# Ensure wireless interfaces are disabled

Necessity: Disabling wireless interfaces is a critical security measure for any system that does not require wireless connectivity, particularly servers and secure workstations. An active but unused wireless interface significantly expands the system's attack surface, exposing it to remote exploits, unauthorized access, and man-in-the-middle attacks. By disabling it, you adhere to the principle of least functionality, removing a potential vector for compromise. Auditing and Remediation: The audit script queries the NetworkManager service via the `nmcli` utility to determine the current operational state of the Wi-Fi radio. The remediation script uses the same utility to set the state, effectively turning the wireless hardware on or off at the software level. Recommended State Rationale: The recommendation is uniformly 'disabled' across all security levels because the nature of this control is binary. Basic: Disabling wireless is a fundamental step for any system where it is not actively used. Moderate: This level reinforces the basic recommendation, as there is no secure intermediate state; the interface is either a potential risk (enabled) or not (disabled). Strict: In high-security environments, disabling wireless interfaces is a mandatory baseline. The configuration ensures the system cannot be accessed or exploited over Wi-Fi, which is an uncontrolled and often insecure medium compared to a wired network.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of wireless interfaces using the 'nmcli radio wifi' command. The script must parse the output to determine if Wi-Fi is enabled or disabled and print only the string 'enabled' or 'disabled' to standard output, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be either 'enabled' or 'disabled'. The script will use this argument to set the state of wireless interfaces via the 'nmcli radio wifi on' or 'nmcli radio wifi off' command. The script must return the string 'true' on success or 'false' on failure.

