# Ensure permissions on /etc/passwd are configured

Necessity: The `/etc/passwd` file contains critical user account information, including usernames, user IDs (UIDs), group IDs (GIDs), home directories, and default shells. While modern systems store hashed passwords in `/etc/shadow`, the `/etc/passwd` file remains a valuable target for attackers seeking to enumerate system users for reconnaissance. Improper write permissions could allow an unauthorized user to add, modify, or delete user accounts, potentially leading to a complete system compromise. Ensuring correct, restrictive permissions is fundamental to system integrity and security. Auditing and Remediation: The audit script precisely reads and returns the octal permission mode of the `/etc/passwd` file, providing a clear status of its current configuration. The remediation script utilizes the `chmod` command to enforce a specified permission set, directly correcting any misconfigurations and aligning the file with the desired security policy. Recommended State Rationale: Basic `['644']` represents the standard default, allowing the file owner (root) read/write access, while the group and all other users have read-only access. This is necessary for many system utilities to resolve UIDs to usernames. Moderate `['640']` increases security by removing read permissions for 'others', restricting access to only the root user and members of the root group. This adheres to the principle of least privilege and is a common CIS Benchmark recommendation, as it prevents unprivileged processes from enumerating users. Strict `['640']` is the same as Moderate because any further restriction (e.g., removing group read) could break system services or administrative tools that rely on this access, making `640` the most secure yet functional configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['640']` |
| **Strict** | `['640']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `stat` command with the format option `-c "%a"` to retrieve the octal permissions of the `/etc/passwd` file. The script must output only the numerical permission value (e.g., '644') and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired octal permission mode (e.g., '644'). The script must use the `chmod` command to apply these permissions to the `/etc/passwd` file. It must then verify the change and output 'true' on success or 'false' on failure.

