# Ensure sctp kernel module is not available

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol that provides services similar to TCP and UDP. If SCTP is not required for any specific application on the system, disabling its kernel module is a critical security best practice. This action reduces the kernel's attack surface by removing unnecessary code that could potentially contain vulnerabilities. An attacker could otherwise exploit a flaw in the SCTP protocol stack to compromise the system. The principle of least functionality dictates that any component not explicitly required should be disabled. The audit script verifies that the 'sctp' module is both unloaded and configured to be non-loadable. The remediation script enforces this state by creating a modprobe configuration file to blacklist the module and unloads it if it is active. Since the security benefit is binary—the module is either disabled or it is not—the recommended state for Basic, Moderate, and Strict levels is 'Not Available'. There is no intermediate security posture; if the protocol is unused, it should be completely disabled to eliminate the associated risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Available']` |
| **Moderate** | `['Not Available']` |
| **Strict** | `['Not Available']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'sctp' kernel module is disabled. The script must inspect the system's modprobe configuration and currently loaded modules. If the module is prevented from loading (e.g., via 'install sctp /bin/true') and is not currently loaded, the script must return only the string 'Not Available'. Otherwise, it must return 'Available'.

## Remediation Script Working

Bash script that accepts one argument: 'Not Available'. If the argument is 'Not Available', the script must create a configuration file in '/etc/modprobe.d/' to prevent the 'sctp' module from loading (e.g., by adding 'install sctp /bin/true'). The script should also unload the 'sctp' module from the running kernel if it is currently loaded. The script must return 'true' on success and 'false' on failure.

