Alerting System
Relevant source files
The following files were used as context for generating this wiki page:
The Alerting System in the DNS Hardening project is a multi-layered monitoring framework designed to detect and report compromises to the secure DNS configuration on Parrot OS. It ensures the integrity of the local Unbound resolver, the immutability of system DNS settings, and the active state of DNS over TLS (DoT) connections.
The system operates primarily through scheduled background tasks (cron jobs) that execute specialized scripts to validate system state. When a deviation from the hardened state is detected, the system generates log entries and, if available, triggers desktop notifications to alert the user of a potential security compromise.
Sources: MONITORING.md:1-12, scripts/dns_alert.sh:1-5, CHANGELOG.md:15-18
System Architecture and Workflow
The alerting system is composed of three primary functional modules that work in tandem to provide a comprehensive audit trail and real-time notification mechanism.
Logic Flow for Compromise Detection
The following diagram illustrates the decision logic used by the primary alert script to determine if the system has been compromised.
The alerting system validates three critical security pillars: the kernel-level write protection of the configuration, the priority of the local resolver, and the operational status of the encryption service.
Sources: scripts/dns_alert.sh:16-36
Monitoring Components
The system utilizes specialized scripts to monitor different aspects of the DNS infrastructure.
Core Alerting (dns_alert.sh)
This is the primary security watchdog. It performs high-frequency checks (typically every minute) to ensure the system remains in a hardened state. It specifically monitors:
- Immutable Flag: Verification via
lsattrthat/etc/resolv.confcannot be modified by root or other services. - Resolver Priority: Ensuring
127.0.0.1remains the primary nameserver. - Service Integrity: Verifying that the
unboundservice is actively running.
Sources: scripts/dns_alert.sh:16-36, MONITORING.md:43-52
State Change Monitoring (dns_monitor.sh)
Unlike the alert script which focuses on failure, the monitor script tracks transitions between states. It maintains a state file at /var/run/dns_hardening.state and logs only when the system moves from "HARDENED" to "COMPROMISED" or vice versa.
Sources: scripts/dns_monitor.sh:1-40, MONITORING.md:23-38
TLS and Fallback Monitoring (dns_tls_monitor.sh)
This component ensures that DNS queries are actually being encrypted via Port 853. It triggers dummy DNS queries to force connection establishment and then audits active sockets.
Sources: scripts/dns_tls_monitor.sh:1-45, UNBOUND_TLS_STATUS.md:55-75
Alerting Mechanisms and Outputs
The system provides two forms of feedback when a compromise is detected: persistent logs and transient notifications.
| Output Type | Destination | Description |
|---|---|---|
| Alert Log | /var/log/dns_hardening_alerts.log | Detailed timestamped entries of security failures. |
| Monitor Log | /var/log/dns_hardening_monitor.log | History of state transitions (Restored vs. Compromised). |
| Desktop Notification | notify-send | Critical UI alerts with 30-second persistence if a GUI is active. |
Sources: scripts/dns_alert.sh:7-14, MONITORING.md:65-73, scripts/dns_monitor.sh:17-21
Installation and Configuration
The alerting system is deployed via an interactive installer that configures system schedules.
Deployment Process
Configuration Options
Users can choose the frequency of the background checks during installation. The recommended setting is every 30 minutes to balance security with system overhead.
| Choice | Interval String | Frequency |
|---|---|---|
| 1 | */5 * * * * | Every 5 Minutes |
| 2 | */15 * * * * | Every 15 Minutes |
| 3 | */30 * * * * | Every 30 Minutes (Recommended) |
| 4 | 0 * * * * | Every Hour |
Sources: scripts/dns_monitoring_install.sh:26-45, MONITORING.md:58-63
Summary
The Alerting System provides the necessary visibility into the DNS security posture of Parrot OS. By combining immutable file checks, service monitoring, and TLS socket auditing into a unified logging and notification framework, it ensures that any attempts by services like NetworkManager or Portmaster to override secure settings are immediately detected and recorded.
Sources: README.md:120-135, CHANGELOG.md:46-51