Secure IBM Z with cnspec

Use cnspec to assess the security configuration of IBM Z mainframes running z/OS, together with the external security manager that protects them, from a single connection. cnspec exposes RACF system options, user and group profiles, data set and general resource profiles with their access lists, digital certificates, SYS1.PARMLIB members, and z/OS UNIX files as MQL resources, so you can find risky settings and enforce your own security policies.

New to cnspec? Start with the Quickstart, or read the Operating systems overview to see every platform cnspec can secure.

PrerequisitesCopy Anchor Link

To scan a z/OS system with cnspec, you must have:

• cnspec installed on your workstation
• The SSH daemon running and reachable on z/OS UNIX System Services
• A user ID with a TSO segment and read authority for the security settings you want to assess. For a full SETROPTS LIST report, the user needs the RACF SPECIAL or AUDITOR attribute.

cnspec connects over SSH to z/OS UNIX System Services and runs read-only TSO/E and operator commands through tsocmd. Nothing is installed on the target.

Connect to a z/OS systemCopy Anchor Link

Pass the host name or IP address of the system and the user ID to sign on as:

cnspec scan ibmz HOST --username AUDITOR --ask-pass

To authenticate with an SSH key instead of a password:

cnspec scan ibmz HOST --username AUDITOR -i ~/.ssh/id_ed25519

If a z/OSMF server is available, pass its base URL. Resources that can use the z/OSMF REST API then read structured data from it, and everything else still works over SSH:

cnspec scan ibmz HOST --username AUDITOR --ask-pass --zosmf-url https://zosmf.example.com

The ibmz.racf resources read RACF settings, so they apply to systems that use RACF as their external security manager.

Write your own policiesCopy Anchor Link

Mondoo doesn't ship a z/OS security policy. To enforce the controls that matter for your environment, wrap checks like the ones below in your own policy and pass it with --policy-bundle:

cnspec scan ibmz HOST --username AUDITOR --ask-pass --policy-bundle my-zos-policy.mql.yaml

When a scan completes, cnspec prints a summary of the checks it ran, grouped by policy. Each check shows a pass or fail result, and the report ends with a risk score from 0 (no risk) to 100 (highest risk). To send results to a file or change the output format, read Report Results.

Example checksCopy Anchor Link

Open a cnspec shell to explore the system interactively:

cnspec shell ibmz HOST --username AUDITOR --ask-pass

Ensure user IDs are revoked after three failed logonsCopy Anchor Link

cnspec> ibmz.racf.passwordRevokeAttempts <= 3 && ibmz.racf.passwordRevokeAttempts > 0
[ok] value: true

Ensure passwords use the KDFAES algorithmCopy Anchor Link

cnspec> ibmz.racf.passwordEncryptionAlgorithm == "KDFAES"
[ok] value: "KDFAES"

List users with the SPECIAL or OPERATIONS attributeCopy Anchor Link

cnspec> ibmz.racf.users.where(special || operations) { userid attributes revoked }

Ensure SYS1.PARMLIB is not readable by everyoneCopy Anchor Link

cnspec> ibmz.racf.dataset(name: "SYS1.PARMLIB").uacc == "NONE"
[ok] value: "NONE"

Ensure no certificate authority certificate has expiredCopy Anchor Link

cnspec> ibmz.racf.certificates.none(expired)
[ok] value: true

Read a PARMLIB memberCopy Anchor Link

cnspec> ibmz.parmlib.member(name: "SMFPRM00").lines

Check permissions on a z/OS UNIX fileCopy Anchor Link

cnspec> ibmz.uss.file(path: "/etc/profile").permissions

Learn moreCopy Anchor Link

• Mondoo IBM Z Resource Pack Reference: every IBM Z resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries
• Write custom policies: wrap your checks in a policy