# Ensure permissions on /etc/cron.monthly are configured

Necessity: The `/etc/cron.monthly` directory contains scripts that are executed automatically with root privileges on a monthly basis. If an unauthorized user can write to this directory, they could add a malicious script. This script would then be executed as root, leading to a full system compromise through privilege escalation. Restricting access is critical to maintaining system integrity.

Auditing and Remediation: The audit script checks the directory's permissions, owner, and group. It uses the `stat` command to retrieve the octal permission mode (e.g., 700), the user owner (e.g., root), and the group owner (e.g., root). The remediation script applies the correct configuration using the `chmod`, `chown`, and `chgrp` commands to enforce the specified state, ensuring that only the root user has access.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly '700:root:root'. This configuration is a standard security best practice (as recommended by CIS benchmarks) because it provides the necessary level of protection for a critical system directory. The '700' permission mode grants read, write, and execute permissions exclusively to the owner, while the 'root:root' ownership ensures that the owner is the superuser. Any less restrictive configuration would allow non-privileged users to view or modify scripts that will be executed with the highest privileges, creating an unacceptable security risk. Therefore, there is no valid use case for a more permissive state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700:root:root']` |
| **Moderate** | `['700:root:root']` |
| **Strict** | `['700:root:root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that retrieves the file permissions, owner, and group for the '/etc/cron.monthly' directory. The script must output a single string in the format 'permissions:owner:group' (e.g., '700:root:root'), with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single string argument in the format 'permissions:owner:group' (e.g., './remediate.sh "700:root:root"'). The script must use this argument to set the permissions (chmod), owner (chown), and group (chgrp) for the '/etc/cron.monthly' directory. The script must return `true` on success and `false` on failure.

