Status Monitoring Utility
Relevant source files
The following files were used as context for generating this wiki page:
The Status Monitoring Utility is a specialized suite of tools within the DNS Hardening Parrot project designed to verify, track, and alert on the state of system DNS configurations. Its primary purpose is to ensure that the hardening measures applied—such as the immutable flag on /etc/resolv.conf and the Unbound local resolver—remain active and uncompromised by other system services like NetworkManager or Portmaster.
The utility operates through a combination of manual check scripts and automated background tasks. It provides a comprehensive audit trail through dedicated log files and uses visual indicators to signal the "HARDENED" or "COMPROMISED" state of the host's DNS infrastructure.
Sources: MONITORING.md:1-10, CHANGELOG.md:10-20
Architecture and Components
The monitoring system is structured into three distinct layers: manual verification, stateful change monitoring, and real-time alerting.
Core Monitoring Components
| Component | Script File | Execution Method | Target |
|---|---|---|---|
| Manual Status Check | dns_status.sh | On-demand | Immutable flag, Unbound status, Resolution |
| Stateful Monitor | dns_monitor.sh | Cron (5-30 min) | State changes (Restored vs. Compromised) |
| Active Alerter | dns_alert.sh | Cron (1 min) | Immediate compromise detection |
| TLS Watchdog | dns_tls_monitor.sh | Cron (30 min) | Port 853 (DoT) active connections |
Sources: MONITORING.md:5-50, UNBOUND_TLS_STATUS.md:40-50
Monitoring Logic Flow
The following diagram illustrates how the dns_status.sh script evaluates the system's security posture.
The script performs sequential checks on the kernel-level file protection, configuration content, service availability, and functional connectivity.
Sources: scripts/dns_status.sh:13-55
Manual Status Verification
The dns_status.sh script provides immediate visual feedback on the hardening state. It checks the following specific attributes:
- Immutable Flag: Uses
lsattrto verify if theiattribute is set on/etc/resolv.conf, preventing even root-level modifications. - Resolver Integrity: Greps
/etc/resolv.confto ensure127.0.0.1(localhost) is the designated nameserver. - Service Health: Uses
systemctl is-activeto confirm the Unbound resolver is running. - Functional Test: Executes an
nslookupon a known domain (google.com) to verify resolution is actually working through the hardened stack.
Sources: scripts/dns_status.sh:13-43, MONITORING.md:13-22
Automated State Monitoring
Periodic monitoring is handled by dns_monitor.sh, which is designed to log only when the system state transitions between "HARDENED" and "COMPROMISED". This prevents log bloat during normal operation.
State Persistence
The utility maintains state using a dedicated file at /var/run/dns_hardening.state.
- If the current state differs from the previous state, an event is logged to
/var/log/dns_hardening_monitor.log. - In the event of a compromise, the script captures and logs the current content of
/etc/resolv.confto aid in forensic analysis.
Sources: scripts/dns_monitor.sh:16-38
Alerting and TLS Verification
The dns_alert.sh and dns_tls_monitor.sh scripts provide the highest level of scrutiny, focusing on immediate failures and encryption verification.
Compromise Alerts
dns_alert.sh runs every minute and triggers alerts if:
- The immutable flag is missing.
- The localhost resolver is no longer the primary nameserver.
- The Unbound service is stopped.
Alerts are written to /var/log/dns_hardening_alerts.log and, if available, sent as desktop notifications via notify-send.
Sources: scripts/dns_alert.sh:8-35
Encryption Monitoring (DNS over TLS)
The dns_tls_monitor.sh script specifically verifies that DNS queries are being encrypted over TLS (port 853). It proactively triggers queries to domains like cloudflare.com and google.com, then checks for active connections using ss -tn.
Sources: scripts/dns_tls_monitor.sh:19-32, UNBOUND_TLS_STATUS.md:40-60
Installation and Configuration
Monitoring is typically deployed using dns_monitoring_install.sh, which offers an interactive menu for setting cron intervals.
| Log Path | Purpose | Source Script |
|---|---|---|
/var/log/dns_hardening_monitor.log | Records transitions between hardened/compromised states. | dns_monitor.sh |
/var/log/dns_hardening_alerts.log | Detailed alerts for specific security failures. | dns_alert.sh, dns_tls_monitor.sh |
/var/run/dns_hardening.state | Tracks the last known security state. | dns_monitor.sh |
Sources: scripts/dns_monitoring_install.sh:31-45, MONITORING.md:73-82
Monitoring Installation Flow
Summary
The Status Monitoring Utility provides an essential defense-in-depth layer for DNS hardening. By combining proactive TLS connection verification with reactive alerting on configuration changes, it ensures that the "Top 1-2% global security posture" of the system is maintained against automated overrides by other networking software.
Sources: README.md:9-15, TEST_RESULTS.md:65-75