RHEL 9 must configure a DNS processing mode in Network Manager.

STIG ID: RHEL-09-252040  |  SRG: SRG-OS-000480-GPOS-00227 |  Severity: medium |  CCI: CCI-000366 |  Vulnerability Id: V-257949

Vulnerability Discussion

In order to ensure that DNS resolver settings are respected, a DNS mode in Network Manager must be configured.

Check

Verify that RHEL 9 has a DNS mode configured in Network Manager.

$ NetworkManager --print-config
[main]
dns=none

If the dns key under main does not exist or is not set to "none" or "default", this is a finding.

Note: If RHEL 9 is configured to use a DNS resolver other than Network Manager, the configuration must be documented and approved by the information system security officer (ISSO).

Fix

Configure NetworkManager in RHEL 9 to use a DNS mode.

In "/etc/NetworkManager/NetworkManager.conf" add the following line in the "[main]" section:

dns = none

NetworkManager must be reloaded for the change to take effect.

$ sudo systemctl reload NetworkManager
This website is not created by, run, approved, or endorsed by the U.S. Department of Defense. Use at your own risk. This website is created by open-source software.