# Ensure ufw outbound connections are configured (Manual)

Necessity: Configuring a default-deny policy for outbound connections is a critical security measure. By default, many systems allow all outbound traffic, which means if a system is compromised, malicious software can easily exfiltrate data, communicate with command-and-control (C2) servers, or participate in attacks on other systems. Enforcing a default-deny egress policy adheres to the principle of least privilege, ensuring that only explicitly approved connections can leave the network, thereby containing potential breaches and limiting the attack surface. Auditing and Remediation: The audit script checks the current default policy for outgoing connections as configured in UFW, returning either 'allow' or 'deny'. The remediation script sets this default policy, fundamentally changing how the firewall treats all outbound traffic that does not match a specific rule. Recommended State Rationale: The Basic state of ['allow'] represents the default, most permissive configuration, ensuring application functionality without network restrictions but offering minimal security. The Moderate and Strict states are both set to ['deny'], which represents the security best practice. This configuration immediately enhances security by blocking all unapproved outbound traffic. It is considered both moderate and a strict baseline because it forces a proactive security posture where the administrator must justify and explicitly permit every type of outbound connection, effectively containing threats from the outset. Further hardening beyond this default policy involves creating a granular set of 'allow' rules for essential services.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['allow']` |
| **Moderate** | `['deny']` |
| **Strict** | `['deny']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that executes `sudo ufw status verbose | grep "Default:" | sed -n 's/.*, \(allow\|deny\) (outgoing).*/\1/p'` to retrieve the current default outbound connection policy. The script must output only the value (`allow` or `deny`) without any extra text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument ('allow' or 'deny') for the desired default outbound policy. The script will execute `sudo ufw default $1 outgoing` to apply the setting. The script must output `true` on successful execution and `false` on failure.

