Attack Prevention Mechanisms
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The attack prevention mechanisms in this project are designed to create a resilient and tamper-proof DNS resolution environment on Parrot OS. The primary goal is to protect the system against common DNS-based threats such as poisoning, spoofing, man-in-the-middle (MITM) attacks, and unauthorized configuration changes by local services like Portmaster or NetworkManager.
The architecture relies on a multi-layered defense strategy: encrypting upstream traffic via DNS over TLS (DoT), enforcing data integrity through DNSSEC validation, and implementing filesystem-level protections to maintain the integrity of local resolver configurations. Sources: README.md, DNS_Hardening_Complete_Guide.md
1. Protocol-Level Protections
The project implements several protocol-level defenses within the Unbound DNS resolver to ensure the confidentiality and integrity of DNS queries.
DNS over TLS (DoT)
All upstream communication is encrypted using DoT on port 853. This prevents ISP monitoring and MITM interception of DNS metadata. The system is configured with multiple diverse upstream providers (Cloudflare and Quad9) to mitigate risks associated with provider downtime or BGP hijacking.
Sources: configs/unbound.conf:75-84, README.md:125-135
DNSSEC Validation
To prevent DNS poisoning and spoofing, the system enforces DNSSEC validation. Queries are verified using the root trust anchor, ensuring that the records received have not been altered in transit.
Sources: configs/unbound.conf:29-33, UNBOUND_TLS_STATUS.md:18-23
Privacy Hardening via Query Minimization
The resolver utilizes qname-minimisation to limit the amount of information sent to upstream authoritative servers. Only the minimum necessary labels are sent at each step of the recursive resolution process.
Sources: configs/unbound.conf:19-21
| Mechanism | Configuration Element | Description |
|---|---|---|
| DoT Enforcement | forward-tls-upstream: yes | Forces upstream queries to use TLS encryption. |
| DNSSEC | auto-trust-anchor-file | Uses the root key for cryptographic validation of records. |
| QNAME Minimization | qname-minimisation-strict: yes | Enforces strict privacy by minimizing data sent to authorities. |
| Identity Hiding | hide-identity: yes | Prevents the resolver from leaking its version or identity to probes. |
| Sources: configs/unbound.conf:19-58 |
2. Filesystem and Service Hardening
A critical component of the defense strategy is preventing local software from overriding the hardened DNS settings.
Immutable Configuration Protection
The dns_harden.sh script employs the chattr +i command on /etc/resolv.conf. This sets the immutable flag at the kernel level, preventing any user—including root—or service (like Portmaster or NetworkManager) from modifying, deleting, or renaming the file.
Sources: scripts/dns_harden.sh:42-43, README.md:35-43
Local Resolver Lockdown
Unbound is configured to only accept queries from the localhost (127.0.0.1), refusing any external requests to prevent the system from being used in DNS amplification attacks.
Sources: configs/unbound.conf:14-16
This diagram illustrates the flow from a local application query through the protected filesystem layer to the encrypted upstream providers, highlighting the blocked attack vectors.
3. Automated Monitoring and Alerting
The system includes a monitoring suite that continuously audits the security state of the DNS infrastructure.
Hardening State Monitoring
The dns_monitor.sh script tracks the presence of the immutable flag and logs any changes in state to /var/log/dns_hardening_monitor.log.
Sources: scripts/dns_monitor.sh:10-40
Compromise Detection
The dns_alert.sh script performs active checks for three specific compromise indicators:
- Removal of the immutable flag from
/etc/resolv.conf. - Modification of
resolv.confto use a non-local nameserver as the primary resolver. - The Unbound service being stopped or crashing.
Sources: scripts/dns_alert.sh:20-35
The sequence diagram shows the automated alerting process that occurs when a security policy violation is detected.
4. Anti-Rebinding and Rate Limiting
To protect the local network, the resolver includes mechanisms to prevent internal resource exploitation.
DNS Rebinding Prevention
The configuration explicitly defines private address ranges as private-address. This prevents external DNS responses from pointing to internal IP addresses (e.g., 192.168.x.x), effectively blocking DNS rebinding attacks against local services.
Sources: configs/unbound.conf:62-68
Abuse Mitigation
Rate limiting is implemented to prevent local applications or malicious scripts from overwhelming the resolver or being used in outgoing reflection attacks.
Sources: configs/unbound.conf:51-54
# Rate limiting configuration in unbound.conf
ratelimit: 1000
ratelimit-slabs: 4
ratelimit-size: 4m
# Anti-rebinding configuration
private-address: 192.168.0.0/16
private-address: 10.0.0.0/8
Sources: configs/unbound.conf:51-66
Conclusion
The Attack Prevention Mechanisms provide a comprehensive security posture (estimated in the top 1-2% globally) by combining protocol-level encryption with OS-level hardening. Through the use of immutable files, mandatory DNSSEC, and continuous monitoring, the system ensures that DNS remains a trusted foundation for network activity on Parrot OS.
Sources: README.md:213-215, TEST_RESULTS.md:75-80