# Ensure ufw is installed

Necessity: A host-based firewall is a critical security control that protects the system from network-based threats. Uncomplicated Firewall (UFW) provides a user-friendly interface for managing iptables, allowing administrators to control incoming and outgoing traffic. Without a firewall, all network services running on the system are directly exposed to the network, significantly increasing the attack surface and risk of unauthorized access or compromise. Ensuring UFW is installed is the foundational step for securing the host at the network layer.

Auditing and Remediation: The audit script verifies the installation status of the 'ufw' package using the system's package manager (dpkg). The remediation script installs the 'ufw' package using 'apt-get' if it is found to be missing, thereby establishing the necessary software for firewall configuration.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Installed'. This is a binary, foundational control; a system either has the firewall software or it does not. The presence of the UFW package is a prerequisite for any further firewall configuration. Therefore, for all levels of security hardening, the firewall software must be present on the system. The granularity of security (Basic, Moderate, Strict) is applied in subsequent rules that configure the firewall's behavior, not in the installation of the package itself.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'ufw' package is installed. The script must output 'Installed' if the package is found and 'Not Installed' if it is not. The output should contain only this value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state ('Installed'). The script must use the system's package manager to install the 'ufw' package if the argument is 'Installed'. The script should return 'true' upon successful installation or if the package is already installed, and 'false' on any failure.

