# Ensure web server services are not in use

Necessity: An installed web server increases the system's attack surface. Web server software (e.g., Apache, Nginx) is a common target for attackers, and vulnerabilities can be exploited to gain unauthorized access, execute arbitrary code, or launch denial-of-service attacks. If the system is not intended to function as a web server, these services provide no benefit and introduce unnecessary risk. Adhering to the principle of least functionality by removing unneeded services is a fundamental security best practice.

Auditing and Remediation: The audit script checks for the installation status of common web server packages such as 'apache2', 'nginx', and 'lighttpd'. The remediation script, when instructed, purges these packages, completely removing the software and its configuration files from the system to eliminate the associated risk.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Not Installed'. This is a binary control; the service is either required for the system's function or it is not. If it is not required, it should be removed. There is no less secure 'acceptable' state, as even a disabled service can be misconfigured or maliciously enabled. Therefore, complete removal is the only recommended state to ensure the attack surface is minimized.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the 'apache2', 'nginx', or 'lighttpd' packages are installed. If any of these packages are found on the system, the script must return the string 'Installed'. If none of these packages are installed, it must return 'Not Installed'. The output should be strictly one of these two strings, with no additional text or formatting.

## Remediation Script Working

shell script that accepts one positional argument. If the argument is the string 'Not Installed', the script must attempt to purge the 'apache2', 'nginx', and 'lighttpd' packages and their dependencies from the system. The script must return 'true' if the operation is successful or if the packages are already not present. It must return 'false' if the uninstallation fails.

