# Ensure dns server services are not in use

Necessity: Running a DNS server on a system that is not explicitly intended for that purpose introduces a significant and unnecessary security risk. Unconfigured or improperly secured DNS servers can be exploited for DNS amplification/reflection attacks (a type of DDoS attack), DNS cache poisoning, and reconnaissance activities by attackers. Adhering to the principle of least functionality, any service not essential to the system's role should be disabled or removed to minimize its attack surface. Auditing and Remediation: The audit script verifies whether common DNS server packages, such as 'bind9' or 'dnsmasq', are installed on the system. The remediation script removes these packages using the package manager, thereby eliminating the DNS server functionality and its associated risks. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Not Installed'. There is no secure justification for running an unnecessary network service. Unless the machine's designated role is to serve as a DNS server for a network, the service should be removed entirely. This single, strict recommendation ensures the attack surface is minimized and prevents potential misconfigurations that could expose the system and the network to attack.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if either the 'bind9' or 'dnsmasq' package is installed. The script should output 'Installed' if either package is present and 'Not Installed' if neither is. The output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state ('Not Installed'). If the argument is 'Not Installed', the script must use 'apt-get purge' to completely remove both the 'bind9' and 'dnsmasq' packages. The script must return 'true' upon successful removal or if the packages are already not installed, and 'false' on any failure.

