Secure FreeBSD with cnspec

Scan your FreeBSD systems to find security risks before they become incidents. cnspec evaluates kernel parameters, SSH configuration, file system permissions, user accounts, installed packages, and dozens of other FreeBSD controls.

New to cnspec? Start with the Quickstart, or read the Operating systems overview to see every platform cnspec can secure.

PrerequisitesCopy Anchor Link

• cnspec installed on your workstation
• SSH access to the target FreeBSD system

Scan a FreeBSD assetCopy Anchor Link

cnspec connects to FreeBSD systems remotely over SSH.

Scan a remote machine over SSHCopy Anchor Link

To scan a remote FreeBSD machine using SSH with password authentication:

cnspec scan ssh user@HOST

To use an SSH key for authentication:

cnspec scan ssh user@HOST -i /path/to/identity_key

To scan using a specific port, include it in the target:

cnspec scan ssh user@HOST:2222

Understand scan outputCopy Anchor Link

When a scan completes, cnspec prints a summary of all the checks it ran, grouped into passing and failing checks. Each failed check shows its risk rating. For example:

Passing:
✓ Ensure SSH root login is disabled
✓ Ensure no user has an empty password

Failing:
✕ MEDIUM (50):    Ensure IP forwarding is disabled

At the end of the output, cnspec shows a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To send results to a file or change the output format (JSON, SARIF, and more), read Report Results.

To assess your FreeBSD systems against Mondoo's security recommendations, enable the Mondoo FreeBSD Security policy, which covers SSH configuration, file permissions, user accounts, network settings, and more. To learn how to enable policies, read Manage policies in Mondoo Platform. You can also create your own policies or specify a particular policy bundle with --policy-bundle.

Example checksCopy Anchor Link

Run cnspec shell ssh user@HOST to open the cnspec interactive shell connected to a remote FreeBSD system. From there you can make checks like the examples below.

Ensure SSH root login is disabledCopy Anchor Link

cnspec> sshd.config.params["PermitRootLogin"] == "no"
[ok] value: "no"

Ensure IP forwarding is disabledCopy Anchor Link

cnspec> kernel.parameters["net.inet.ip.forwarding"] == 0
[ok] value: "0"

Ensure the SSH service is runningCopy Anchor Link

cnspec> service("sshd").running
[ok] value: true

List all listening ports and their processesCopy Anchor Link

cnspec> ports.listening { port protocol address process.executable }

Ensure every enabled package repository verifies signaturesCopy Anchor Link

The pkg.repos resource merges the repository definitions in /etc/pkg/ and /usr/local/etc/pkg/repos/ the way pkg does, so an override such as FreeBSD: { enabled: no } is reflected in the result. A signatureType of none means pkg installs from the repository without verifying a signature:

cnspec> pkg.repos.where( enabled ).none( signatureType == "none" )
[ok] value: true

Ensure strong SSH ciphers are configuredCopy Anchor Link

cnspec> sshd.config.ciphers.containsNone(["arcfour", "arcfour128", "arcfour256"])
[ok] value: []

Learn moreCopy Anchor Link

• To learn how to run ad hoc checks interactively, read Create Checks in cnspec Shell.

• For a list of all the OS resources and fields you can query, read the Mondoo Operating Systems (OS) Resource Pack Reference and Mondoo Core Resource Pack Reference.

• To learn more about how MQL works, read Write Effective MQL.