# Ensure X window server services are not in use

Necessity: The X Window System provides a graphical user interface (GUI), which is typically unnecessary for a server. Installing a GUI on a server dramatically increases its attack surface by adding a large number of network-listening services, libraries, and applications that are not required for its core function. This violates the principle of least functionality. A vulnerability in any of the numerous X11 components could be exploited for local privilege escalation or remote access.

Auditing and Remediation: The audit script verifies whether the 'xserver-xorg' package, the core of the X Window System, is installed on the system. The remediation script uninstalls and purges the 'xserver-xorg' package and its associated dependencies, effectively removing the GUI from the server.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Not Installed'. There is no secure justification for running a graphical interface on a production server. Any installation of X Window services introduces an unacceptable level of risk by adding complexity and potential vulnerabilities. The only secure configuration is its complete removal, which is why the recommended state does not vary across different hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'xserver-xorg' package is installed. The script must output only the string 'Installed' if the package is present, or 'Not Installed' if it is not present, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument for the desired state. If the argument is 'Not Installed', the script must use 'apt-get purge --auto-remove xserver-xorg*' to completely remove the X Window System packages. The script must return 'true' on successful removal or if the package is already absent, and 'false' if the operation fails or the input argument is invalid.

