# Ensure permissions on /etc/cron.hourly are configured

The cron system is a time-based job scheduler in Unix-like operating systems. Directories such as /etc/cron.hourly contain scripts that are executed at regular intervals with root privileges. It is critical to secure these directories to prevent unauthorized modification, which could lead to privilege escalation or the execution of malicious code. An attacker with the ability to write to this directory could place a script that grants them root access or otherwise compromises the system. The audit script verifies the current permissions and ownership of the /etc/cron.hourly directory using the 'stat' command. The remediation script uses 'chmod' and 'chown' to enforce the specified secure state. All recommended states (Basic, Moderate, and Strict) are set to '700 root root'. This configuration adheres to the principle of least privilege: the '700' permission ensures that only the owner (root) can read, write, and execute the contents of the directory, while the 'root:root' ownership assigns this control exclusively to the superuser. There is no variance between the levels because this is a foundational security setting with a single, universally accepted correct state as defined by security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700 root root']` |
| **Moderate** | `['700 root root']` |
| **Strict** | `['700 root root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the 'stat' command to retrieve the permissions, user ownership, and group ownership for the '/etc/cron.hourly' directory. The script must output these values as a single space-separated string in the format 'permissions owner group' (e.g., '700 root root'), and nothing else.

## Remediation Script Working

Bash script that accepts three positional command-line arguments: permissions (in octal format), owner, and group. The script must use 'chmod' to set the permissions and 'chown' to set the owner and group for the '/etc/cron.hourly' directory. The script must output 'true' on successful completion and 'false' if any command fails.

