# Ensure sctp kernel module is not available

The Stream Control Transmission Protocol (SCTP) is a transport layer protocol that is not commonly used on most systems. Disabling kernel modules for unneeded network protocols is a critical security practice. It reduces the kernel's attack surface by removing code that could potentially contain vulnerabilities. An attacker could exploit a flaw in an unused but loaded kernel module to compromise or crash the system. The audit script verifies that the `sctp` module is both unloaded from the running kernel and blacklisted via a modprobe configuration to prevent it from loading on boot. The remediation script enforces this state by unloading the module and creating the necessary blacklisting configuration file. Since the security benefit is binary—the module is either available or it is not—the recommended state for Basic, Moderate, and Strict security levels is 'disabled'. Any system not explicitly requiring SCTP for a specific application should have this module disabled to maintain a minimal and secure kernel environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the `sctp` kernel module is disabled. The script should verify that the module is not currently loaded (via `lsmod`) and that its loading is prevented (via `modprobe`). The script must return the string 'disabled' if the module is properly disabled, and 'enabled' otherwise. The output must contain only this string.

## Remediation Script Working

Bash script that accepts a single positional argument, the desired state, which must be 'disabled'. The script will create a configuration file in `/etc/modprobe.d/` to prevent the `sctp` module from being loaded and will attempt to unload the module from the running kernel if it is active. The script must return `true` on success and `false` on failure.

