# Ensure dnsmasq services are not in use

Necessity: The 'dnsmasq' service provides network infrastructure functionalities like DNS, DHCP, and TFTP. If the system is not intended to be a network infrastructure server, this service is unnecessary and increases the system's attack surface. An improperly configured dnsmasq can be exploited for DNS amplification attacks, cache poisoning, or unauthorized network configuration distribution. Disabling or removing it aligns with the principle of least functionality, reducing potential security vulnerabilities.

Auditing and Remediation: The audit script verifies the system's compliance by first checking if the 'dnsmasq' package is installed. If it is, the script then checks if the service is enabled to run on boot. The remediation script ensures the service is not active by executing the necessary 'systemctl' commands to both stop the currently running process and disable it from starting automatically in the future.

Recommended State Rationale:
- Basic: Recommends ['disabled']. This is the minimum acceptable state, ensuring that the service does not run automatically, thereby preventing it from being 'in use' under normal circumstances.
- Moderate: Recommends ['disabled', 'Not Installed']. This state is more secure as it accepts both a correctly configured system (service disabled) and an ideally configured system (package not present), providing a broader definition of compliance.
- Strict: Recommends ['Not Installed']. This is the most secure configuration. By completely removing the 'dnsmasq' package, it eliminates any risk of the service being manually started or its binaries being exploited, thus maximally reducing the system's attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled', 'Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'dnsmasq' service. The script should first check if the 'dnsmasq' package is installed using 'rpm -q dnsmasq'. If it is not installed, the script must return the string 'Not Installed'. If it is installed, the script must use 'systemctl is-enabled dnsmasq' to determine if the service is enabled and return only the resulting status string (e.g., 'enabled' or 'disabled'). The output must not contain any extra text or formatting.

## Remediation Script Working

Bash script that accepts one positional command-line argument representing the desired state, which should be 'disabled'. The script must stop the 'dnsmasq' service using 'systemctl stop dnsmasq' and disable it using 'systemctl disable dnsmasq'. The script must return the string 'true' upon successful execution or 'false' if any command fails.

