Monitoring Installation & Lifecycle

The monitoring system in the DNS Hardening Parrot project provides automated oversight of the system's security posture. Its primary purpose is to detect and log unauthorized modifications to critical DNS configurations, specifically targeting the removal of immutable flags on /etc/resolv.conf, the status of the Unbound service, and the integrity of DNS over TLS (DoT) connections.

The lifecycle encompasses automated installation via interactive scripts, periodic execution through cron jobs, stateful monitoring of hardening transitions, and a clean uninstallation process. This system ensures that once the environment is hardened via scripts/dns_harden.sh, any compromise is immediately recorded and potentially alerted via desktop notifications.

Sources: MONITORING.md:1-12, CHANGELOG.md:10-18

Installation Lifecycle

The installation process is managed by dns_monitoring_install.sh, which acts as a wrapper to deploy monitoring scripts to the system's binary path and schedule them using the cron daemon.

Deployment Workflow

1. Root Verification: The script ensures it is running with elevated privileges.
2. Interactive Configuration: The user selects a monitoring interval (5, 15, 30, or 60 minutes).
3. Binary Deployment: Monitoring and alert scripts are moved to /usr/local/bin/ and granted execution permissions.
4. Scheduling: Cron entries are created for both dns_monitor.sh and dns_alert.sh.

The diagram shows the sequential steps taken by the installer to establish periodic monitoring.
Sources: scripts/dns_monitoring_install.sh:10-60

Monitoring Components

The system utilizes three distinct scripts to handle manual checks, stateful logging, and critical alerts.

Sources: MONITORING.md:108-115, scripts/dns_status.sh:1-40

Stateful Monitoring Logic

dns_monitor.sh maintains persistence using a state file at /var/run/dns_hardening.state. It compares the current status of the immutable flag against the last known state to prevent log spamming.

This flowchart illustrates the stateful logic used to minimize redundant logging.
Sources: scripts/dns_monitor.sh:1-35

Alerting and TLS Verification

The system includes specific checks for the health of the encrypted DNS tunnel.

Alert Conditions

dns_alert.sh triggers an alert if any of the following conditions are met:

• The immutable flag (i) is missing from /etc/resolv.conf.
• The localhost resolver (127.0.0.1) is no longer the primary nameserver.
• The unbound service is not active.

Sources: scripts/dns_alert.sh:18-35

TLS Monitoring

The dns_tls_monitor.sh script specifically validates DNS over TLS (DoT) by checking active connections on port 853.

The sequence diagram demonstrates how the system forces DNS traffic to verify that encrypted tunnels are being established correctly.
Sources: scripts/dns_tls_monitor.sh:22-45, UNBOUND_TLS_STATUS.md:65-80

Uninstallation Lifecycle

The dns_monitoring_uninstall.sh script provides a mechanism to revert all changes made during the installation phase.

1. Cron Removal: It uses grep -v to strip the specific monitoring lines from the root crontab.
2. Binary Cleanup: Deletes the scripts from /usr/local/bin/.
3. Optional Log Purge: Interactively asks the user whether to delete historical logs and state files.

Sources: scripts/dns_monitoring_uninstall.sh:13-43

Conclusion

The Monitoring Installation & Lifecycle provides a robust framework for ensuring the continued integrity of the DNS hardening measures. By combining stateful logging, active TLS verification, and automated lifecycle management, the system provides a continuous audit trail and immediate notification of configuration drifts or service failures.

Sources: MONITORING.md:158-170, CHANGELOG.md:40-50