# Ensure ufw is not in use with iptables

Necessity: Running multiple host-based firewall management tools, such as 'ufw' and the default 'firewalld' on CentOS, creates a significant security risk. It can lead to conflicting rules, unpredictable network behavior, and potential security holes where one firewall's permissive rule inadvertently overrides another's restrictive one. This misconfiguration complicates firewall management and auditing, making it difficult to ascertain the true security posture of the system. The principle of using a single, authoritative tool for managing the firewall is a critical security best practice.

Auditing and Remediation: The audit script verifies the status of 'ufw' to ensure it is not active or installed, preventing conflicts with the system's default firewall manager. The remediation script enforces the desired state by either disabling the 'ufw' service or removing the package entirely, thereby eliminating the source of potential rule conflicts.

Recommended State Rationale:
- Basic: ['Disabled'] - This state ensures that 'ufw' is not actively managing the firewall, which is the minimum action required to prevent immediate rule conflicts. However, the package remains on the system and could be re-enabled accidentally.
- Moderate: ['Not Installed'] - This is a more secure state that involves completely removing the 'ufw' package. This prevents accidental activation and reduces the system's attack surface by removing unnecessary software.
- Strict: ['Not Installed'] - This is the most secure and recommended state. It aligns with the moderate level because completely removing the conflicting software is the definitive method to enforce a single-firewall-management policy, ensuring simplicity, predictability, and robust security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the Uncomplicated Firewall (ufw). The script must first determine if the 'ufw' package is installed. If it is not installed, the script must return the string 'Not Installed'. If the package is installed, the script must then check if the ufw service is active or enabled using 'systemctl'. If it is either active or enabled, the script must return 'Enabled'; otherwise, it must return 'Disabled'. The script must only output one of these three exact strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument to set the state of the Uncomplicated Firewall (ufw). If the argument is 'Disabled', the script must stop and disable the ufw service using 'systemctl stop ufw' and 'systemctl disable ufw'. If the argument is 'Not Installed', the script must use the system's package manager ('yum' or 'dnf') to remove the 'ufw' package completely. The script must return the boolean value 'true' on success and 'false' on failure.

