# Ensure permissions on /etc/gshadow- are configured

The '/etc/gshadow-' file is a backup of '/etc/gshadow', which contains sensitive information about group passwords. Restricting its permissions is crucial to prevent unauthorized users from accessing this data, which could be used for offline password cracking or to gain insight into the system's group structure, potentially leading to privilege escalation. The audit script verifies the file's current permission settings using 'stat', while the remediation script uses 'chmod' to enforce a secure permission set. The Basic state of ['640'] ensures only the root user and group have read access. The Moderate and Strict states recommend ['0'], revoking all permissions, as this file is not required for normal system operations, thus providing the most secure configuration by rendering the backup file inaccessible without explicit action from a privileged user.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['640']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks the permissions of the '/etc/gshadow-' file. The script should use the 'stat -c "%a" /etc/gshadow-' command. If the file exists, it must output only the octal permission value (e.g., '640'). If the file does not exist, the script should output 'Not Found'.

## Remediation Script Working

shell script that accepts a single positional argument representing the desired octal permissions for the '/etc/gshadow-' file. The script should use the 'chmod' command to apply these permissions to the file. If the file exists and the command is successful, the script must return 'true'; otherwise, it must return 'false'.

