# Ensure web server services are not in use

Necessity: Web servers are a primary vector for cyberattacks. Vulnerabilities in the web server software (e.g., Apache, Nginx) or the web applications they host can be exploited to gain unauthorized access, compromise data, or use the system for malicious purposes. Disabling or removing web server packages on systems that do not require them is a critical security measure that reduces the system's attack surface, adhering to the principle of least functionality.

Auditing and Remediation: The audit script verifies whether common web server packages ('httpd', 'nginx') are installed on the system, which is a reliable indicator of a web server's presence. The remediation script automates the complete removal of these packages, which is more secure than simply disabling the services as it prevents them from being accidentally or maliciously re-enabled.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Not Installed'. For a system not explicitly intended to be a web server, there is no secure justification for having web server software present. A disabled service can still be a security risk, as it might be re-enabled during a system update or by an administrator mistake. Complete removal is the only state that guarantees the service cannot run, thereby providing the highest level of security for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the presence of the 'httpd' (Apache) and 'nginx' packages. The script must output 'Installed' if either package is installed, and 'Not Installed' if neither is found. The output must be limited to only these strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument. If the argument is 'Not Installed', the script must use the system's package manager (e.g., 'yum' or 'dnf') to remove the 'httpd' and 'nginx' packages. The script must return 'true' upon successful removal or if the packages were already absent, and 'false' if the removal process fails.

