Prerequisites & Compatibility
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The DNS Hardening project for Parrot OS is designed to implement an enterprise-grade DNS infrastructure focusing on DNS over TLS (DoT), DNSSEC validation, and aggressive privacy protection. Its primary goal is to place the host system in the top 1-2% of global DNS security posture by mitigating common threats like DNS poisoning, MITM attacks, and ISP surveillance.
Compatibility is centered around Debian-based environments, specifically Parrot OS, though the logic applies to similar Linux distributions. The system ensures operational stability by integrating emergency restoration mechanisms and protection against third-party network managers that typically override DNS settings.
Sources: README.md:1-12, DNS_Hardening_Complete_Guide.md:1-10
Operating System & Permission Requirements
System Compatibility
The project is explicitly tested and designed for Parrot OS. Due to the reliance on apt for package management and specific file paths like /etc/unbound/ and /etc/NetworkManager/, it is highly compatible with Debian-derivative systems.
Sources: README_SHORT.md:57, DNS_Hardening_Complete_Guide.md:3, README.md:13-25
Privileged Access
Administrative (root) privileges are mandatory for all core operations. All scripts perform a root check at execution to prevent permission-related failures.
Sources: scripts/dns_harden.sh:16, scripts/dns_restore.sh:38-43
| Requirement | Description | Validated By |
|---|---|---|
| User Privileges | Root (EUID 0) | [[ $EUID -ne 0 ]] check in scripts |
| OS Environment | Parrot OS / Debian-based | Package manager dependency (apt) |
| Shell | Bash | #!/bin/bash shebang |
Sources: scripts/dns_harden.sh:16, scripts/dns_restore.sh:1-12
Software Dependencies
The system relies on a specific set of tools to achieve its security objectives.
Core Components
- Unbound: The primary recursive DNS resolver used for local caching and upstream DoT forwarding.
- unbound-anchor: Used to retrieve and update the root trust anchor for DNSSEC validation.
- Systemd: Used to manage the
unboundandsystemd-resolvedservice states.
Sources: README.md:15-18, DNS_Hardening_Complete_Guide.md:21-25
Utility Requirements
- chattr: Required to set the
+i(immutable) flag on/etc/resolv.confto prevent unauthorized modifications. - dig / nslookup: Used by monitoring and verification scripts to validate resolution and DNSSEC flags.
- NetworkManager: While the project disables its DNS management, it must be present to apply the unmanaged configuration.
Sources: README.md:46-52, scripts/dns_harden.sh:47-65, TEST_RESULTS.md:44-51
Network & Configuration Compatibility
Service Conflict Resolution
The system is incompatible with active systemd-resolved stub listeners, as they conflict with Unbound for port 53. The installation process explicitly stops and masks systemd-resolved to ensure Unbound can bind to the local interface.
Sources: README.md:13-25, DNS_Hardening_Complete_Guide.md:144-162
Upstream Connectivity
For DNS over TLS to function, the network must allow outbound traffic on TCP Port 853. The configuration utilizes several high-reputation providers as shown in the flow below:
The diagram shows the transition from local application queries to encrypted upstream traffic.
Sources: configs/unbound.conf:75-87, UNBOUND_TLS_STATUS.md:6-15
Compatibility with Third-Party Software
Portmaster & NetworkManager
A major feature of this project is compatibility through "resistance." Third-party tools like Portmaster or standard NetworkManager settings often attempt to overwrite /etc/resolv.conf. The project achieves compatibility by:
- Removing the dynamic symlink.
- Creating a static configuration file.
- Applying the kernel-level immutable flag.
Sources: CHANGELOG.md:15-18, README_SHORT.md:38-46
Hardware Resource Constraints
The Unbound configuration is optimized for low-to-medium resource environments, making it compatible with most standard Parrot OS installations.
| Parameter | Configuration Value | Context |
|---|---|---|
num-threads | 2 | CPU Utilization |
msg-cache-size | 50m | Memory Limit |
rrset-cache-size | 100m | Memory Limit |
key-cache-size | 100m | DNSSEC Cache |
Sources: configs/unbound.conf:41-45, configs/unbound.conf:67-70
Summary
To successfully deploy the DNS Hardening system, the host must be a Debian-based Linux distribution (Parrot OS) with root access. It requires the Unbound resolver and must ensure that Port 853 is not blocked by firewalls to support DNS over TLS. The architecture is specifically designed to be "Portmaster-resistant" by leveraging filesystem immutable flags, ensuring that hardened settings persist despite attempts by other network services to modify them.
Sources: README_SHORT.md:1-12, TEST_RESULTS.md:62-75