Get Started with the Mondoo Shell

The Explanation

What is this thing?

Mondoo shell is a powerful discovery tool for your infrastructure.

What does it do?

It enables you to ask questions about your infrastructure. Instead of manually inspecting and parsing the services list, ip tables, and packages on your machine, or manually chaining and aggregating results of AWS api calls across multiple regions, you can ask and discover with a query written in MQL in Mondoo shell.

What does it run on?

All platforms that are supported by Mondoo scan are supported by Mondoo shell.

Start the Mondoo Shell

Connect to the Mondoo shell the same way you would run a Mondoo Scan:

mondoo shell aws

mondoo shell ssh vagrant@127.0.0.1:2222 -p vagrant --insecure --sudo

mondoo shell k8s

The Examples

Linux System

query:

# list all the packages on the machine
packages.list { installed outdated name }

partial sample result:

 543: {
    name: "openssl"
    installed: true
    outdated: false
  }
  544: {
    name: "dbus-common"
    installed: true
    outdated: false
  }
  545: {
    name: "gzip"
    installed: true
    outdated: false
  }
  546: {
    name: "dbus"
    installed: true
    outdated: false
  }
  547: {
    name: "systemd-udev"
    installed: true
    outdated: false
  }

query:

# parse the sshd config file and return the ciphers and params
sshd.config("/etc/ssh/sshd_config") { ciphers params }

partial sample result:

sshd.config: {
  params: {
    AcceptEnv: "LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES,LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT,LC_IDENTIFICATION LC_ALL LANGUAGE,XMODIFIERS"
    AuthorizedKeysFile: ".ssh/authorized_keys"
    ChallengeResponseAuthentication: "no"
    GSSAPIAuthentication: "no"
    GSSAPICleanupCredentials: "no"
    HostKey: "/etc/ssh/ssh_host_rsa_key,/etc/ssh/ssh_host_ecdsa_key,/etc/ssh/ssh_host_ed25519_key"
    PasswordAuthentication: "yes"

AWS Account

query:

# return the instanceType, tags, and launchTime for all EC2 instances in the AWS account (multi-region)
aws.ec2.instances { instanceType tags launchTime }

partial sample result:

  10: {
    launchTime: 2022-06-20 12:26:40 +0000 UTC
    tags: {
      GitHubOrg: "mondoohq"
      GitHubRepo: "demo"
      Name: "kali-linux-hacker-instance-ecrm"
      Terraform: "true"
    }
    instanceType: "t2.medium"
  }
  11: {
    launchTime: 2021-01-16 15:25:54 +0000 UTC
    tags: {}
    instanceType: "t2.small"
  }

query:

# return location, policy, encryption, and logging configurations for all the S3 buckets in the AWS account
aws.s3.buckets { location policy encryption logging  }

partial sample result:

  3: {
    logging: {}
    encryption: {
      Rules: [
        0: {
          ApplyServerSideEncryptionByDefault: {
            KMSMasterKeyID: null
            SSEAlgorithm: "AES256"
          }
          BucketKeyEnabled: false
        }
      ]
    }
    policy: aws.s3.bucket.policy id = aws-logs-1234567891011-us-east-2-access-logs
    location: "us-east-2"
  }
  4: {
    logging: {}
    encryption: null
    policy: null
    location: "eu-central-1"
  }

K8S Cluster

query:

# return the name, labels, and kind for all k8s nodes
k8s.nodes { name labels kind }

partial sample result:

  0: {
    kind: "Node"
    labels: {
      beta.kubernetes.io/arch: "amd64"
      beta.kubernetes.io/os: "linux"
      kubernetes.io/arch: "amd64"
      kubernetes.io/hostname: "minikube"
      kubernetes.io/os: "linux"
      minikube.k8s.io/commit: "a03fbcf166e6f74ef224d4a63be4277d017bb62e"
      minikube.k8s.io/name: "minikube"
      minikube.k8s.io/updated_at: "2022_06_15T17_35_18_0700"
      minikube.k8s.io/version: "v1.22.0"
      node-role.kubernetes.io/control-plane: ""
      node-role.kubernetes.io/master: ""
      node.kubernetes.io/exclude-from-external-load-balancers: ""
    }
    name: "minikube"
  }

query:

# return the name and spec of all k8s services
k8s.services { name spec }

partial sample result:

  1: {
    name: "kube-dns"
    spec: {
      clusterIP: "10.96.0.10"
      clusterIPs: [
        0: "10.96.0.10"
      ]
      ipFamilies: [
        0: "IPv4"
      ]
      ipFamilyPolicy: "SingleStack"
      ports: [
        0: {
          name: "dns"
          port: 53.000000
          protocol: "UDP"
          targetPort: 53.000000
        }
        1: {
          name: "dns-tcp"
          port: 53.000000
          protocol: "TCP"
          targetPort: 53.000000
        }
        2: {
          name: "metrics"
          port: 9153.000000
          protocol: "TCP"
          targetPort: 9153.000000
        }
      ]
      selector: {
        k8s-app: "kube-dns"
      }
      sessionAffinity: "None"
      type: "ClusterIP"
    }
  }

Going Further

MQL has the ability to filter and evaluate query results. The syntax is based on javascript and GraphQL.

Keywords for Listing Results and Filtering

• : use to list all the fields in a resource
• { fieldname_1 fieldname_2 }: use curly brackets and specific field names to only return the fields you want
• where: use where to only return results that match the where clause

Keywords for True/False Results on Arrays ([])

• all: all results must match
• any: at least one result must match
• one: only one result must match
• contains: match result exists on the array
• containsNone: match result does not exist on the array

Helpers

• time.now(): timestamp for now time
• time.day, time.minute: multiply against an int to evaluate against a day/time

What is available to query

See everything you can query here

Examples

# return information all EC2 instances where the launchTime is before 3 days ago
aws.ec2.instances.where(launchTime < time.now() - 3 * time.day) { arn launchTime tags }

# ensure the sshd config macs contains the string "test"
sshd.config.macs.contains("test")

# return the name and policy statements of all S3 buckets where the policy is not null
aws.s3.buckets.where(policy != null) { name policy.statements }

# no AWS IAM user should have policies attached directly to their user
aws.iam.users.all( attachedPolicies.length == 0 )