Secure Oracle Solaris with cnspec

Scan your Oracle Solaris systems to find security risks before they become incidents. The Mondoo Oracle Solaris Security policy checks Solaris 11.4 systems for kernel and network hardening, exposed network services, SSH configuration, account and password settings, auditing, and software integrity. cnspec also exposes Solaris users, groups, SMF services, IPS packages, zones, ZFS pools and datasets, and file system metadata as queryable MQL resources, so you can write your own policies for the controls that matter most in your environment.

New to cnspec? Start with the Quickstart, or read the Operating systems overview to see every platform cnspec can secure.

PrerequisitesCopy Anchor Link

To query a Solaris system with cnspec, you must have:

• cnspec installed on your workstation
• SSH access to the target Solaris system

cnspec doesn't run on Solaris itself. You run it on your workstation (or any Linux, macOS, or Windows host) and it connects to the Solaris system over SSH, so nothing is installed on the target.

Connect over SSHCopy Anchor Link

To scan a remote Solaris system using SSH, authenticating with your SSH agent and any matching entry in ~/.ssh/config:

cnspec scan ssh user@HOST

To authenticate with a password, add --ask-pass and cnspec prompts you for it:

cnspec scan ssh user@HOST --ask-pass

To use an SSH key for authentication:

cnspec scan ssh user@HOST -i /path/to/identity_key

To scan using a specific port, include it in the target:

cnspec scan ssh user@HOST:2222

Scan with elevated privilegesCopy Anchor Link

On Solaris, root is usually a role you can't log in as directly, so you connect as a regular user. A few checks need root: the ones that read the audit configuration, /etc/shadow, and the sudo rules. If the user you connect as can run sudo, add --sudo so cnspec runs those checks with elevated privileges:

cnspec scan ssh user@HOST --sudo

Without --sudo, cnspec skips the checks that need root instead of reporting them as failures.

Scan with the Mondoo Oracle Solaris Security policyCopy Anchor Link

The Mondoo Oracle Solaris Security policy has 71 checks for Oracle Solaris 11.4, grouped into these areas:

• Kernel and process hardening, such as ASLR, non-executable stacks and heaps, and setuid core dumps
• Network stack settings, such as IP forwarding, source routing, and ICMP redirects
• Network services, such as telnet, FTP, the r-services, NFS, SNMP, and graphical login
• SSH server configuration, including file permissions, ciphers, MACs, and key exchange algorithms
• Accounts and authentication, such as the root role, login retries, password hashing, and password length
• Permissions on sensitive files such as /etc/passwd and /etc/shadow
• Auditing and logging
• Software integrity for IPS packages and publishers
• Firewall and time synchronization
• Privilege escalation through sudo

Each failed check includes remediation steps as shell commands and Ansible tasks.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "Solaris", and add the policy. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the open-source policy bundle URL directly to cnspec:

cnspec scan ssh user@HOST --sudo \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-solaris-security.mql.yaml

To scan with a policy you wrote yourself, pass its file path to --policy-bundle instead.

When a scan completes, cnspec prints a summary of the checks it ran, grouped by policy. Each check shows a pass or fail result, and the report ends with a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance. To send results to a file or change the output format (JSON, SARIF, and more), read Report Results.

Example checksCopy Anchor Link

Open a cnspec shell to explore resources interactively:

cnspec shell ssh user@HOST --sudo

Ensure SSH root login is disabledCopy Anchor Link

cnspec> sshd.config.params["PermitRootLogin"] == "no"
[ok] value: "no"

Ensure the SSH service is onlineCopy Anchor Link

SMF services are identified by their full FMRI, so use svc:/network/ssh:default rather than an abbreviation such as ssh:

cnspec> service("svc:/network/ssh:default").running
[ok] value: true

List all online SMF servicesCopy Anchor Link

cnspec> services.where(running) { name }

Ensure root login is restricted to the consoleCopy Anchor Link

cnspec> parse.ini("/etc/default/login").params["CONSOLE"] == "/dev/console"
[ok] value: "/dev/console"

Ensure only root has UID 0Copy Anchor Link

cnspec> users.where(uid == 0).all(name == "root")
[ok] value: true

List installed IPS packagesCopy Anchor Link

cnspec> packages.where(name == /openssl/) { name version }

List zones and their isolation settingsCopy Anchor Link

cnspec> solaris.zones { name state brand ipType }

Ensure every ZFS pool is healthyCopy Anchor Link

cnspec> zfs.pools.all(health == "ONLINE")
[ok] value: true

List all listening ports and their processesCopy Anchor Link

cnspec> ports.listening { port protocol address process.executable }

Learn moreCopy Anchor Link

• Mondoo Operating Systems (OS) Resource Pack Reference: every OS resource and field cnspec can query
• Mondoo Core Resource Pack Reference: core resources available everywhere
• Write Effective MQL: guide to authoring checks and queries
• Create Checks in cnspec Shell: run ad hoc checks interactively