xc001611ec0}, {{0x0, 0x0}, {0xc00138c180, 0x32}, {0xc000582780, 0x19}, ...})
	/home/benr/actions-runner/_work/cnspec/cnspec/policy/scan/local_scanner.go:224 +0x5e8
go.mondoo.com/cnspec/policy/scan.(*LocalScanner).Run(0x8ba2bb8?, {0x8ba2c28?, 0xc001611e60?}, 0xc000fd1b58)
	/home/benr/actions-runner/_work/cnspec/cnspec/policy/scan/local_scanner.go:142 +0x15b
go.mondoo.com/cnspec/apps/cnspec/cmd.RunScan(0xc0010221b0)
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cmd/scan.go:539 +0x35f
go.mondoo.com/cnspec/apps/cnspec/cmd.glob..func18(0x0?, {0xc0000ffb40?, 0x0?, 0x0?}, 0x0?, 0x0?)
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cmd/scan.go:348 +0xd9
go.mondoo.com/cnquery/apps/cnquery/cmd/builder.localProviderCmd.func1(0xc001400000?, {0xc0000ffb40?, 0x2?, 0x2?})
	/home/benr/go/pkg/mod/go.mondoo.com/[email protected]/apps/cnquery/cmd/builder/builder.go:193 +0x2b
github.com/spf13/cobra.(*Command).execute(0xc001400000, {0xc0000ffb20, 0x2, 0x2})
	/home/benr/go/pkg/mod/github.com/spf13/[email protected]/command.go:920 +0x847
github.com/spf13/cobra.(*Command).ExecuteC(0xc192f60)
	/home/benr/go/pkg/mod/github.com/spf13/[email protected]/command.go:1044 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
	/home/benr/go/pkg/mod/github.com/spf13/[email protected]/command.go:968
go.mondoo.com/cnspec/apps/cnspec/cmd.Execute()
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cmd/root.go:76 +0x25
main.main()
	/home/benr/actions-runner/_work/cnspec/cnspec/apps/cnspec/cnspec.go:6 +0x17

$ docker run -ti ubuntu:18.04 bash
...
root@1b3c9f51e368:/# export MONDOO_CONFIG_BASE64=eyJt.....
root@1b3c9f51e368:/# cnspec scan local
....
Controls:
✕ Fail:  B  70  Ensure minimum days between password changes is configured
✓ Pass:  Ensure IMAP and POP3 server are not installed
✓ Pass:  Ensure telnet server is stopped and not enabled
....
✕ Fail:  D  20  Ensure permissions on /etc/cron.daily are configured
✓ Pass:  Ensure rsh server is stopped and not enabled
✓ Pass:  Ensure noexec option set on /dev/shm partition
✓ Pass:  Ensure Samba is stopped and not enabled
. Skipped: Ensure journald is configured to write logfiles to persistent disk
✓ Pass:  Ensure system accounts are non-login
. Skipped: Ensure secure permissions on /etc/group- are set
✓ Pass:  Ensure password hashing algorithm is SHA-512

Vulnerabilities:
  ■  SCORE  PACKAGE  INSTALLED         FIXED             AVAILABLE         
  ■  3.3    login    1:4.5-1ubuntu2.3  1:4.5-1ubuntu2.5  1:4.5-1ubuntu2.3  
  ■  3.3    passwd   1:4.5-1ubuntu2.3  1:4.5-1ubuntu2.5  1:4.5-1ubuntu2.3  

Overall CVSS score: 3.3


Summary (1 assets)
==================

Target:     1b3c9f51e368
Score:      D    25/100     (100% completed)
✓ Passed:   ██████ 43% (100)
✕ Failed:   █████ 30% (70)
! Errors:   ███ 20% (46)
» Skipped:  █ 7% (17)

Policies:
F   0  Linux Security Baseline by Mondoo (deprecated)
F   0  CIS Ubuntu Linux 18.04 LTS Benchmark - Level 1 - Server
.  ..  Platform Overview Information by Mondoo
F   0  CIS Ubuntu Linux 18.04 LTS Benchmark - Level 2 - Server
B  60  Platform End-of-Life Policy by Mondoo
B  67  Platform Vulnerability Policy by Mondoo

Report URL: https://console.mondoo.com/space/fleet/2IKhCIokyTv2SAvAVVTIMdz0Wgi?spaceId=wizardly-sanderson-742451

 ~/dev  cnspec scan k8s lunalectric/
→ loaded configuration from /Users/tsmith/.config/mondoo/mondoo.yml using source default
→ using service account credentials
→ discover related assets for 1 asset(s)
→ discovery option auto is used. This will detect the assets: cluster, jobs, cronjobs, pods, statefulsets, deployments, replicasets, daemonsets
→ resolved assets resolved-assets=5
→ connecting to asset K8s Manifest lunalectric (code)

███████████████████████████████████████████████████████████████████████████ 100% K8s Manifest lunalectric
→ connecting to asset luna/postgres (k8s-object)

███████████████████████████████████████████████████████████████████████████ 100% luna/postgres
→ connecting to asset luna/luna-frontend (k8s-object)

███████████████████████████████████████████████████████████████████████████ 100% luna/luna-frontend
→ connecting to asset luna/postgres (k8s-object)

███████████████████████████████████████████████████████████████████████████ 100% luna/postgres
→ connecting to asset luna/luna-frontend (k8s-object)

███████████████████████████████████████████████████████████████████████████ 100% luna/luna-frontend

 !  ~/d/cnspec   $  cnspec scan github -h
Scan a GitHub organization or repository

Usage:
  cnspec scan github SUBCOMMAND [flags]
  cnspec scan github [command]

Available Commands:
  org
  repo        Scan a GitHub repository
  user        Scan a GitHub user

Flags:

  -o, --output string                    set output format: yaml, json, junit, csv, compact, summary, full, report (default "compact")

 ~/dev  cnspec scan k8s lunaelectric/frontend/frontend.yml --output junit
→ loaded configuration from /Users/tsmith/.config/mondoo/mondoo.yml using source default
→ using service account credentials
→ discover related assets for 1 asset(s)
→ discovery option auto is used. This will detect the assets: cluster, jobs, cronjobs, pods, statefulsets, deployments, replicasets, daemonsets
→ resolved assets resolved-assets=2
→ connecting to asset K8s Manifest frontend (code)

███████████████████████████████████████████████████████████████████████████ 100% K8s Manifest frontend
→ connecting to asset luna/luna-frontend (k8s-object)

███████████████████████████████████████████████████████████████████████████ 100% luna/luna-frontend

❯ ./cnspec shell
→ loaded configuration from /Users/chip/.config/mondoo/mondoo.yml using source default
→ discover related assets for 0 asset(s)
→ resolved assets resolved-assets=0
FTL could not find an asset that we can connect to

 ~/dev  cnspec scan container almalinux:8
→ loaded configuration from /Users/tsmith/.config/mondoo/mondoo.yml using source default
→ using service account credentials
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
→ syncing assets
→ connecting to asset index.docker.io/library/almalinux@56ec0a505cbd (container-image)
! resolver.db> failed to store data, types don't match asset=//assets.api.mondoo.app/spaces/practical-visvesvaraya-957532/assets/2H3sJ4Pw5FDqr8SF5IvLQLxHU7K checksum=aqYNhAltcEb8Us9rrSndGyONs5+/eu8zKLjtc3MhT1V9wzIHoZniQylGNL6k9+ftj8MnoMI/18dd3mMzIxBBhA== data={"type":"\u001bservice"} expected=block received=service
x failed to send datapoints error="1 error occurred:\n\t* failed to store data for \"aqYNhAltcEb8Us9rrSndGyONs5+/eu8zKLjtc3MhT1V9wzIHoZniQylGNL6k9+ftj8MnoMI/18dd3mMzIxBBhA==\", types don't match: expected block, got service\n\n"


Asset: index.docker.io/library/almalinux@56ec0a505cbd
=====================================================
Data queries:
packages.list.length: 149
error: Query encountered errors:
failed to create resource 'service': could not retrieve service list
service: no data available
error: Query encountered errors:
could not determine kernel version
kernel.installed: []
error: Query encountered errors:
could not parse uptime:
os.uptime: 3 seconds
platform.arch: "amd64"
error: Query encountered errors:
run command not supported on this transport
command.stderr: ""
error: Query encountered errors:
run command not supported on this transport
if: no data available
platform.eol.date: 2029-05-31 17:00:00 -0700 PDT
error: Query encountered errors:
could not detect hostname
os.hostname: ""
platform.vulnerabilityReport: {
  platform: {
    arch: "amd64"
    name: "almalinux"
    release: "8.6"
    title: "AlmaLinux 8.6 (Sky Tiger), Docker Image"
  }
  published: "2022-11-04T01:34:45Z"
  stats: {
    advisories: {}
... 7 more lines ...
mondoo.jobEnvironment: {
  id: "client.mondoo.com"
  name: "Mondoo Client"
}
platform.release: "8.6"
mondoo.version: "unstable"
platform.title: "AlmaLinux 8.6 (Sky Tiger), Docker Image"

Controls:
! Error: Ensure events that modify date and time information are collected
✕ Fail:  Ensure audit logs are not automatically deleted
! Error: Ensure tftp server is stopped and not enabled
! Error: Ensure file deletion events by users are collected
✓ Pass:  Ensure secure permissions on /etc/group are set
! Error: Ensure rsyslog Service is enabled
! Error: Ensure HTTP servers are stopped and not enabled
✓ Pass:  Ensure X Window System is not installed
✕ Fail:  F   0  Ensure IPv6 router advertisements are not accepted
! Error: Ensure Avahi server is stopped and not enabled
! Error: Ensure core dumps are restricted
✓ Pass:  Ensure default group for the root account is GID 0
! Error: Ensure rsh server is stopped and not enabled
! Error: Ensure NFS and RPC are stopped and not enabled
✓ Pass:  Ensure system accounts are non-login
✓ Pass:  Ensure UID_MIN is set to 1000
✓ Pass:  Ensure no duplicate group names exist
! Error: Ensure IMAP and POP3 server is stopped and not enabled
✕ Fail:  F   0  Ensure source routed packets are not accepted
✕ Fail:  C  40  Ensure rsyslog default file permissions configured
! Error: Ensure events that modify the system's network environment are collected
! Error: Ensure session initiation information is collected
✓ Pass:  Ensure root group is empty
. Skipped: Ensure secure permissions on all log files are set
✕ Fail:  C  40  Ensure Advanced Intrusion Detection Environment (AIDE) is installed
✕ Fail:  C  40  Ensure IP forwarding is disabled
✕ Fail:  F   0  Ensure broadcast ICMP requests are ignored
✕ Fail:  C  40  Ensure journald is configured to send logs to rsyslog
✓ Pass:  Ensure secure permissions on /etc/gshadow are set
✕ Fail:  F   0  Ensure secure ICMP redirects are not accepted
! Error: Ensure FTP server is stopped and not enabled
✕ Fail:  F   0  Ensure packet redirect sending is disabled
✕ Fail:  C  40  Ensure rsyslog is installed
✕ Fail:  F   0  Ensure access to the su command is restricted
✓ Pass:  Ensure no duplicate GIDs exist
! Error: Ensure rsync service is stopped and not enabled
! Error: Ensure CUPS is stopped and not enabled
✓ Pass:  Ensure secure permissions on /etc/shadow are set
! Error: Ensure filesystem integrity is regularly checked
✕ Fail:  D  20  Ensure audit log storage size is configured
! Error: Ensure talk server is stopped and not enabled
! Error: Ensure LDAP server is stopped and not enabled
✕ Fail:  F   0  Ensure Reverse Path Filtering is enabled
! Error: Ensure login and logout events are collected
✕ Fail:  B  60  Ensure journald is configured to compress large log files
! Error: Ensure events that modify the system's Mandatory Access Controls are collected
✕ Fail:  F   0  Ensure TCP SYN Cookies is enabled
✕ Fail:  C  40  Ensure journald is configured to write logfiles to persistent disk
✓ Pass:  Ensure secure permissions on /etc/gshadow- are set
✓ Pass:  Ensure no known platform CVEs exist
✓ Pass:  Ensure the platform is not End-of-Life
✓ Pass:  Ensure no known platform advisories exist
! Error: Ensure events that modify user/group information are collected
✕ Fail:  D  20  Ensure suspicious packets are logged
✓ Pass:  Ensure each user is a member of a group
! Error: Ensure SNMP server is stopped and not enabled
✓ Pass:  Ensure secure permissions on /etc/passwd are set
! Error: Ensure NIS server is stopped and not enabled
✓ Pass:  Platform is not end-of-life
! Error: Ensure Samba is stopped and not enabled
! Error: Ensure system administrator actions (sudolog) are collected
! Error: Ensure discretionary access control permission modification events are collected
! Error: Ensure the audit configuration is immutable
! Error: Ensure mail transfer agent is configured for local-only mode
. Skipped: Ensure auditing for processes that start prior to auditd is enabled
✓ Pass:  Ensure all GIDs in /etc/passwd exist in /etc/group
. Skipped: Ensure shadow group is empty
! Error: Ensure HTTP Proxy server is stopped and not enabled
✕ Fail:  F   0  Ensure secure permissions on /etc/group- are set
✕ Fail:  C  40  Ensure system is disabled when audit logs are full
! Error: Ensure telnet server is stopped and not enabled
! Error: Ensure unsuccessful unauthorized file access attempts are collected
✕ Fail:  F   0  Ensure address space layout randomization (ASLR) is enabled
✓ Pass:  Ensure no duplicate UIDs exist
! Error: Ensure successful file system mounts are collected
✓ Pass:  Ensure secure permissions on /etc/shadow- are set
✓ Pass:  Ensure no duplicate user names exist
! Error: Ensure kernel module loading and unloading is collected
✕ Fail:  F   0  Ensure ICMP redirects are not accepted
! Error: Ensure sudo logging is enabled
✕ Fail:  F   0  Ensure bogus ICMP responses are ignored
✕ Fail:  D  20  Ensure auditd is installed
! Error: Ensure changes to system administration scope (sudoers) is collected
! Error: Ensure DNS server is stopped and not enabled
✕ Fail:  F   0  Ensure secure permissions on /etc/passwd- are set
! Error: Ensure DHCP server is stopped and not enabled
✓ Pass:  Ensure prelink is disabled
! Error: Ensure auditd service is enabled

Vulnerabilities:
■ No advisories found (passed)

Overall CVSS score: 0.0


Summary (1 assets)
==================

Target:     index.docker.io/library/almalinux@56ec0a505cbd
Score:      B    66/100     (100% completed)
✓ Passed:   ████ 25% (22)
✕ Failed:   ████ 28% (25)
! Errors:   ██████ 43% (38)
» Skipped:  █ 3% (3)

Policies:
F   0  Linux Security by Mondoo
.  ..  Platform Overview Information by Mondoo
A 100  Platform Vulnerability Policy by Mondoo
A 100  Platform End-of-Life Policy by Mondoo

Report URL: FOO

To get more information, please run this scan with "-o full".

→ loaded configuration from /Users/tsmith/.config/mondoo/luna.yml using source --config
→ using service account credentials
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=0
x could not resolve asset error="could not detect GitHub asset type" asset=
FTL failed to run scan error="failed to resolve multiple assets"

cat <<'EOF1' >test.sh
cat <<'EOF2' >/tmp/test.yaml
policies:
- uid: my-policies
  specs:
  - asset_filter:
      query: platform.family.contains(_ == 'unix')
    scoring_queries:
      test1: null
queries:
- uid: test1
  title: /tmp1 exists
  severity: 100
  query: |
    file("/tmp1") {
      permissions.user_readable == true
    }
EOF2
cnspec version
grep -i pretty_name /etc/os-release

cnspec scan local --incognito --score-threshold 100 -o full -f /tmp/test.yaml --json >/tmp/out.json
echo exit:$?
cat /tmp/out.json | jq --monochrome-output
EOF1
bash -x test.sh

root@80297ad0b51e:/tmp# bash -x test.sh
+ cat
+ cnspec version
cnspec 7.2.0 (babecff, 2022-10-31T23:38:24Z)
+ grep -i pretty_name /etc/os-release
PRETTY_NAME="Ubuntu 22.10"
+ cnspec scan local --incognito --score-threshold 100 -o full -f /tmp/test.yaml --json
→ no configuration file provided
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=1
→ connecting to asset 80297ad0b51e (baremetal)
+ echo exit:0
exit:0
+ cat /tmp/out.json
+ jq --monochrome-output
{
  "assets": {
    "//policy.api.mondoo.com/assets/2H0y07mHIsJffl5hljM7DiAR5uM": {
      "mrn": "//policy.api.mondoo.com/assets/2H0y07mHIsJffl5hljM7DiAR5uM",
      "name": "80297ad0b51e"
    }
  },
  "data": {
    "//policy.api.mondoo.com/assets/2H0y07mHIsJffl5hljM7DiAR5uM": {}
  },
  "scores": {
    "//policy.api.mondoo.com/assets/2H0y07mHIsJffl5hljM7DiAR5uM": {
      "//local.cnspec.io/run/local-execution/queries/test1": {
        "score": 0,
        "status": "error"
      }
    }
  },
  "errors": {}
}
root@80297ad0b51e:/tmp#

❯ ./cnspec shell local
→ loaded configuration from /Users/chip/.config/mondoo/mondoo.yml using source default
→ discover related assets for 1 asset(s)
→ resolved assets resolved-assets=0
x could not connect to asset error="Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?" asset=
FTL could not resolve assets