# Ensure permissions on /etc/group- are configured

Necessity: The `/etc/group-` file is a backup of `/etc/group`, which contains the list of all user groups on the system. It is critical to secure this file to prevent unauthorized access and modification. An attacker gaining write access could potentially escalate their privileges by adding their user to an administrative group (e.g., `root` or `wheel`). Unauthorized read access could reveal information about the system's user and group structure, aiding in further attacks.

Auditing and Remediation: The audit script checks the current octal permission settings on the `/etc/group-` file to ensure they align with security policies. The remediation script uses the `chmod` command to modify these permissions to a more secure state, directly enforcing the required configuration.

Recommended State Rationale:
- Basic `['0644']`: This state provides read and write permissions for the owner (root) and read-only permissions for the root group and all other users. It is a standard secure baseline that prevents unauthorized modification while allowing system services to read the file.
- Moderate `['0640']`: This state enhances security by removing read permissions for 'others'. Access is restricted to the root user and members of the root group, adhering to the principle of least privilege by limiting information exposure about the system's group configuration.
- Strict `['0600']`: This is the most secure configuration, granting read and write permissions exclusively to the root user. It completely prevents any non-root user or process from reading or modifying the file, maximally reducing the risk of privilege escalation and information disclosure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0644']` |
| **Moderate** | `['0640']` |
| **Strict** | `['0600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that retrieves the octal permissions for the file `/etc/group-`. The script must use the `stat -c "%a" /etc/group-` command and output only the numerical permission value (e.g., '644') with no additional text or formatting.

## Remediation Script Working

Bash script that sets the permissions for the file `/etc/group-`. The script must accept a single positional command-line argument representing the desired octal permission mode (e.g., '644'). It must use the `chmod` command to apply the change and output 'true' on success or 'false' on failure.

