# Ensure permissions on /etc/security/opasswd are configured

Necessity: The '/etc/security/opasswd' file is used by the 'pam_pwhistory' module to store a history of previously used password hashes. This prevents users from reusing old passwords, which is a critical component of a strong password policy. If this file has improper permissions, an attacker with local access could potentially read old password hashes to gain insights for cracking current passwords, or modify/delete the file to bypass password history controls, thereby weakening the overall security posture of the system.

Auditing and Remediation: The audit script checks the ownership and access permissions of '/etc/security/opasswd' to ensure it is securely configured. The remediation script enforces the correct state by setting the owner and group to 'root' and restricting file permissions so that only the root user has read and write access, creating the file if necessary.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'root:root 600'. This is a fundamental security setting with a single correct configuration. Ownership by 'root:root' ensures that only the superuser account can manage the file. The '600' permission set grants read and write access exclusively to the owner (root) and denies all access to group members and all other users. This configuration adheres to the principle of least privilege and is essential for protecting the sensitive password history data stored within the file, as recommended by security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root:root 600']` |
| **Moderate** | `['root:root 600']` |
| **Strict** | `['root:root 600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the existence of the '/etc/security/opasswd' file. If it exists, the script must output its ownership and permissions in the format 'owner:group permissions' (e.g., 'root:root 600'). If the file does not exist, the script should output 'Not Configured'. The output must exclusively contain the resulting string without any additional text or formatting.

## Remediation Script Working

Bash script that accepts a single string argument specifying the desired state, such as 'root:root 600'. The script must create the '/etc/security/opasswd' file if it does not exist, then use the 'chown' and 'chmod' commands to set its ownership and permissions according to the argument. The script must output 'true' on success and 'false' on failure.

