# Ensure only approved services are listening on a network interface

Necessity: Exposing network services unnecessarily is a primary security risk. Every open port represents a potential entry point for an attacker, increasing the system's attack surface. Services may contain vulnerabilities that can be exploited for unauthorized access, data exfiltration, or denial-of-service attacks. Adhering to the principle of least privilege by only allowing approved network services minimizes this risk significantly.

Auditing and Remediation: The audit script provides a point-in-time snapshot of all network-accessible services by using the `ss` utility to list all listening TCP and UDP sockets. This allows administrators to identify any unauthorized or unexpected open ports. The remediation script configures the system's firewall (`firewalld` in CentOS 7+) to enforce an 'allow-list' policy. It removes all currently permitted services and explicitly adds back only those that are approved, effectively blocking all other inbound traffic by default.

Recommended State Rationale:
- Basic: `['ssh']`. This state establishes a secure baseline by permitting only the Secure Shell service, which is essential for remote administration. All other network access is denied, drastically reducing the attack surface.
- Moderate: `['ssh', 'ntp', 'dhcpv6-client']`. This state builds upon the basic level by adding services often considered essential for a functional server. 'ntp' (for time synchronization via `chronyd`) is critical for accurate logging and authentication protocols. 'dhcpv6-client' is necessary for network autoconfiguration in modern IPv6 environments. This represents a balance between high security and standard operational functionality.
- Strict: `['ssh']`. This state enforces the most stringent security posture, reverting to the absolute minimum required for remote management. It is intended for single-purpose, high-risk systems where every additional service must be explicitly justified and individually added. This configuration ensures the smallest possible attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['ssh']` |
| **Moderate** | `['ssh', 'ntp', 'dhcpv6-client']` |
| **Strict** | `['ssh']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that uses the `ss -lntup` command to identify all listening TCP and UDP network sockets. The script must parse the output to extract the protocol, local port, and the process name for each listening service. The final output should be a single, comma-separated string of these services, with each entry formatted as 'protocol:port:process' (e.g., 'tcp:22:sshd,udp:68:dhclient'). The output must not contain any headers or extra text.

## Remediation Script Working

bash script that accepts a comma-separated list of approved `firewalld` services as a command-line argument (e.g., './remediate.sh "ssh,http"'). The script must first determine the active firewalld zone, remove all existing services from that zone, and then add each approved service from the input list. The new configuration must be made permanent using `firewall-cmd --runtime-to-permanent`. The script must return `true` on success and `false` on failure.

