Resolv.conf Management
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Resolv.conf Management in the dns-hardening-parrot project is a security-centric system designed to establish and maintain a static, hardened DNS configuration on Parrot OS. Its primary purpose is to prevent unauthorized or dynamic modifications to the system's DNS resolver settings by third-party applications such as Portmaster, NetworkManager, or other system services. By utilizing kernel-level file protections and strategic service overrides, the system ensures that DNS queries are consistently routed through a local, encrypted Unbound resolver.
The management lifecycle includes automated hardening, emergency restoration, and continuous monitoring to detect and alert on state changes or security compromises. Sources: README.md:21-28, scripts/dns_harden.sh:1-10
Hardening Mechanism
The hardening process transforms /etc/resolv.conf from a dynamic symlink into a static, immutable file. This is achieved through a sequence of steps that remove existing management links and apply the chattr +i attribute.
Architecture of Hardening
The hardening logic is implemented primarily in scripts/dns_harden.sh. It performs the following operations:
- Backup: Current configurations are saved to
/root/dns_backups/harden_TIMESTAMP/. - Symlink Removal: The existing
/etc/resolv.conf(often a link to systemd-resolved) is deleted. - Static File Creation: A new file is written containing the local loopback address (
127.0.0.1) as the primary nameserver. - Immutability: The
chattr +icommand is used to prevent any process, including root, from modifying the file.
Sources: scripts/dns_harden.sh:24-49, README.md:32-42
Configuration Parameters
The hardened resolv.conf uses specific options to optimize security and performance.
| Parameter | Value | Description |
|---|---|---|
nameserver | 127.0.0.1 | Directs queries to the local Unbound resolver. |
nameserver | 1.1.1.1 | Fallback resolver (Cloudflare). |
options timeout | 2 | Sets the wait time for a response to 2 seconds. |
options attempts | 3 | Sets the number of retry attempts to 3. |
options trust-ad | Enabled | Informs the system to trust the AD (Authenticated Data) flag from DNSSEC. |
Sources: scripts/dns_harden.sh:41-48, TEST_RESULTS.md:12-22
NetworkManager Integration
To prevent NetworkManager from attempting to overwrite the DNS settings, the project deploys a specific configuration snippet to /etc/NetworkManager/conf.d/dns-hardening.conf.
This diagram shows how NetworkManager is restricted from managing the DNS lifecycle through specific configuration flags.
Sources: scripts/dns_harden.sh:54-60, TEST_RESULTS.md:46-52
Restoration and Recovery
The project provides scripts/dns_restore.sh to handle scenarios where hardened configurations fail or need to be reverted for maintenance.
Restoration Logic
The restoration script follows a destructive-then-constructive path to ensure connectivity:
- Stop Services: Temporarily halts
unboundandsystemd-resolved. - Clear Attributes: Removes the immutable flag (
chattr -i) to allow file operations. - Bootstrap DNS: Overwrites
/etc/resolv.confwith a list of reliable public resolvers (Cloudflare, Quad9, Google) to restore immediate internet access. - Masking: Masks the
unboundservice to prevent it from starting in a broken state.
Sources: scripts/dns_restore.sh:50-85, DNS_Hardening_Complete_Guide.md:47-90
Monitoring and Alerting
Continuous management of resolv.conf is handled by a suite of monitoring scripts that track the file's state and attributes.
Monitoring Flow
The system distinguishes between routine state tracking and security alerting.
The sequence illustrates the interaction between cron-scheduled checks and the logging/notification system.
Sources: scripts/dns_monitor.sh:10-38, scripts/dns_alert.sh:9-35, MONITORING.md:44-70
Status Indicators
The scripts/dns_status.sh utility provides a manual interface for auditing the current management state. It checks the following components:
- Immutable Flag: Verified via
lsattr. - Localhost Usage: Verified via
grepon/etc/resolv.conf. - Service Health: Verified via
systemctl is-active unbound. - Resolution Capability: Verified via
nslookup google.com.
Sources: scripts/dns_status.sh:13-50, MONITORING.md:10-25
Conclusion
Resolv.conf Management in this project provides a robust defense-in-depth strategy against DNS hijacking and unauthorized configuration changes. By combining kernel-level file locking with aggressive service management and real-time alerting, the system maintains the integrity of the DNS resolution path, ensuring that privacy-focused Unbound configurations remain the authoritative source for system-wide name resolution.