# Ensure access to the su command is restricted

Necessity: The 'su' command allows a user to switch to another user account, including root, by providing the target account's password. Unrestricted access presents a significant security risk, as any compromised user account could be used to attempt brute-force attacks against the root password. Restricting 'su' to a specific administrative group (e.g., 'sudo') enforces the principle of least privilege, reduces the attack surface for privilege escalation, and encourages the use of 'sudo' which provides superior logging and granular control over commands. 

Auditing and Remediation: The audit script inspects the file permissions and group ownership of the '/bin/su' binary to determine if its use is limited. The remediation script directly modifies these file attributes. By setting the group to 'sudo' and permissions to '4750' ('rwsr-x---'), it ensures that only root and members of the 'sudo' group can execute the command. 

Recommended State Rationale: 
Basic, Moderate, and Strict: All levels recommend the 'restricted' state. This is a foundational security control with a binary outcome—it is either properly restricted or it is not. There is no meaningful intermediate state. Restricting 'su' access is a best practice (mandated by CIS Benchmarks) that should be applied to any production system, regardless of the desired hardening level, to limit vectors for privilege escalation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['restricted']` |
| **Moderate** | `['restricted']` |
| **Strict** | `['restricted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the configuration of the '/bin/su' executable. The script must output the file's permissions in octal format and its group owner, separated by a space (e.g., '4750 sudo' or '4755 root'). The script must only return this string value with no extra text or labels.

## Remediation Script Working

Bash script that modifies access to the 'su' command. The script must accept a single positional command-line argument: 'restricted' or 'unrestricted'. For 'restricted', it must change the group owner of '/bin/su' to 'sudo' and set its permissions to '4750'. For 'unrestricted', it must revert the group to 'root' and permissions to '4755'. The script must return 'true' on success and 'false' on failure.

