# Ensure ufw service is enabled

Necessity: A host-based firewall is a critical security control that protects a system by filtering incoming and outgoing network traffic. Uncomplicated Firewall (UFW) provides a user-friendly interface for managing iptables. Ensuring the UFW service is enabled guarantees that the firewall is active upon system boot, providing a persistent first line of defense against unauthorized access, network-based attacks, and malware. A disabled firewall leaves the host completely exposed to network threats. Auditing and Remediation: The audit script verifies the status of the 'ufw' systemd service to determine if it is configured to start at boot. The remediation script uses 'systemctl enable --now ufw' to both enable the service for future boots and start it in the current session, immediately enforcing the firewall rules. Recommended State Rationale: For this control, the state is binary; the firewall is either active or it is not. Basic: The recommended state is ['enabled'] because a firewall provides no protection unless it is active. This is the minimum requirement for system security. Moderate: The state remains ['enabled']. There is no intermediate security level; the firewall must be running to be effective. Strict: The state remains ['enabled']. A strict security posture absolutely requires an active host-based firewall. The distinction between security levels would be reflected in the strictness of the firewall *rules*, not in the enabled status of the service itself.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the ufw service is enabled using 'systemctl is-enabled ufw'. The script should handle the case where the service is not installed. It must output only the current state (e.g., 'enabled', 'disabled', 'not found'), with no extra text.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be 'enabled'. The script will use 'systemctl enable --now ufw' to enable and start the service. It must return 'true' if the command succeeds and 'false' otherwise.

