0016-resolv-resolv Modified¶

Rule ID¶

• 0016-resolv

Category¶

• system

Severity¶

• warn

Supported Versions¶

• Linux

Description¶

• Monitors host /etc/resolv.conf for modifications

Scan Frequency¶

• disable

Rationale¶

• /etc/resolv.conf is the DNS client configuration file, used to set the DNS server IP address and DNS domain name, and also contains the host's domain search order. This file is the configuration file used by the domain name resolver (resolver, a library that resolves hostnames to IP addresses). Its format is simple: each line starts with a keyword followed by one or more space-separated parameters. If this file is tampered with illegally, it can cause service unavailability or DNS resolution failure.

Risk Items¶

• Hacker intrusion

• Data leakage

• Network security

• Cryptomining risk

• Botnet risk

Audit Method¶

• Verify whether the host /etc/resolv.conf has been illegally modified. You can run the following command to verify:

ls -l /etc/resolv.conf

Remediation¶

• If the host /etc/resolv.conf has been illegally modified, be sure to carefully inspect the host environment for signs of intrusion and change the host user password.

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None