# Ensure permissions on /etc/crontab are configured

Necessity: The `/etc/crontab` file is a system-wide configuration file that specifies scheduled commands to be executed by the cron daemon, often with root privileges. If an unauthorized user gains write access to this file, they could insert malicious commands that would execute with the privileges of the cron daemon. This could lead to privilege escalation, unauthorized data access, or a complete system compromise. Restricting access is critical to prevent such attacks.

Auditing and Remediation: The audit script checks the current ownership and permissions of the `/etc/crontab` file. The remediation script uses the `chown` command to set the owner and group to `root` and the `chmod` command to set the permissions, ensuring only the root user can read and modify the file.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is '600 root root'. This is the standard secure configuration according to security benchmarks like CIS. The owner and group must be `root` because system-wide cron jobs should only be managed by the superuser. The `600` permission mode ensures that only the owner (root) has read and write access, and no other users or groups can view or modify the file. This prevents both information disclosure about scheduled tasks and unauthorized modification that could lead to malicious code execution. There is no more secure or functionally correct state; therefore, this recommendation is consistent across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['600 root root']` |
| **Moderate** | `['600 root root']` |
| **Strict** | `['600 root root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `stat` command to retrieve the file permissions, owner, and group for `/etc/crontab`. The script must output these values in the format 'permissions owner group' (e.g., '600 root root'), and nothing else.

## Remediation Script Working

Bash script that takes a single positional argument for the file permissions (e.g., '600'). The script must use `chown` to set the owner and group of `/etc/crontab` to `root:root` and then use `chmod` to apply the permissions provided in the argument. The script must output `true` on success and `false` on failure.

