Introduction & Project Goals
Relevant source files
The following files were used as context for generating this wiki page:
The DNS Hardening for Parrot OS project is designed to implement an enterprise-grade DNS infrastructure that prioritizes security, privacy, and system resilience. By utilizing the Unbound DNS resolver in conjunction with DNS over TLS (DoT) and DNSSEC validation, the project aims to place users in the top 1-2% globally for DNS security posture. The scope of the project includes hardening system configurations, preventing unauthorized modifications by third-party services like Portmaster or NetworkManager, and providing robust monitoring and recovery tools.
Sources: DNS_Hardening_Complete_Guide.md:4-14, README_SHORT.md:3-12, CHANGELOG.md:10-14
Core Project Objectives
The primary goal of this project is to eliminate common DNS vulnerabilities such as poisoning, spoofing, and man-in-the-middle attacks while ensuring user privacy through encryption and query minimization.
Security and Privacy Protections
The project implements several layers of defense to protect the DNS resolution path:
- Encryption: All upstream queries are encrypted using DNS over TLS (DoT) to prevent ISP surveillance and metadata leakage.
- Integrity: DNSSEC validation is enforced to ensure the authenticity of DNS records and prevent record spoofing.
- Access Control: The local resolver is restricted to localhost (127.0.0.1) to prevent external abuse and DNS amplification attacks.
- Privacy Hardening: Query minimization (QNAME minimization) is enabled to reduce the amount of information sent to authoritative servers.
Sources: DNS_Hardening_Complete_Guide.md:7-14, configs/unbound.conf:13-18, configs/unbound.conf:21-23
System Resilience and Persistence
A key architectural goal is to ensure the hardened configuration remains active despite interference from system services.
- Immutable Configuration: The project uses the kernel-level immutable flag (
chattr +i) on/etc/resolv.confto prevent Portmaster, NetworkManager, or other services from modifying DNS settings. - Automated Monitoring: Periodic scripts check for state changes or compromises, logging events and alerting the user if hardening is removed.
- Emergency Recovery: A dedicated restoration system is provided to revert the system to a functional state in under 30 seconds if hardened configurations fail.
Sources: README.md:33-43, CHANGELOG.md:27-31, scripts/dns_harden.sh:37-43
System Architecture Overview
The system architecture transitions the OS from relying on external, unencrypted ISP resolvers to a local, hardened recursive resolver setup.
This diagram illustrates the flow of a DNS query from an application through the hardened local stack to encrypted upstream providers.
Sources: DNS_Hardening_Complete_Guide.md:126-177, configs/unbound.conf:1-92
Feature Summary
| Feature | Description | Implementation Detail |
|---|---|---|
| DNS over TLS (DoT) | Encrypts DNS queries to upstream resolvers. | Uses port 853 with Cloudflare and Quad9. |
| DNSSEC Validation | Verifies the authenticity of DNS records. | Uses auto-trust-anchor-file for root keys. |
| Immutable Protection | Prevents unauthorized file modification. | Applies chattr +i to /etc/resolv.conf. |
| Query Minimization | Increases privacy by limiting data exposure. | qname-minimisation: yes in Unbound. |
| Anti-Rebinding | Blocks internal network access from DNS. | Defines private-address ranges in config. |
| Emergency Restore | Rapid recovery mechanism. | Script removes immutable flags and resets services. |
Sources: README.md:7-14, configs/unbound.conf:21-23, configs/unbound.conf:65-72, scripts/dns_harden.sh:37-43
Project Components
The project is structured into three main modules: configuration, hardening/restoration scripts, and monitoring tools.
1. Configuration Module
The heart of the project is the unbound.conf file, which defines the security parameters for the local resolver.
# Example of Hardened Access Control and Rate Limiting
server:
access-control: 127.0.0.0/8 allow
access-control: 0.0.0.0/0 refuse
ratelimit: 1000
hide-identity: yes
hide-version: yes
Sources: configs/unbound.conf:17-18, configs/unbound.conf:51-56
2. Hardening & Recovery Module
This module ensures the configurations are applied and protected. The dns_harden.sh script specifically targets the "Portmaster-Resistant" goal by decoupling NetworkManager from DNS management.
This flowchart depicts the sequence of operations performed by the hardening script to secure the system configuration.
3. Monitoring Module
The monitoring module provides continuous assurance that the security posture has not been degraded. It includes dns_status.sh for manual checks and dns_monitor.sh for automated logging of state changes.
Sources: MONITORING.md:1-20, CHANGELOG.md:16-19
Conclusion
The Introduction & Project Goals for the dns-hardening-parrot repository focus on transforming a standard Parrot OS installation into a high-security environment. By combining a hardened Unbound resolver with strict system-level write protections and proactive monitoring, the project provides a comprehensive defense against DNS-based attacks and privacy infringements.
Sources: DNS_Hardening_Complete_Guide.md:4-14, README.md:214-216