# Ensure only approved services are listening on a network interface

Necessity: Every listening network service represents a potential attack surface. Unnecessary or misconfigured services can be exploited by attackers to gain unauthorized access, exfiltrate data, or launch denial-of-service attacks. The principle of least functionality dictates that only essential services required for the system's specific role should be active, thereby minimizing potential vulnerabilities.

Auditing and Remediation: The audit script provides an inventory of all active network listeners and their associated processes, offering a clear view of the system's current exposure. The remediation script enforces a security policy by taking a pre-defined 'allow list' of services. It programmatically stops and disables any running service not on this list, effectively reducing the attack surface to only what is explicitly approved.

Recommended State Rationale:
- Basic: Recommends allowing `sshd` for essential remote administration and `systemd-resolve` for local DNS caching, which is a standard component. This state is suitable for a general-purpose managed server.
- Moderate: Recommends allowing only `sshd`. This stricter configuration is for systems that do not require local DNS resolution or any other network service beyond secure remote access, such as dedicated application servers where DNS is handled externally.
- Strict: Recommends allowing no publicly listening services. This state is for highly sensitive systems or appliances that are managed via a console or a separate, isolated management network. It represents the most secure posture by eliminating all network-based attack vectors, suitable for offline systems or those behind a bastion host.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['sshd:22', 'systemd-resolve:53']` |
| **Moderate** | `['sshd:22']` |
| **Strict** | `[]` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes `ss -ltunp` to list all listening TCP and UDP sockets. The script must parse this output to return a single, comma-separated string of all unique listening services in the format 'process_name:port' (e.g., 'sshd:22,systemd-resolve:53'). The list should be sorted alphabetically.

## Remediation Script Working

Bash script that accepts a single command-line argument: a comma-separated string of approved services in 'process_name:port' format. The script must identify all currently listening network services, compare them against the approved list, and for each unapproved service, identify its systemd unit and execute `systemctl stop` and `systemctl disable`. The script must return `true` if all unapproved services are successfully stopped or if there are no unapproved services to begin with. It must return `false` if it fails to stop any unapproved service.

