# Ensure bluetooth services are not in use

The Bluetooth wireless protocol introduces a significant attack surface to a system. It has a history of security vulnerabilities (such as BlueBorne) that could allow a physically proximate attacker to gain unauthorized access, execute arbitrary code, or cause a denial of service. Disabling Bluetooth services when they are not required is a critical security measure that adheres to the principle of least functionality, reducing the risk of exploitation. The audit script checks if the `bluetooth` systemd service is enabled to start on boot, which is the primary indicator of its intended use. The remediation script actively stops the service and disables it from starting automatically in the future. The recommended state for all levels of security is to ensure the service is not in use. A 'Basic' state is to have the service disabled. 'Moderate' and 'Strict' states go further by recommending the service/package be completely uninstalled ('Not Installed'), as this prevents it from being accidentally or maliciously enabled and removes the vulnerable code from the system entirely. If the service is not installed, it cannot be exploited.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled', 'Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses `systemctl is-enabled bluetooth` to check the status of the bluetooth service. The script should output the result directly. If the command fails because the service is not installed, the script should output 'Not Installed'. The output should be only the status string, with no extra text.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state (e.g., 'Disabled'). If the argument is 'Disabled', the script must execute `systemctl stop bluetooth` followed by `systemctl --now disable bluetooth`. The script must return `true` on success and `false` on failure.

