0017-resolv-exist-DNS resolv File Deleted¶

Rule ID¶

• 0017-resolv-exist

Category¶

• system

Severity¶

• critical

Compatible Versions¶

• Linux

Description¶

• Monitor whether the host /etc/group file exists

Scan Frequency¶

• disable

Rationale¶

• /etc/resolv.conf is the DNS client configuration file, used to set the DNS server IP address and DNS domain name. It also contains the host's domain search order. This file is the configuration file used by the resolver (a library that resolves IP addresses from hostnames). Its format is simple: each line starts with a keyword followed by one or more space-separated parameters. If this file is deleted, services may become unavailable or DNS resolution may fail.

Risk Item¶

• Service Unavailable

Audit Method¶

• Verify the host /etc/resolv.conf. You can execute the following command to verify:

ls /etc/resolv.conf

Remediation¶

• If /etc/resolv.conf is deleted, execute the touch /etc/resolv.conf command to recreate the file.

Impact¶

• None

Default Value¶

• None

References¶

• Hacker Intrusion Emergency Investigation Ideas & Processes (Unofficial)

• Record of a Real Cryptocurrency Mining Intrusion Investigation Analysis (Unofficial)

CIS Controls¶

• None