# Ensure ftp client is not installed

Necessity: The File Transfer Protocol (FTP) is an insecure, cleartext protocol. It transmits credentials and data without encryption, making them susceptible to interception and eavesdropping by attackers on the network. Removing the FTP client reduces the system's attack surface and prevents users from making insecure connections, thereby protecting sensitive information. The risk of misconfiguration is the potential for data leakage and credential theft.

Auditing and Remediation: The audit script queries the Debian package manager (dpkg) to verify whether the 'ftp' package is installed. The remediation script utilizes the Advanced Package Tool (apt-get) to either completely remove (purge) the 'ftp' package or install it, aligning the system with the desired security state.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Not Installed'. This is because the FTP protocol is fundamentally insecure, and no configuration of the client can mitigate the risks associated with its use. Secure alternatives like SFTP (Secure File Transfer Protocol) or FTPS (FTP over SSL/TLS) should be used instead. For any hardened system, the only acceptable configuration is to have the insecure client software completely removed to enforce the use of secure file transfer methods.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the installation status of the 'ftp' package using the 'dpkg-query' command. The script must output only one of two strings: 'Installed' if the package is found, or 'Not Installed' if it is not.

## Remediation Script Working

Bash script that accepts a single positional argument, which can be either 'Installed' or 'Not Installed'. If the argument is 'Not Installed', the script must use 'apt-get purge -y ftp' to remove the package. If the argument is 'Installed', it should use 'apt-get install -y ftp'. The script must return 'true' if the package is already in the desired state or the operation succeeds, and 'false' on failure.

