The Hardening Script
Relevant source files
The following files were used as context for generating this wiki page:
The Hardening Script (dns_harden.sh) is a core security component of the dns-hardening-parrot project designed to enforce a persistent and secure DNS configuration on Parrot OS. Its primary purpose is to protect the system's DNS resolver settings from unauthorized or automated modifications by third-party services such as Portmaster, NetworkManager, or other dynamic configuration tools.
By applying kernel-level write protection and overriding service-level configurations, the script ensures that the system consistently utilizes the local Unbound resolver while maintaining hardened fallback options. This implementation contributes to a security posture categorized within the top 1-2% globally by preventing common vectors for DNS poisoning, MITM attacks, and metadata leakage.
Sources: scripts/dns_harden.sh, README.md:19-25, CHANGELOG.md:14-17
Core Logic and Execution Flow
The hardening process follows a strict sequence to move the system from a dynamic, potentially vulnerable state to a static, hardened state. It requires root privileges (EUID 0) to manipulate system-level configuration files and file system attributes.
Logical Steps
- Environment Preparation: Establishes logging and creates timestamped backups of existing configurations in
/root/dns_backups/. - File System Manipulation: Removes existing symlinks for
/etc/resolv.conf(often managed bysystemd-resolvedorNetworkManager) and replaces them with a static file. - Service Decoupling: Configures NetworkManager specifically to ignore DNS management through a custom configuration drop-in.
- Immutability Enforcement: Uses the
chattr +icommand to apply the immutable flag to the resolver configuration, preventing any further changes even by the root user.
The following diagram illustrates the high-level execution flow of the script:
Sources: scripts/dns_harden.sh:15-68, README.md:27-36
Configuration Parameters
The script writes specific hardened parameters to the system to ensure query integrity and privacy.
/etc/resolv.conf Content
| Parameter | Value | Description |
|---|---|---|
nameserver | 127.0.0.1 | Directs queries to the local Unbound resolver. |
nameserver | 1.1.1.1, 1.0.0.1, 9.9.9.9 | Hardened fallback providers. |
options timeout | 2 | Reduces wait time for DNS timeouts. |
options attempts | 3 | Number of retry attempts. |
options edns0 | Enabled | Support for Extension Mechanisms for DNS. |
options trust-ad | Enabled | Tells the system to trust the AD (Authenticated Data) flag from the resolver. |
Sources: scripts/dns_harden.sh:37-46, TEST_RESULTS.md:15-26
NetworkManager Override
The script creates a configuration file at /etc/NetworkManager/conf.d/dns-hardening.conf with the following settings:
dns=none: Prevents NM from updating resolv.conf.systemd-resolved=false: Disables integration with systemd-resolved.rc-manager=unmanaged: Explicitly tells NM not to manage the resolv.conf file.
Sources: scripts/dns_harden.sh:52-57, TEST_RESULTS.md:46-51
Verification and Status Monitoring
The project provides a companion script, dns_status.sh, to verify the success of the hardening operations.
Status Indicators
| Component | Success Criteria | Failure State |
|---|---|---|
| Immutable Flag | ACTIVE (detected via lsattr) | MISSING (File is vulnerable) |
| Resolver Path | Using 127.0.0.1 | Using external or dynamic IP |
| NetworkManager | Config file exists | Hardening config missing |
| Unbound Service | Active: running | Inactive or Not running |
Restoration and Reversibility
Because the script sets the immutable flag, standard text editors cannot modify /etc/resolv.conf. To make changes or revert the system, the dns_restore.sh script or manual flag removal is required.
Reversion Procedure
- Remove the immutable flag:
sudo chattr -i /etc/resolv.conf. - (Optional) Execute
dns_restore.shto remove masks from services and restore default public resolvers.
Sources: scripts/dns_harden.sh:72, scripts/dns_restore.sh:54-72, README.md:42-50
Conclusion
The Hardening Script serves as the primary enforcement mechanism for the DNS security suite. By leveraging the Linux immutable file attribute and disabling NetworkManager's dynamic DNS features, it creates a robust environment where the privacy-focused Unbound configuration cannot be bypassed by automated system services or third-party software.