# Ensure permissions on /etc/cron.hourly are configured

Necessity: The '/etc/cron.hourly' directory contains scripts that are executed hourly by the cron daemon with root privileges. If unauthorized users can write to this directory, they could introduce malicious scripts that would then be executed as root, leading to a complete system compromise through privilege escalation. Restricting permissions is critical to prevent this attack vector.

Auditing and Remediation: The audit script verifies the current permissions of the '/etc/cron.hourly' directory by checking its octal mode. The remediation script uses the 'chmod' command to set the permissions to a secure state, ensuring that only the root user has the ability to read, write, and execute files within it.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '700'. This permission setting (rwx------) ensures that only the directory's owner, which must be root, can read its contents, place new scripts within it, and execute them. There is no more secure or functional permission set for this critical system directory. Any less restrictive permission (e.g., '755') would allow other users to view or execute scheduled tasks, creating a significant security risk. Any more restrictive permission (e.g., removing write or execute for the owner) would break the intended functionality of the cron service. Therefore, '700' is the definitive standard based on CIS benchmarks and security best practices.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700']` |
| **Moderate** | `['700']` |
| **Strict** | `['700']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that uses the 'stat -c "%a" /etc/cron.hourly' command to retrieve the octal permissions of the '/etc/cron.hourly' directory. The script must output only the numerical permission value (e.g., '700') with no additional text or formatting.

## Remediation Script Working

shell script that accepts a single positional command-line argument representing the desired octal permissions (e.g., '700'). The script must use the 'chmod' command to apply these permissions to the '/etc/cron.hourly' directory. The script must return 'true' if the operation is successful and 'false' if it fails.

