# Ensure X window server services are not in use

Necessity: The X Window System provides a graphical user interface (GUI) but significantly increases the attack surface of a server. It includes numerous packages, libraries, and running services that are unnecessary for a server's typical role. These components can contain vulnerabilities that could be exploited for privilege escalation or unauthorized access. Disabling or removing the X Window System adheres to the security principle of least functionality, reducing the system's complexity and potential exposure to threats. For most server environments, a GUI is not required and should be uninstalled.

Auditing and Remediation: The audit script checks for the presence of the 'xorg-x11-server-common' package, which is a core component of the X Window System. Its installation status serves as a reliable indicator of whether a GUI is available. The remediation script uninstalls this package, effectively removing the graphical environment, and also configures the system to boot into the non-graphical 'multi-user.target' by default, ensuring the GUI does not load even if some components remain.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Not Installed'. This is a binary control; a server environment either requires a GUI for a specific function (e.g., a terminal server) or it does not. From a security hardening perspective, there is no intermediate state. For any server not explicitly designated as a graphical workstation or kiosk, the most secure configuration is the complete removal of the GUI to minimize the attack surface. This aligns with best practices and major security benchmarks (e.g., CIS Benchmarks), which recommend against installing graphical environments on servers.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'xorg-x11-server-common' package is installed. If the package is present, the script must return the string 'Installed'. If it is not installed, the script must return 'Not Installed'. The output should exclusively be one of these two strings, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single command-line argument specifying the desired state. If the argument is 'Not Installed', the script must use the system's package manager (yum/dnf) to remove the 'xorg-x11-server-common' package and its dependencies. It must also set the default systemd target to 'multi-user.target'. The script must return 'true' upon successful completion and 'false' if any part of the remediation fails.

