# Ensure avahi daemon services are not in use

Necessity: The Avahi daemon provides zero-configuration networking (zeroconf/mDNS), allowing systems to publish and discover services on a local network without manual configuration. On a server, this functionality is typically unnecessary and increases the attack surface. It can broadcast information about the host and its services, which could be exploited by an attacker on the same network segment to gather intelligence. Disabling Avahi adheres to the principle of least functionality by removing unneeded services.

Auditing and Remediation: The audit script verifies the status of the 'avahi-daemon' systemd service to determine if it is enabled to start at boot. The remediation script either stops and disables the service to prevent it from running or, for a stricter configuration, removes the 'avahi' package from the system entirely.

Recommended State Rationale:
- Basic: ['disabled'] - This is the minimum acceptable state. Disabling the service prevents it from starting on boot, which effectively mitigates the immediate risk of network information disclosure.
- Moderate: ['disabled'] - For this particular setting, disabling the service is a sufficient moderate control, as it prevents its operation.
- Strict: ['not installed'] - The most secure configuration is to remove the package entirely. This prevents an administrator from accidentally re-enabling the service and ensures the system's software footprint is minimized, reducing the potential for future vulnerabilities associated with the package.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'avahi-daemon' service is enabled. The script should use 'systemctl is-enabled avahi-daemon.service'. If the service is not found, the script should output 'not installed'. Otherwise, it must return only the status (e.g., 'enabled', 'disabled') with no extra text.

## Remediation Script Working

Bash script that accepts one positional argument: the desired state ('disabled' or 'not installed'). If the argument is 'disabled', the script must use 'systemctl stop avahi-daemon.service' and 'systemctl disable avahi-daemon.service'. If the argument is 'not installed', it should use the system's package manager (e.g., 'yum remove avahi') to uninstall the package. The script must return 'true' on success and 'false' on failure.

