Test Results Analysis
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Test Results Analysis provides a comprehensive evaluation of the DNS hardening implementation for Parrot OS. It validates the effectiveness of security measures such as immutable file protection, DNS over TLS (DoT) connectivity, and DNSSEC validation. The analysis ensures that the system remains in the top 1-2% of global security postures by verifying that local resolvers cannot be bypassed by services like Portmaster or NetworkManager.
This module relies on a suite of automated scripts and manual verification steps to confirm that the Unbound resolver is functioning correctly, the /etc/resolv.conf file is write-protected at the kernel level, and fallback mechanisms are properly configured.
Sources: TEST_RESULTS.md:1-5, CHANGELOG.md:1-15, UNBOUND_TLS_STATUS.md:1-10
Hardening Verification Metrics
The project utilizes specific pass/fail criteria to determine the "Hardened" or "Compromised" status of the system. The core of this verification lies in the immutable attribute of the system's DNS configuration file.
Core Security Tests
The following table summarizes the primary test cases executed during the hardening analysis:
| Test ID | Metric | Expected Result | Implementation Logic |
|---|---|---|---|
| Test 1 | Immutable Flag | ----i--------- | Uses lsattr to check kernel-level protection |
| Test 2 | Resolv.conf Content | Nameserver 127.0.0.1 | Verifies local Unbound is the primary resolver |
| Test 5 | Modification Block | Operation not permitted | Attempts to tee to the file as root |
| Test 6 | NetworkManager | dns=none | Ensures NM does not manage DNS settings |
| Test 7 | Service Status | active | Confirms the Unbound daemon is running |
Sources: TEST_RESULTS.md:7-40, scripts/dns_status.sh:15-45
Status Determination Logic
The system status is determined by a binary check of the immutable flag. If the flag is missing, the system is flagged as "COMPROMISED," necessitating a re-run of the hardening script.
Sources: scripts/dns_status.sh:48-55, scripts/dns_monitor.sh:10-15
Monitoring Architecture and Data Flow
The monitoring system consists of three distinct layers: manual status checks, periodic state monitoring, and real-time compromise alerting.
The diagram shows the relationship between the hardening script and the multi-layered monitoring suite.
Sources: scripts/dns_monitor.sh:5-35, scripts/dns_alert.sh:5-25, MONITORING.md:1-30
State Tracking and Alerting
The monitoring logic uses a state file (/var/run/dns_hardening.state) to compare the current security posture against the previous check. This prevents redundant logging and ensures that only transitions (e.g., RESTORED to COMPROMISED) are recorded in the monitor log.
Sources: scripts/dns_monitor.sh:17-40, CHANGELOG.md:40-50
DNS over TLS (DoT) Performance Analysis
The analysis of DoT focuses on active connections to port 853. Unlike standard DNS, DoT connections may be established on-demand, which can result in an "INFO" status rather than a "PASS" if no queries are active during the test.
TLS Connection Flow
The dns_tls_monitor.sh script triggers active queries to ensure TLS handshakes occur before verifying port status.
This sequence ensures that TLS connectivity is verified under load rather than idle state.
Sources: scripts/dns_tls_monitor.sh:22-35, UNBOUND_TLS_STATUS.md:12-25
DoT Verification Commands
Verification of DoT and DNSSEC is performed using the following toolset:
- TLS Check:
sudo ss -tupn | grep 853(Checks for connections to 1.1.1.1, 9.9.9.9, etc.) - DNSSEC Check:
dig @127.0.0.1 +dnssec | grep flags(Looks for theador Authenticated Data flag) - Fallback Check: Ensuring
nslookupreports127.0.0.1#53as the server.
Sources: TEST_RESULTS.md:42-45, UNBOUND_TLS_STATUS.md:12-40
Audit and Logging Analysis
Comprehensive logging is implemented to provide an audit trail for all hardening and restoration events.
| Log Path | Purpose | Source Script |
|---|---|---|
/tmp/dns_harden_*.log | Detailed output of the hardening process | dns_harden.sh |
/var/log/dns_hardening_monitor.log | History of state transitions (HARDENED/COMPROMISED) | dns_monitor.sh |
/var/log/dns_hardening_alerts.log | Security breach events (e.g., flag removal) | dns_alert.sh |
/root/dns_backups/ | Storage for pre-hardening configuration states | dns_harden.sh |
Sources: scripts/dns_harden.sh:10-15, scripts/dns_monitor.sh:5-10, CHANGELOG.md:52-60
Conclusion
The Test Results Analysis confirms that the DNS hardening system successfully implements kernel-level protection for DNS configurations. By combining immutable file attributes with continuous monitoring of Unbound's TLS state and resolver priority, the system mitigates risks associated with local DNS hijacking and ISP surveillance. The use of timestamped logs and automated state tracking provides a robust audit trail necessary for enterprise-grade security environments.
Sources: TEST_RESULTS.md:50-65, CHANGELOG.md:1-10