RHEL-10-800300 RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks.
All changes in this version
Maps to SC-5 via CCI-002385, CCI-001115
Title
RHEL 10 must configure a DNS processing mode in Network Manager to avoid conflicts with other Domain Name Server (DNS) managers and to not leak DNS queries to untrusted networks.
Control
Verify RHEL 10 has a DNS mode configured in Network Manager. $ NetworkManager --print-config [main] dns=none If the dns key under "main" does not exist or is set to "dnsmasq", this is a finding. Note: If RHEL 10 is configured to use a DNS resolver other than Network Manager, the configuration must be documented and approved by the information system security officer.
Discussion
To ensure that DNS resolver settings are respected, a DNS mode in Network Manager must be configured. The following are common DNS values in "NetworkManager.conf [main]": - default: NetworkManager will update "/etc/resolv.conf" to reflect the nameservers provided by currently active connections. - none: NetworkManager will not modify "/etc/resolv.conf". Used when DNS is managed manually or by another service. - systemd-resolved: Uses "systemd-resolved" to manage DNS. - dnsmasq: Enables the internal "dnsmasq" plugin. Satisfies: SRG-OS-000420-GPOS-00186, SRG-OS-000142-GPOS-00091
Related controls
CCI-001115, CCI-002385
Fix
Configure RHEL 10 to use a DNS mode in Network Manager. In "/etc/NetworkManager/NetworkManager.conf", add the following line in the "[main]" section: dns = none Where is default, none, or systemd-resolved. Network Manager must be reloaded for the change to take effect: $ sudo systemctl reload NetworkManager