# Ensure permissions on /etc/gshadow are configured

Necessity: The `/etc/gshadow` file contains the encrypted (hashed) passwords for user accounts and password aging information. Unauthorized access to this file presents a severe security risk. If an attacker gains read access, they can copy the password hashes and attempt to crack them offline using brute-force or dictionary attacks. This could lead to account compromise, privilege escalation, and full system control. Restricting permissions is a critical defense-in-depth measure to protect user credentials.

Auditing and Remediation: The audit script verifies the file permissions by checking the current octal mode of `/etc/gshadow`. The remediation script uses the `chmod` command to set the file's permissions to the specified secure value, effectively revoking all read, write, and execute permissions for the owner, group, and all other users.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is `0000`. This configuration is mandated by security benchmarks such as the CIS (Center for Internet Security) guidelines. The rationale is based on the principle of least privilege; no user or system process, including the root user, needs to directly read or write to this file. Access is programmatically handled by trusted system utilities (e.g., `passwd`, `chage`). By setting the permissions to `0000`, the system enforces this access model, providing the strongest possible protection against unauthorized disclosure of password hashes.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0000']` |
| **Moderate** | `['0000']` |
| **Strict** | `['0000']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that returns the octal permission mode of the `/etc/gshadow` file. The output must be the numerical value only, with no additional text or formatting.

## Remediation Script Working

Bash script that takes a single positional argument, which is the desired octal permission mode (e.g., '0000'). The script must apply this permission to the `/etc/gshadow` file using the `chmod` command. It must return `true` on success and `false` on failure.

