# Ensure ufw service is enabled

Necessity: The host-based firewall is a critical first line of defense against network-based threats. Uncomplicated Firewall (UFW) provides a user-friendly interface for managing iptables, controlling all incoming and outgoing network traffic. Ensuring the UFW service is enabled prevents unauthorized access to services running on the host, blocks malicious traffic, and mitigates threats like port scanning and intrusion attempts. A disabled firewall leaves the system fully exposed to the network, significantly increasing its attack surface. 

Auditing and Remediation: The audit script verifies the UFW service's status within systemd, confirming whether it is set to start automatically upon system boot. The remediation script uses the `systemctl` command to modify this state, either enabling the service to ensure it is active and persistent, or disabling it. The `--now` flag ensures the service is also immediately started or stopped. 

Recommended State Rationale: 
- Basic: `['enabled']`. This is the fundamental requirement for network security on any host. Any state other than 'enabled' is a major security gap. 
- Moderate: `['enabled']`. There is no middle ground for the firewall service's enabled state. A moderate security posture absolutely requires the host firewall to be active. 
- Strict: `['enabled']`. In a strict security environment, having the host firewall enabled is a non-negotiable baseline. Further hardening is achieved through the configuration of specific firewall rules, but the service itself must always be active.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that executes `systemctl is-enabled ufw` to check if the Uncomplicated Firewall service is configured to start on boot. The script must only output the string result (e.g., 'enabled' or 'disabled') with no additional text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must execute `systemctl enable --now ufw`. If 'disabled', it must execute `systemctl disable --now ufw`. The script must return the string 'true' on success and 'false' on failure.

