# Ensure tftp server services are not in use

The Trivial File Transfer Protocol (TFTP) is a simplified, unauthenticated, and unencrypted version of FTP. Its lack of security controls makes it highly vulnerable to abuse. Attackers can use an exposed TFTP server to exfiltrate sensitive data or upload malicious files to the system. The audit script verifies whether the `tftp-server` package is installed, as its presence indicates a potential risk. The remediation script removes this package to eliminate the service entirely. For all security levels (Basic, Moderate, and Strict), the recommended state is 'Not Installed'. This aligns with the principle of least functionality, which dictates that any software not explicitly required for the system's function should be removed to reduce the attack surface. There is no secure configuration for a TFTP server on a general-purpose system; disabling the service is insufficient, as it could be re-enabled accidentally or maliciously. Complete removal is the only definitive mitigation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the `tftp-server` package is installed. The script must output 'Installed' if the package is present, and 'Not Installed' if it is not. Ensure no other text is output.

## Remediation Script Working

Bash script that accepts one positional argument representing the desired state. If the argument is 'Not Installed', the script must attempt to remove the `tftp-server` package using the system's package manager. The script must output `true` on successful removal or if the package was already not present, and `false` if the removal fails.

