# Ensure permissions on /etc/cron.d are configured

Necessity: The '/etc/cron.d' directory contains system-wide cron job definitions that are executed with the privileges of the user specified within the file, which is often root. If an unauthorized user can write to this directory, they could introduce a malicious script and schedule it to run with elevated privileges, leading to a complete system compromise. Incorrect read permissions could allow an attacker to gather information about system operations. Therefore, restricting permissions to only the root user is critical to prevent privilege escalation and information disclosure.

Auditing and Remediation: The audit script checks the current permissions of the '/etc/cron.d' directory in octal format. The remediation script uses the 'chmod' command to set the permissions to the correct, secure value provided as an argument.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is '700'. This permission set (rwx------) ensures that only the owner of the directory (which must be root) can read, write, and list its contents. This is the standard recommendation from security benchmarks like CIS because it effectively mitigates the risk of unauthorized job scheduling and privilege escalation. There is no practical or secure intermediate state; any permission more permissive than '700' introduces unnecessary risk to this critical system directory.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700']` |
| **Moderate** | `['700']` |
| **Strict** | `['700']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the permissions of the '/etc/cron.d' directory. The script must use the 'stat' command with the format specifier '%a' to retrieve the permissions in octal format (e.g., '700'). The output must be only the numeric value, with no additional text or formatting.

## Remediation Script Working

Bash script that sets the permissions for the '/etc/cron.d' directory. The script must accept a single positional command-line argument, which is the desired permission in octal format (e.g., '700'). The script should use the 'chmod' command to apply the new permissions. It must return 'true' on success and 'false' on failure.

