mediumnetworkverified ✓

Ensure the Uncomplicated Firewall (ufw) is active

ufw-enabled · UBUNTU ≥ 22 · 1 impl

Description

The Uncomplicated Firewall (ufw) must report 'Status: active' so that the host application firewall is enforcing its ruleset.

Rationale

An installed but inactive host firewall provides no protection. ufw must be active for its default-deny and per-service rules to take effect and control inbound and outbound connections.

Check → Remediate

Checkcommand

# 'ufw status' requires root; run under --sudo. If ufw is absent the
# command is unavailable and the firewall is not active -> finding
# (an assessor may clear this manually if a different firewall is active).
if ufw status 2>/dev/null | grep -qE '^Status:[[:space:]]+active'; then
  echo "OK: ufw is active"; exit 0
fi
echo "FAIL: ufw is not active"; exit 1

expected_exit:: 0

Remediatemanual

note:: Enable the firewall with 'ufw enable'. Note: enabling ufw can disrupt active SSH sessions; ensure an allow rule for SSH exists first.

Framework references

STIG

V-270655 / UBTU-24-100310V-260515 / UBTU-22-251015

NIST 800-53

AC-17(1)CA-3(5)

Live verification

ubuntu22:checkubuntu24:check

#ufw#firewall#network#stig