# Ensure ufw firewall rules exist for all open ports

Necessity: A host-based firewall provides a critical layer of defense by controlling network traffic at the operating system level. Unmanaged or undocumented open ports are significant security vulnerabilities, as they expose services that may be unnecessary, unpatched, or misconfigured. Attackers systematically scan for open ports to identify attack vectors. Ensuring that every open port is explicitly defined in a firewall ruleset enforces the principle of least privilege for network services, drastically reducing the system's attack surface.

Auditing and Remediation: The audit script inventories all active listening ports on the system and cross-references them against the active 'allow' rules in the UFW configuration. It reports whether the system is 'Compliant' (all ports managed), 'Non-Compliant' (unmanaged ports exist), or 'Not-Applicable' if UFW is not the active firewall. The remediation script establishes a secure default posture by enabling UFW, setting the default incoming policy to 'deny', and allowing outgoing traffic. This 'default-deny' stance is a security best practice that requires administrators to explicitly permit only necessary services, preventing accidental exposure.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Compliant'. In this context, compliance is a binary state; the system either has all its open ports managed by the firewall or it does not. A 'Non-Compliant' state represents an unacceptable security risk at any hardening level. The stringency of the security posture is determined by the firewall's default policy (e.g., 'default-deny') and the specificity of its rules, which the remediation script is designed to establish as a baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Compliant']` |
| **Moderate** | `['Compliant']` |
| **Strict** | `['Compliant']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for all listening TCP and UDP ports and verifies that each one has a corresponding 'ALLOW' rule in the Uncomplicated Firewall (ufw). The script must first check if ufw is installed and active. If ufw is not installed or is inactive, the script should return 'Not-Applicable'. If all listening ports are covered by a ufw rule, the script should return 'Compliant'. If any listening port is not covered by a ufw rule, the script should return 'Non-Compliant'. The output must only be one of these three strings.

## Remediation Script Working

Bash script that configures the Uncomplicated Firewall (ufw) with a secure baseline policy. The script must accept a single positional command-line argument: 'enforce'. When executed with this argument, the script will enable ufw, set the default incoming policy to 'deny', the default outgoing policy to 'allow', and reload the firewall. The script must return 'true' on successful application of the policy and 'false' on failure.

