mediumnetworkunverified

Ensure NetworkManager DNS processing mode is not dnsmasq

nm-dns-processing-mode · RHEL ≥ 10 · 1 impl

Description

NetworkManager's "dns" key under [main] must be set (and not to "dnsmasq"), so a local caching resolver is not silently interposed.

Rationale

The dnsmasq local resolver can mask DNS misconfiguration and is not the approved DNS processing mode.

Check → Remediate

Checkcommand

dns=$(NetworkManager --print-config 2>/dev/null | awk -F= '/^[[:space:]]*dns[[:space:]]*=/{gsub(/[[:space:]]/,"",$2);print $2;exit}')
if [ -z "$dns" ] || [ "$dns" = "dnsmasq" ]; then echo "FAIL: NM dns mode is '${dns:-unset}'"; exit 1; fi
echo "OK: NM dns mode is $dns"; exit 0

expected_exit:: 0

Remediatemanual

note:: Set dns=none (or default) under [main] in /etc/NetworkManager/NetworkManager.conf, then reload NetworkManager.

Framework references

STIG

V-281362 / RHEL-10-800300

NIST 800-53

SC-20SC-21

#dns#networkmanager#stig