Description
The ufw service can be enabled with the following command:
$ sudo systemctl enable ufw.service
Rationale
The ufw service must be enabled and running in order for ufw to protect the system
Shell script
The following script can be run on the host to remediate the issue.
#!/bin/bash
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ( [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && dpkg-query --show --showformat='${db:Status-Status}\n' 'ufw' 2>/dev/null | grep -q installed ); }; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'ufw.service'
"$SYSTEMCTL_EXEC" start 'ufw.service'
"$SYSTEMCTL_EXEC" enable 'ufw.service'
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package_facts:
manager: auto
tags:
- DISA-STIG-UBTU-20-010434
- enable_strategy
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- service_ufw_enabled
- name: Enable service ufw
block:
- name: Gather the package facts
package_facts:
manager: auto
- name: Enable service ufw
systemd:
name: ufw
enabled: 'yes'
state: started
masked: 'no'
when:
- '"ufw" in ansible_facts.packages'
when:
- ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
- ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
and "ufw" in ansible_facts.packages )
tags:
- DISA-STIG-UBTU-20-010434
- enable_strategy
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- service_ufw_enabled
