# Ensure avahi daemon services are not in use

The Avahi daemon provides zero-configuration networking (zeroconf), allowing devices to publish and discover services on a local network without manual configuration. While useful in some desktop or small office environments, it is generally unnecessary on servers and increases the system's attack surface by broadcasting network information. Disabling or removing it is a common security hardening practice to minimize the information available to potential attackers on the local network.

The audit script checks the status of the 'avahi-daemon' service using 'systemctl', determining if it is enabled to run at boot or if the package is installed at all. The remediation script provides two actions based on the provided argument: it can either disable the service to prevent it from running, or it can purge the package entirely from the system for a more permanent solution.

The recommended states are progressive. 'Basic' ('disabled') ensures the service does not run on startup, which is a sufficient minimum baseline. 'Moderate' and 'Strict' recommend 'not installed', which is the most secure configuration. Uninstalling the package completely removes the service's binaries and configuration, eliminating the associated attack surface and preventing it from being accidentally started by an administrator or as a dependency of another service.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['not installed']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'avahi-daemon' service. The script should first use 'systemctl is-enabled avahi-daemon'. If this command fails (indicating the service is not installed), the script should output 'not installed'. Otherwise, it should output the result of the command (e.g., 'enabled', 'disabled'). The script must only return the current state without any extra text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired state ('disabled' or 'not installed'). If the argument is 'disabled', the script must use the commands 'systemctl stop avahi-daemon' and 'systemctl disable avahi-daemon'. If the argument is 'not installed', it must use 'apt-get purge -y avahi-daemon'. The script must return 'true' on successful completion and 'false' on failure.

