cnspec System Requirements

PowerShell 5.1 or later is required. The Windows installer declares #Requires -Version 5, so it stops with an error on any host running an older PowerShell. Check the installed version before you install:

$PSVersionTable.PSVersion

TLS 1.2 must be enabled so the installer can reach Mondoo's download and API endpoints. It is enabled by default on modern Windows, and the install pages explain how to confirm or enable it.

cnspec on Linux is largely distribution independent. The Linux binaries are statically linked with no external library dependencies, so they run on any distribution with a supported CPU architecture and a reasonably modern kernel (Linux 3.2 or later). You do not need a specific distribution or release to run cnspec.

What the scan can read depends less on the distribution than on which standard utilities are present. cnspec reads most operating system state directly from files, and shells out to common system tools for the rest:

• A package manager (dpkg, rpm, or apk) for installed-package and patch checks
• systemctl or service for service state
• mount and lsblk for filesystem and block-device checks
• getent for users and groups

These tools are present by default on the distribution that provides them. If one is missing, only the checks that depend on it are affected; the rest of the scan still runs. The automated install script additionally needs curl and tar.

Mondoo validates cnspec and its policies against these distributions:

A distribution that isn't listed here usually still works; the table reflects what Mondoo tests, not a hard requirement to run cnspec. You can also scan any Linux host remotely over SSH, as a cloud volume, or as a container image without installing cnspec on the target.

cnspec runs natively on both Intel and Apple silicon Macs, and Mondoo publishes a signed, notarized universal package that supports both. Use a current or recent macOS release.

• Installing: the package manager and the automated install script require root, or a user with sudo.
• Scanning: run cnspec scan local as root or with sudo. A full scan reads files such as /etc/shadow and /etc/sudoers that are only readable by root. Without elevated privileges, the checks that depend on those files return no data. When you run cnspec as a service, the systemd unit runs as root by default.

• Installing: the installer declares #Requires -RunAsAdministrator. Run it from an elevated PowerShell or Command Prompt, or with an administrator account through MSI or Chocolatey.
• Scanning locally: run cnspec scan local from an elevated terminal so it can read protected registry keys and system configuration.
• Scanning remotely: cnspec connects to a remote Windows host over WinRM, which listens on port 5986 for HTTPS (the default) or 5985 for HTTP. Use an account with administrator privileges, for example cnspec scan winrm Administrator@HOST --ask-pass.

• Installing: the universal .pkg and the automated install script require sudo.
• Scanning: run cnspec scan local with sudo to read protected files. Some data, such as Time Machine preferences, is gated by macOS Full Disk Access even for root. Grant Full Disk Access to the terminal (or to the cnspec service) when you need those checks.