Unhardening Procedure
Relevant source files
The following files were used as context for generating this wiki page:
The Unhardening Procedure encompasses the necessary steps and automated scripts required to revert a system from its high-security DNS state back to a standard configuration. This is primarily facilitated through the emergency restoration script and manual removal of file-system level protections. The procedure is critical for troubleshooting when hardened configurations fail or when users need to perform manual DNS modifications that are otherwise blocked by the project's security features.
Sources: README.md:167-175, scripts/dns_restore.sh:5-7
Emergency Restoration Workflow
The primary method for unhardening the system is through the dns_restore.sh script. This script is designed to handle the complexities of the hardening process, such as immutable file flags and masked services, in under 30 seconds.
The diagram above illustrates the sequential logic of the automated restoration process used to return the system to a functional, non-hardened state.
Sources: scripts/dns_restore.sh:53-157, DNS_Hardening_Complete_Guide.md:278-281
Key Restoration Steps
- Service Suspension: The script stops
unboundandsystemd-resolvedto prevent lock contention during file modification. - Configuration Backup: All current configurations are copied to
/root/dns_backups/backup_TIMESTAMP/before any changes are made. - Removal of File Protection: The script executes
chattr -i /etc/resolv.confto remove the kernel-level write protection. - Static Resolver Reset: A basic
/etc/resolv.confis created using standard public resolvers (1.1.1.1, 8.8.8.8) to ensure immediate connectivity. - Service Masking: Hardened services like
unboundare masked to prevent them from automatically restarting in a broken state.
Sources: scripts/dns_restore.sh:56-100, README.md:92-101
Manual Unhardening and Temporary Suspension
Users may choose to manually unharden specific components if the full restoration script is not required. This is often necessary for temporary configuration changes.
Resolv.conf File Access
The hardening script applies an immutable flag (+i) to /etc/resolv.conf, which prevents even the root user from modifying the file. Unhardening this specific component requires manual interaction with chattr.
| Action | Command | Purpose |
|---|---|---|
| Remove Protection | sudo chattr -i /etc/resolv.conf | Allows editing of the resolver configuration. |
| Re-apply Protection | sudo chattr +i /etc/resolv.conf | Re-locks the file against modification. |
| Verify Status | lsattr /etc/resolv.conf | Checks if the 'i' flag is currently present. |
Sources: README.md:73-82, README_SHORT.md:52-56, scripts/dns_harden.sh:45-56
Reverting NetworkManager Changes
Hardening configures NetworkManager to ignore DNS management by creating a configuration file at /etc/NetworkManager/conf.d/dns-hardening.conf. To unharden this, the user must remove this file and restart the service.
Sources: scripts/dns_harden.sh:58-66, CHANGELOG.md:12-14
Monitoring Deactivation
The project includes an automated monitoring and alert system that must be uninstalled during a full unhardening procedure to prevent false positive alerts (e.g., "Immutable flag removed").
This sequence shows the interaction between the uninstallation script and the system's cron and log directories.
Sources: scripts/dns_monitoring_uninstall.sh:11-45, MONITORING.md:112-126
Cleanup of Monitoring Artifacts
The dns_monitoring_uninstall.sh script performs the following:
- Removes cron jobs for
dns_monitor.shanddns_alert.sh. - Deletes monitoring binaries from
/usr/local/bin/. - Optionally purges status files like
/var/run/dns_hardening.stateand log files in/var/log/.
Sources: scripts/dns_monitoring_uninstall.sh:16-43
Summary of Unhardening Impacts
The unhardening procedure significantly alters the security posture of the system, reverting it from the "Top 1-2% globally" status to standard operating levels.
| Feature | Hardened State | Unhardened (Restored) State |
|---|---|---|
| Resolver | Local Unbound (127.0.0.1) | Public Resolvers (1.1.1.1, etc.) |
| Encryption | DNS over TLS (DoT) | Plaintext (Port 53) |
| Integrity | DNSSEC Validation Active | Validation Disabled/Handled by Upstream |
| File Safety | Immutable /etc/resolv.conf | Writable /etc/resolv.conf |
| NM Integration | Unmanaged (dns=none) | Managed (Default) |
Sources: README.md:188-196, DNS_Hardening_Complete_Guide.md:417-425, UNBOUND_TLS_STATUS.md:41-52