# Ensure ufw firewall rules exist for all open ports

Necessity: A host-based firewall is a critical security control that filters network traffic to and from a system. Ensuring that a firewall is active and that all open ports are explicitly managed by its rules prevents unauthorized access to services. A misconfiguration, such as having a listening service without a corresponding firewall rule (an implicit 'allow'), exposes the system to potential attacks, port scanning, and exploitation.

Auditing and Remediation: The audit script inventories all listening TCP and UDP ports and cross-references them against the active UFW rule set. It flags any discrepancies, ensuring that no service is inadvertently exposed to the network. The remediation script establishes a secure baseline by activating UFW and enforcing a 'default deny' policy for all incoming connections, which is a foundational security principle. This forces administrators to explicitly permit traffic only to required services, adhering to the principle of least privilege.

Recommended State Rationale:
- Basic: ['enabled'] - The fundamental requirement is that the host-based firewall is active. This provides an essential layer of protection against network-based threats.
- Moderate: ['enabled'] - This state implies that the firewall is not only enabled but is also configured with a standard 'default deny' inbound policy. All traffic is blocked unless an explicit 'allow' rule exists for a specific service.
- Strict: ['enabled'] - At the strictest level, the firewall is enabled with a 'default deny' policy for both incoming and outgoing traffic (egress filtering). This provides maximum control, preventing a compromised system from communicating with external malicious servers, exfiltrating data, or participating in attacks on other systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the UFW (Uncomplicated Firewall) service is active and if a corresponding firewall rule exists for every TCP and UDP port in a listening state. The script should output 'true' if all listening ports are explicitly covered by a UFW rule, and 'false' otherwise. The output must only be the boolean value, with no extra text or labels.

## Remediation Script Working

bash script that accepts one positional argument: 'enabled'. If the argument is 'enabled', the script must ensure UFW is installed, set the default incoming policy to 'deny', set the default outgoing policy to 'allow', and enable the firewall service. The script must return 'true' on successful configuration and 'false' on failure.

