Automated Monitoring Service
Relevant source files
The following files were used as context for generating this wiki page:
The Automated Monitoring Service is a comprehensive observability suite designed to ensure the integrity of a hardened DNS infrastructure on Parrot OS. Its primary purpose is to detect unauthorized modifications to critical system files, verify the operational status of the local Unbound resolver, and alert administrators when security postures are compromised.
The service consists of periodic status checks, stateful monitoring, and real-time alerting mechanisms. It tracks the status of the /etc/resolv.conf immutable flag, the priority of the localhost resolver, and the activity of DNS over TLS (DoT) connections.
Sources: MONITORING.md:1-10, CHANGELOG.md:15-18, scripts/dns_monitor.sh:1-5
Service Components and Architecture
The monitoring infrastructure is built as a modular set of Shell scripts managed by system cron jobs. Each component focuses on a specific aspect of the DNS security stack.
Monitoring Logic Flow
The following diagram illustrates how the different monitoring components interact with the system state and log files.
The diagram shows the transition from scheduled triggers to specific monitoring scripts that interact with system state files and various log outputs.
Sources: scripts/dns_monitor.sh:10-40, scripts/dns_alert.sh:1-15, scripts/dns_tls_monitor.sh:1-20
Core Monitoring Scripts
| Script | Purpose | Execution Target |
|---|---|---|
dns_status.sh | Manual on-demand status check with visual indicators. | Manual |
dns_monitor.sh | Stateful monitor that logs only when hardening status changes. | Cron |
dns_alert.sh | Security auditor that logs and notifies on specific compromises. | Cron |
dns_tls_monitor.sh | Verifies active DNS over TLS (Port 853) connections. | Cron |
Sources: MONITORING.md:5-15, scripts/dns_monitoring_install.sh:42-45, UNBOUND_TLS_STATUS.md:46-55
Security Audit and Alerting Logic
The dns_alert.sh and dns_tls_monitor.sh scripts serve as the primary defensive auditing tools. They perform multiple validation steps to ensure the system has not regressed to an insecure state.
Validation Checks
- Immutable Flag Check: Verifies if
/etc/resolv.confhas the+iattribute set usinglsattr. If missing, it indicates a compromise or manual "unhardening". - Resolver Priority: Checks if
127.0.0.1is the first nameserver entry inresolv.confto ensure all queries are routed through the local hardened resolver. - Service Availability: Validates that the
unboundservice is in anactivestate. - TLS Connection Verification: Uses
ss -tnto count active connections on port 853.
Sources: scripts/dns_alert.sh:18-35, scripts/dns_tls_monitor.sh:23-40
Notification System
When a failure is detected, the service utilizes a dual-channel notification approach:
- Log Persistence: Appends detailed error messages to
/var/log/dns_hardening_alerts.log. - Desktop Alerts: If
notify-sendis available, it pushes a critical system notification to the user interface to ensure immediate visibility.
Sources: scripts/dns_alert.sh:8-16, scripts/dns_tls_monitor.sh:8-16
Installation and Configuration
The service is deployed via an interactive installer (dns_monitoring_install.sh) which allows users to select monitoring intervals.
Installation Process Sequence
The sequence shows the interactive steps and system modifications performed during the automated setup.
Sources: scripts/dns_monitoring_install.sh:10-55, MONITORING.md:52-65
Configuration Parameters
The monitoring interval is configurable during installation, resulting in different cron expressions:
| Choice | Interval | Cron Expression |
|---|---|---|
| 1 | 5 Minutes | */5 * * * * |
| 2 | 15 Minutes | */15 * * * * |
| 3 (Default) | 30 Minutes | */30 * * * * |
| 4 | 60 Minutes | 0 * * * * |
Sources: scripts/dns_monitoring_install.sh:30-40
State Management
The dns_monitor.sh script maintains a state file at /var/run/dns_hardening.state. This allows the service to distinguish between a persistent "compromised" state and a new "state change" event, preventing log flooding.
State Transition Logic
- State Change: If the current status (HARDENED/COMPROMISED) differs from the value in the state file, a log entry is created.
- Recovery Logging: Specifically logs "✓ DNS hardening RESTORED" when the system returns to a hardened state.
- Compromise Logging: Specifically logs "✗ DNS hardening COMPROMISED - immutable flag removed" and includes the current contents of the first line of
resolv.conf.
Sources: scripts/dns_monitor.sh:10-38
Summary
The Automated Monitoring Service provides a resilient layer of protection for DNS hardening by combining periodic audits with stateful logging and desktop notifications. By utilizing standard Linux tools like cron, lsattr, and unbound, it ensures that the "Top 1-2% global security posture" of the system is maintained without requiring manual intervention.
Sources: CHANGELOG.md:40-50, README.md:140-150