Verification Procedures
Relevant source files
The following files were used as context for generating this wiki page:
Verification procedures in the dns-hardening-parrot project are designed to ensure the integrity, security, and functionality of the hardened DNS infrastructure on Parrot OS. These procedures validate key security features, including DNS over TLS (DoT) encryption, DNSSEC validation, and the protection of system configuration files against unauthorized modifications by services like NetworkManager or Portmaster.
The scope of these procedures covers manual testing, automated monitoring, and state-based alerting. By following these steps, users can confirm their system maintains a high-security posture (top 1-2% globally) and that the Unbound resolver is correctly handling all system-wide DNS queries.
Sources: DNS_Hardening_Complete_Guide.md:1-12, README.md:1-15
Core Verification Methods
Manual Status Verification
The primary method for a quick health check is the dns_status.sh script. This script evaluates the current state of system hardening across five critical dimensions: immutable flags, resolver configuration, service status, NetworkManager integration, and actual resolution capability.
The flow above illustrates how the status check script aggregates multiple technical checks to determine the overall security state of the DNS subsystem.
Sources: scripts/dns_status.sh:10-58, MONITORING.md:12-25
DNSSEC and DoT Validation
Verification of encryption and authenticity requires inspecting the Unbound resolver's behavior during live queries. DNSSEC validation is confirmed by the presence of the Authenticated Data (ad) flag in query responses. DNS over TLS is verified by monitoring active connections on port 853.
| Feature | Verification Command | Expected Indicator |
|---|---|---|
| DNSSEC | dig @127.0.0.1 google.com +dnssec | Presence of ad flag in header |
| DoT | sudo ss -tupn | grep 853 | ESTAB connections to 1.1.1.1 or 9.9.9.9 |
| Resolver | nslookup example.com | Server address shows 127.0.0.1#53 |
Sources: DNS_Hardening_Complete_Guide.md:195-215, UNBOUND_TLS_STATUS.md:7-40
Security Integrity Testing
Immutable Flag Protection
A critical component of the hardening is the use of the chattr +i attribute on /etc/resolv.conf. This prevents modification even by the root user or automated system services. Verification involves attempting a write operation to the file.
Sources: README.md:155-165, scripts/dns_harden.sh:45-46
# Verify the flag is set
lsattr /etc/resolv.conf
# Expected: ----i----------------- /etc/resolv.conf
# Test protection (should fail)
sudo tee /etc/resolv.conf << 'EOF'
nameserver 8.8.8.8
EOF
# Expected: tee: /etc/resolv.conf: Operation not permitted
Sources: TEST_RESULTS.md:16-18, TEST_RESULTS.md:44-47
Monitoring and Alerting Logic
The project implements automated verification through cron-scheduled scripts. dns_monitor.sh tracks state changes, while dns_alert.sh triggers immediate notifications if a compromise is detected (e.g., removal of the immutable flag).
This sequence ensures that administrative logs are not cluttered with redundant information, only capturing transitions between secure and insecure states.
Sources: MONITORING.md:27-45, scripts/dns_monitor.sh:8-41
Automated Test Suites
The project includes a summary of standard test results that should be achieved upon successful implementation.
| Test ID | Objective | Source File Reference |
|---|---|---|
| Test 1 | Immutable Flag Protection | /etc/resolv.conf |
| Test 3 | System DNS Resolution | Using 127.0.0.1#53 |
| Test 6 | NetworkManager Config | dns=none in conf.d |
| Test 9 | DoT Connection | Established on-demand port 853 |
Sources: TEST_RESULTS.md:15-68
TLS Fallback Monitoring
A specific verification procedure is dedicated to detecting "Fallback Mode," where the system bypasses the encrypted Unbound resolver to use plain-text DNS. This is handled by dns_tls_monitor.sh, which triggers queries and then checks for port 853 activity.
Sources: UNBOUND_TLS_STATUS.md:65-80, scripts/dns_tls_monitor.sh:23-40
Conclusion
The verification procedures established in this project provide a multi-layered approach to security auditing. By combining filesystem-level checks (immutable flags), service-level checks (Unbound status), and protocol-level checks (DNSSEC/DoT), the system ensures that the DNS infrastructure remains hardened against poisoning, interception, and unauthorized configuration changes. Regular execution of the provided status and monitoring scripts is recommended to maintain this security posture.