# Ensure rsync services are not in use

Necessity: The rsync service is used for remote file synchronization. If running as a daemon, it opens a network port (typically TCP 873) and can become an attack vector. Misconfigurations could lead to unauthorized data access, modification, or leakage. To follow the principle of least functionality, rsync should not be running as a service unless explicitly required for the server's role. Disabling or removing it reduces the system's attack surface.

Auditing and Remediation: The audit script verifies if the rsync service is installed and, if so, whether it is enabled to start on boot. The remediation script disables and completely removes the rsync package to ensure the service cannot be activated, either manually or automatically.

Recommended State Rationale:
- Basic: ['disabled'] ensures that the rsync service will not start automatically upon system boot, which is the minimum acceptable security baseline.
- Moderate: ['masked'] provides a stronger guarantee by linking the service unit to /dev/null, preventing it from being started manually or as a dependency for another service.
- Strict: ['Not Installed'] is the most secure state. It completely removes the rsync package from the system, eliminating the associated binaries and configuration files. This ensures the service cannot be run at all and removes any potential vulnerabilities associated with the software package itself.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['masked']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'rsync' service. The script should first check if the rsync package is installed. If not, it must return only the string 'Not Installed'. If it is installed, it should use 'systemctl is-enabled rsync' to determine the service status. The script must return only the resulting status string (e.g., 'disabled', 'enabled') without any additional text.

## Remediation Script Working

Bash script that accepts one positional command-line argument representing the desired state (e.g., 'Not Installed'). The script must perform the necessary actions to achieve this state. For 'Not Installed', it should stop the service using 'systemctl stop rsync', disable it with 'systemctl disable rsync', mask it with 'systemctl mask rsync', and then purge the package using 'apt-get purge -y rsync'. The script must return 'true' upon successful completion or 'false' if an error occurs.

