# Ensure wireless interfaces are disabled

Necessity: Disabling wireless interfaces is a critical security measure for servers. Wireless networks introduce a significant attack surface, making the system vulnerable to unauthorized access, eavesdropping, and various radio-frequency attacks. Servers, which typically reside in physically secure data centers with wired connections, do not require wireless functionality. An active wireless interface presents an unnecessary risk and a potential vector for compromise that bypasses traditional network firewalls.

Auditing and Remediation: The audit script queries the NetworkManager service via the `nmcli` command-line utility to determine the current software state of the Wi-Fi radio. The remediation script uses the same utility to set the software switch for the Wi-Fi radio to the 'off' position, effectively disabling all wireless network capabilities managed by the operating system.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'disabled'. This is a binary control with no middle ground for a secure server environment. Any level of hardening requires that unnecessary communication channels be closed. Since a wireless interface on a typical CentOS server is unnecessary, it must be disabled to adhere to the principle of least functionality and minimize the attack surface. There is no security benefit to leaving it enabled, hence the consistent recommendation across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that uses 'nmcli radio wifi' to check the status of wireless radios. The script must parse the output and return only the string 'disabled' if Wi-Fi is off, or 'enabled' if it is on. The output must contain no extra text or formatting.

## Remediation Script Working

shell script that accepts a single positional argument, which must be 'disabled'. Upon receiving this argument, the script must execute 'nmcli radio wifi off' to disable all wireless interfaces. The script must return 'true' on successful execution and 'false' on failure or if an incorrect argument is provided.

