# Ensure ufw default deny firewall policy

Necessity: A default deny firewall policy is a fundamental security principle. It ensures that any network traffic not explicitly permitted by a rule is blocked. This significantly reduces the system's attack surface by preventing unsolicited incoming connections. A default deny policy for outgoing traffic is also critical as it can prevent malware from communicating with command-and-control servers or exfiltrating data, effectively containing a potential breach. Misconfiguring this allows unrestricted network access, leaving the system vulnerable. Auditing and Remediation: The audit script inspects the UFW (Uncomplicated Firewall) status to determine the default policies for both incoming and outgoing traffic. The remediation script modifies these default policies using the 'ufw default' command, enforcing the desired state. Recommended State Rationale: Basic: 'deny (incoming), allow (outgoing)' is a common and effective baseline. It protects the system from external threats while allowing internal applications to connect to the internet without requiring specific outbound rules, which simplifies administration. Moderate: 'deny (incoming), deny (outgoing)' establishes a Zero Trust network posture. This is a significant security enhancement, as it forces the administrator to explicitly define all legitimate network traffic, both inbound and outbound. Strict: The strict recommendation is identical to the moderate one because a default-deny policy for all traffic is the most secure configuration possible for this setting. It provides maximum control and visibility over network communications, which is essential in high-security environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['deny (incoming), allow (outgoing)']` |
| **Moderate** | `['deny (incoming), deny (outgoing)']` |
| **Strict** | `['deny (incoming), deny (outgoing)']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that executes 'ufw status verbose | grep Default' and processes the output to return a single comma-separated string in the format 'deny (incoming), allow (outgoing)'. The script must only output this string value and nothing else.

## Remediation Script Working

Bash script that accepts two positional string arguments: the policy for incoming traffic (e.g., 'deny') and the policy for outgoing traffic (e.g., 'deny'). The script will use these arguments to execute 'ufw default [arg1] incoming' and 'ufw default [arg2] outgoing'. It must return 'true' on successful application of both policies, and 'false' otherwise.

