Installation Guide
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
This guide provides the necessary steps to implement a hardened DNS infrastructure on Parrot OS. The system utilizes Unbound as a local recursive resolver configured for DNS over TLS (DoT) and DNSSEC validation, achieving a security posture within the top 1-2% globally.
The installation process covers the deployment of the resolver, the application of kernel-level file protections via immutable flags to prevent unauthorized modifications by services like NetworkManager or Portmaster, and the setup of automated monitoring systems.
Sources: README.md:3-13, DNS_Hardening_Complete_Guide.md:3-14
Core Component Deployment
The primary architecture relies on replacing the system's default resolver with a hardened instance of Unbound. This involves disabling conflicting services and enabling the local resolver as the primary system DNS.
Prerequisites and Software Installation
The system requires unbound and unbound-anchor for root key management. To prevent conflicts, systemd-resolved must be stopped and masked.
# Update package list and install Unbound
sudo apt update
sudo apt install -y unbound unbound-anchor
# Disable systemd-resolved to prevent port 53 conflicts
sudo systemctl stop systemd-resolved
sudo systemctl mask systemd-resolved
# Enable the Unbound service
sudo systemctl enable unbound
Sources: DNS_Hardening_Complete_Guide.md:19-30, README.md:19-30
Unbound Configuration
The configuration is localized to /etc/unbound/unbound.conf. Key security parameters include disabling IPV6, enabling query minimization, and forcing DNS over TLS for upstream forwarding.
| Parameter | Configuration Value | Purpose |
|---|---|---|
interface | 127.0.0.1 | Restricts resolver to localhost |
qname-minimisation | yes | Enhances privacy by limiting data sent to authority servers |
auto-trust-anchor-file | /var/lib/unbound/root.key | Enables DNSSEC validation |
forward-tls-upstream | yes | Enforces TLS for all upstream queries |
access-control | 127.0.0.0/8 allow | Prevents external queries/amplification attacks |
Sources: configs/unbound.conf:6-33, DNS_Hardening_Complete_Guide.md:139-166
System Hardening Logic
The hardening phase ensures that configuration files cannot be modified by other system processes. This is achieved using the chattr utility to set immutable flags.
Hardening Workflow
The dns_harden.sh script automates the protection of /etc/resolv.conf and redirects NetworkManager to an unmanaged state regarding DNS.
The workflow ensures that even root-level processes cannot overwrite the local resolver settings without explicitly removing the kernel-level immutable flag.
Sources: scripts/dns_harden.sh:17-57, README.md:37-47
Monitoring and Maintenance Setup
Once the core services are installed, an optional monitoring system can be deployed to track the state of the hardening and alert on compromises.
Automated Monitoring Installation
The dns_monitoring_install.sh script sets up a cron schedule to execute status checks. Users can select intervals ranging from 5 minutes to 1 hour.
Verification Procedures
Post-installation verification is critical to ensure DNSSEC and TLS are active.
- DNSSEC Validation: Run
dig @127.0.0.1 google.com +dnssecand check for thead(Authenticated Data) flag. - TLS Connections: Run
sudo ss -tupn | grep 853to verify established encrypted connections to upstream providers like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9). - Immutable Status: Use
lsattr /etc/resolv.confto confirm theiflag is present.
Sources: DNS_Hardening_Complete_Guide.md:213-234, UNBOUND_TLS_STATUS.md:8-28
Conclusion
Successful installation results in a system-wide DNS resolver that is resistant to unauthorized modifications and ensures all outgoing queries are encrypted and authenticated. By utilizing the provided scripts, administrators can maintain this secure state and quickly restore functionality using the emergency restoration tools if configuration errors occur.