# Ensure dnsmasq services are not in use

Necessity: Dnsmasq is a lightweight DNS forwarder and DHCP server. If not explicitly required for the system's function, it unnecessarily exposes network services that could be exploited. An attacker could leverage vulnerabilities in the service to gain unauthorized access, perform DNS spoofing, or conduct man-in-the-middle attacks. Disabling or removing unnecessary services is a fundamental security principle for reducing the system's attack surface. 

Auditing and Remediation: The audit script verifies if the 'dnsmasq' package is installed and, if so, whether its corresponding service is enabled to run. The remediation script provides two levels of mitigation: it can either disable the service, preventing it from starting automatically, or it can purge the package from the system entirely, which is a more permanent and secure solution. 

Recommended State Rationale: 
- Basic/Moderate: ['disabled'] - Disabling the service is the minimum acceptable state. This prevents dnsmasq from actively listening for connections, mitigating the immediate risk of exploitation. This state is appropriate for systems where the package may be needed later or is part of a standard image but is not currently in use. 
- Strict: ['not-installed'] - Recommends completely uninstalling the dnsmasq package. This is the most secure posture as it removes the service's binaries and configuration files, eliminating any possibility of accidental activation or exploitation of the software, even if it's dormant. This adheres to the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['not-installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'dnsmasq' service. The script should output 'not-installed' if the package is not installed. If it is installed, it should output 'disabled' if the service is disabled, or 'enabled' if it is enabled. The script must only return one of these string values with no extra text.

## Remediation Script Working

Bash script that accepts a single positional argument: 'disabled' or 'not-installed'. If the argument is 'disabled', the script must stop and disable the 'dnsmasq' service. If the argument is 'not-installed', it must completely remove the 'dnsmasq' package. The script must return 'true' on successful execution and 'false' on failure.

