# Ensure ufw is installed

Necessity: Uncomplicated Firewall (ufw) is a user-friendly front-end for managing iptables or nftables, simplifying the process of configuring a host-based firewall. A host-based firewall is a critical security control that protects the system from network-based threats by filtering incoming and outgoing traffic. Failure to have a configured firewall installed exposes the system to unauthorized access, port scanning, and various network attacks. While CentOS systems typically use firewalld by default, organizational policy may mandate the use of ufw. Having it installed is the first step to ensuring compliance and proper configuration.

Auditing and Remediation: The audit script queries the RPM package database to determine if the ufw package is present. The remediation script utilizes the system's package manager (yum or dnf) to install the ufw package if it is found to be missing, thereby establishing the foundational requirement for firewall configuration.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is 'Installed'. This is a binary, foundational control; the specified firewall management tool must be present on the system to be configured and enforced. There is no lesser or greater state than having the necessary software installed. Therefore, Basic, Moderate, and Strict levels all require the package to be present as a prerequisite for any subsequent firewall rule configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'ufw' package is installed using the system's package manager. The script must output only the string 'Installed' or 'Not Installed' to standard output.

## Remediation Script Working

Bash script that accepts one argument: the desired state ('Installed' or 'Not Installed'). If the state is 'Installed', the script must use the system's package manager (yum or dnf) to install 'ufw'. The script must return 'true' on success and 'false' on failure. Handling for 'Not Installed' (uninstallation) is optional but should not error.

