DNS: The Parting Shot

The outgoing sysadmin broke internal name resolution on their way out — the resolver only points at a public nameserver now, and the hosts file has lost the one static record everything else depends on. Restore resolution properly, then go see what they left behind for the next person to find.

Record your findings under /root/case:

1. Make the internal DNS server (10.0.0.53) the resolver's first nameserver in /etc/resolv.conf — glibc queries in order and stops on the first answer, so an internal server listed below the public one is never consulted.

2. Restore the missing /etc/hosts record for audit.internal (10.0.0.25).

3. Once you're back in root's home fixing things, something left there won't stay hidden. Recover the flag to /root/case/flag.txt.

See /root/case/brief.txt.