# Ensure Automatic Error Reporting is not enabled

Necessity: The Automatic Bug Reporting Tool (ABRT), or 'abrtd' service, automatically collects data about application crashes. This data can include sensitive information such as memory dumps, system state, running processes, and configuration files, which may contain credentials, private keys, or proprietary data. If configured to send reports automatically, this service could exfiltrate sensitive information from the system, posing a significant security risk. Disabling it is crucial to prevent unintentional data leakage.

Auditing and Remediation: The audit script verifies whether the 'abrtd' systemd service is enabled to start on boot. The remediation script ensures the service is both stopped in the current session and disabled from starting automatically in the future, effectively deactivating the automatic error reporting feature.

Recommended State Rationale: 
- Basic: ['disabled'] - Disabling the service is the fundamental baseline for preventing the automatic collection and potential transmission of sensitive crash data.
- Moderate: ['disabled'] - There is no middle ground for this setting. For any environment requiring moderate security, the risk of data exfiltration from an automated reporting tool is unacceptable.
- Strict: ['disabled'] - In a strictly hardened environment, all non-essential services that could potentially leak system information must be disabled. ABRT falls directly into this category, making its deactivation mandatory to maintain the highest level of security and data confidentiality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'abrtd' service is enabled. The script must query the state using 'systemctl is-enabled abrtd' and output only the string 'enabled' if the service is enabled, or 'disabled' if it is not, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts one positional argument, which will be the desired state ('disabled'). If the argument is 'disabled', the script must use 'systemctl stop abrtd' and 'systemctl disable abrtd' to stop and disable the service. The script must return the string 'true' on success and 'false' on failure.

