# Ensure permissions on /etc/gshadow are configured

Necessity: The `/etc/gshadow` file contains the encrypted passwords and password aging information for local user accounts. Unauthorized access to this file presents a severe security risk, as an attacker could use the password hashes for offline cracking attempts, potentially leading to privilege escalation and full system compromise. Incorrect permissions could allow unprivileged users to read or modify this critical data.

Auditing and Remediation: The audit script uses the `stat` command to check the file's octal permissions and its user/group ownership, returning a single formatted string. The remediation script uses `chown` to enforce `root:shadow` ownership and `chmod` to apply the specified secure permission mode, ensuring the file is properly locked down.

Recommended State Rationale: For this critical system file, there is only one acceptable secure state. Any deviation is a high-severity finding. 
- Basic: `['0:root:shadow']` represents the minimum and only acceptable configuration as defined by security benchmarks like CIS. The owner must be `root`, the group must be `shadow`, and the permissions must be `0000` (no permissions for owner, group, or others). This ensures that only the operating system, through specific privileged processes, can access the password hashes. 
- Moderate & Strict: As there is no valid 'less secure' configuration for this file, the Moderate and Strict states are identical to the Basic state. The `0:root:shadow` configuration is the absolute requirement for maintaining system integrity and confidentiality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0:root:shadow']` |
| **Moderate** | `['0:root:shadow']` |
| **Strict** | `['0:root:shadow']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that executes `stat -c "%a:%U:%G" /etc/gshadow` to retrieve the access permissions, owner, and group for the file. The script should only output the resulting string (e.g., '0:root:shadow') and nothing else.

## Remediation Script Working

bash script that takes a single positional argument representing the desired octal permission mode (e.g., '0000'). The script must first set the ownership of `/etc/gshadow` to 'root:shadow' using `chown root:shadow /etc/gshadow`, and then apply the provided permission mode using `chmod`. The script must return 'true' on success and 'false' on failure.

