# Ensure tftp server services are not in use

The Trivial File Transfer Protocol (TFTP) is a legacy protocol that lacks authentication and encryption, making all data transfers insecure. Its presence on a system introduces a significant security risk, as it can be exploited to exfiltrate sensitive data or introduce malicious files. An attacker could potentially access configuration files, operating system images, or other data transmitted via TFTP. The audit script checks if the 'tftpd-hpa' package, a common TFTP server implementation, is installed and running. The remediation script ensures its complete removal from the system. The recommended state for all security levels (Basic, Moderate, and Strict) is 'Not Installed'. There is no secure configuration for an unnecessary and insecure service; therefore, its complete removal is the only acceptable baseline to eliminate the associated risks of data exposure and unauthorized system access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the installation status of the 'tftpd-hpa' package. The script must output 'Not Installed' if the package is not found. If the package is installed, it should check if the service is active and output 'Installed and Active' or 'Installed but Inactive'. The script must return only one of these exact string values and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument for the desired state. If the argument is 'Not Installed', the script must use the command 'apt-get purge -y tftpd-hpa' to completely remove the TFTP server package. The script must output 'true' on success (including if the package was already uninstalled) and 'false' on failure.

