SV-281362r1167236: RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks. | Red Hat Enterprise Linux 10 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks.

Description

Discussion Text

To ensure that DNS resolver settings are respected, a DNS mode in Network Manager must be configured. The following are common DNS values in "NetworkManager.conf [main]": - default: NetworkManager will update "/etc/resolv.conf" to reflect the nameservers provided by currently active connections. - none: NetworkManager will not modify "/etc/resolv.conf". Used when DNS is managed manually or by another service. - systemd-resolved: Uses "systemd-resolved" to manage DNS. - dnsmasq: Enables the internal "dnsmasq" plugin. Satisfies: SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00091

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002385Not mappedCCI-001115

References

DPMS Target Red Hat Enterprise Linux 10 DISA DPMS Target Red Hat Enterprise Linux 10 5733

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel10os:def:281362
# RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# DNS setting exists in NetworkManager.conf and is default or none
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ( (sed -En 's/^dns=(\S*)\s*$/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -qxF 'none' ) || ( (sed -En 's/^dns=(\S*)\s*$/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -qxF 'default' ) || ( (sed -En 's/^dns=(\S*)\s*$/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -qxF 'systemd-resolved' )
}
# DNS setting exists in NetworkManager.conf main section
# textfilecontent54_object (textfilecontent54_test)
test_2() {
  (sed -En 's/^\[main\]((?:\r?\n(?:[^[\r\n].*)?)*)/\1/p' '/etc/NetworkManager/NetworkManager.conf') | grep -Pq '\ndns='
}

if ( test_1 && test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure RHEL 10 to use a DNS mode in Network Manager.

In "/etc/NetworkManager/NetworkManager.conf", add the following line in the "[main]" section:

dns = none

Where <dns processing mode> is default, none, or systemd-resolved.

Network Manager must be reloaded for the change to take effect:

$ sudo systemctl reload NetworkManager