# Ensure bluetooth services are not in use

Necessity: Bluetooth is a short-range wireless communication protocol that, if enabled on a system that does not require it (such as a server), unnecessarily increases the attack surface. It can be exploited by various attacks (e.g., BlueBorne, BlueSnarfing) to gain unauthorized access, exfiltrate data, or introduce malware. Disabling Bluetooth services mitigates these risks by adhering to the principle of least functionality.

Auditing and Remediation: The audit script verifies the startup status of the 'bluetooth.service' using systemd's control interface. The remediation script actively changes the system's configuration by first stopping the running service and then either preventing it from starting at boot ('disable') or preventing it from being started by any means ('mask').

Recommended State Rationale:
- Basic: ['disabled'] - This is the minimum recommended state. Disabling the service prevents it from automatically launching at system startup, which is sufficient to protect a system that is rebooted infrequently. It can, however, still be started manually or by a dependent service.
- Moderate: ['masked'] - This provides a more robust security posture. Masking the service links it to '/dev/null', which prevents it from being started manually, by other services, or via D-Bus activation. This ensures the service cannot be activated accidentally.
- Strict: ['masked'] - This is the most secure configuration achievable through service management. It offers the highest assurance that the Bluetooth stack will not be activated, effectively removing it as a potential attack vector without uninstalling the underlying packages.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `["disabled"]` |
| **Moderate** | `["masked"]` |
| **Strict** | `["masked"]` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the status of the 'bluetooth' service. The script must use `systemctl is-enabled bluetooth` and output only the resulting status string (e.g., 'disabled', 'enabled', 'masked'), with no additional text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument representing the desired state ('disable' or 'mask'). The script must first stop the 'bluetooth' service with `systemctl stop bluetooth`, then apply the state using either `systemctl disable bluetooth` or `systemctl mask bluetooth`. It must return 'true' on success and 'false' on failure.

