# Ensure local interactive user dot files access is configured

Necessity: User-specific configuration files, commonly known as 'dot files' (e.g., .bashrc, .profile, .ssh/), control the user's shell environment and can contain sensitive information or commands that are executed at login. If these files are world-writable or group-writable, other malicious local users could modify them to execute arbitrary code, escalate privileges, or hijack the user's session the next time they log in. Properly restricting access is critical to prevent local privilege escalation and maintain user account integrity.

Auditing and Remediation: The audit script systematically checks the permissions of all dot files for every interactive user on the system to identify any that are configured with overly permissive settings. The remediation script corrects this vulnerability by using the 'chmod' command to apply a secure permission mode to these files, ensuring they cannot be modified by unauthorized users.

Recommended State Rationale:
- Basic ['750']: This state provides a strong security baseline. Permissions of 'rwxr-x---' mean the owner has full control, the owner's group can read and execute files (but not write), and all other users have no access. This prevents unauthorized modification by users outside the primary group, which is a common CIS benchmark recommendation.
- Moderate ['700']: This state enhances security by removing all permissions for the group. Permissions of 'rwx------' ensure that only the file's owner can read, write, or execute it. This adheres more strictly to the principle of least privilege and is appropriate for environments where users do not need to share configuration details, even within their own group.
- Strict ['700']: This is the most secure and recommended configuration. It completely isolates the user's dot files, providing the strongest protection against local information disclosure and unauthorized modification by any other account on the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['750']` |
| **Moderate** | `['700']` |
| **Strict** | `['700']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that identifies all local interactive users (UID >= 1000 with a valid login shell). For each user, the script must find all 'dot' files and directories (e.g., .bashrc, .ssh) directly within their home directory. The script must then output the single most permissive octal permission mode found across all these files for all interactive users. If no such users or files are found, the script should return 'Not Applicable'.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired octal permission mode (e.g., '750'). The script must find all local interactive users (UID >= 1000 with a valid login shell) and apply the specified permission mode to all 'dot' files and directories located directly within each user's home directory. The script must return `true` if the permissions are successfully applied to all relevant items, and `false` otherwise.

