# Ensure iptables-persistent is not installed with ufw

Necessity: Running multiple host-based firewall management tools, such as UFW and iptables-services, on the same system creates a significant security risk. It can lead to conflicting rules, unpredictable network behavior, and security gaps where one tool's rules unintentionally override another's. This misconfiguration complicates firewall management, increases the attack surface, and makes troubleshooting network connectivity issues extremely difficult.

Auditing and Remediation: The audit script verifies if the system has both `ufw` and `iptables-services` packages installed simultaneously, which indicates a configuration conflict. The remediation script resolves this conflict by uninstalling the `iptables-services` package, thereby standardizing on UFW as the single, authoritative firewall management tool for the host.

Recommended State Rationale: This is a binary security control; the configuration is either correct or incorrect. There is no gradation of security. Having `iptables-services` installed alongside UFW is always considered a high-risk misconfiguration. Therefore, the recommended state for all security levels—Basic, Moderate, and Strict—is unequivocally 'Not Installed'. This ensures a predictable, manageable, and secure firewall posture by eliminating the possibility of rule conflicts and undefined behavior.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script for a CentOS system that checks if both the `ufw` and `iptables-services` packages are installed. If both are installed, the script must return the string 'CONFLICT'. If only one or neither is installed, it must return 'OK'. The output must contain only one of these two strings and nothing else.

## Remediation Script Working

Bash script for a CentOS system that accepts one argument: 'Not Installed'. When executed with this argument, the script must uninstall the `iptables-services` package. The script should return `true` if the package is successfully uninstalled or was already not present. It must return `false` if the uninstallation process fails.

