# Ensure ufw default deny firewall policy

Necessity: A 'default deny' firewall policy is a foundational security principle. It ensures that all unsolicited incoming network traffic is blocked by default, and only connections to services that have been explicitly and purposefully opened are permitted. This configuration significantly reduces the system's attack surface by preventing unauthorized access to potentially vulnerable services. Misconfiguring this to 'allow' would leave all network ports open by default, exposing the system to scans and attacks.

Auditing and Remediation: The audit script inspects the UFW (Uncomplicated Firewall) status to determine the default policy for incoming traffic, extracting the specific policy word. The remediation script modifies this global rule, using the provided argument to set the default behavior for all incoming packets that do not match an existing 'allow' rule.

Recommended State Rationale:
- Basic: ['deny'] is the absolute minimum for a secure system. It establishes a 'blocklist' model, where everything is blocked unless explicitly permitted. This is considered a fundamental best practice.
- Moderate: ['deny'] remains the recommendation. There is no effective intermediate state; a system's default policy should either be secure ('deny') or it is insecure.
- Strict: ['deny'] is the strictest and most secure setting. While 'reject' is an alternative, it sends a response packet to the originator, confirming the host is active. 'deny' silently drops the packet, which is preferable as it reveals less information about the host during network reconnaissance.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['deny']` |
| **Moderate** | `['deny']` |
| **Strict** | `['deny']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes the command `ufw status verbose | grep 'Default:' | awk '{print $2}' | sed 's/[(),]//g'` to retrieve the default incoming firewall policy. The script must be configured to output only the policy name (e.g., 'deny') without any surrounding text or labels.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which will be the desired default policy (e.g., 'deny', 'allow', 'reject'). The script must execute the command `ufw default "$1"` to apply the setting. The script must return `true` upon successful execution or `false` if the command fails.

