# Ensure dns server services are not in use

Necessity: Running a DNS server on a system not designated for that role introduces a significant and unnecessary security risk. Unneeded services expand the system's attack surface, and DNS servers in particular can be exploited for reconnaissance, redirection attacks, cache poisoning, and used as amplifiers in Distributed Denial of Service (DDoS) attacks. Misconfigured or unpatched DNS servers are a common vector for network compromise.

Auditing and Remediation: The audit script verifies whether the BIND DNS package (`named` service) is installed and, if so, whether it is enabled to start on boot. The remediation script ensures the service is inactive by executing the 'systemctl disable --now named' command, which both stops the currently running service and prevents it from starting automatically in the future.

Recommended State Rationale:
- Basic/Moderate: The recommended state is `['disabled', 'Not Installed']`. This ensures that if the BIND package is present for any reason, the service is not running, thereby mitigating the immediate threat of an exposed service. This is a foundational security measure for any server not intended to provide DNS services.
- Strict: The recommended state is `['Not Installed']`. This represents the most secure posture by completely removing the BIND package from the system. This adheres to the principle of least functionality, eliminating all associated binaries and configuration files, which prevents accidental activation and removes any potential vulnerabilities within the software package itself, even when dormant.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled', 'Not Installed']` |
| **Moderate** | `['disabled', 'Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks for the BIND DNS server. If the 'bind' package is not installed, the script must return the string 'Not Installed'. If the package is installed, the script must use 'systemctl is-enabled named' to check the service status and return only the resulting string (e.g., 'enabled', 'disabled'). The script must not output any other text, labels, or formatting.

## Remediation Script Working

bash script that accepts a single positional argument for the desired state. If the argument is 'disabled', the script must use the command 'systemctl disable --now named' to stop and disable the service. The script should not handle uninstallation. The script must return 'true' if the service is successfully disabled or was already in the desired state, and 'false' on any failure.

