# Ensure default user umask is configured

Necessity: The user file-creation mode mask (umask) determines the default permissions for newly created files and directories. An improperly configured umask could result in new files being created with insecure permissions, potentially allowing unauthorized users to read, modify, or execute sensitive data. Setting a restrictive umask by default enforces the principle of least privilege and prevents accidental information disclosure or unauthorized modification.

Auditing and Remediation: The audit script checks the system-wide default umask value by inspecting the `UMASK` setting within the `/etc/login.defs` file. The remediation script modifies this file to set the `UMASK` variable to a secure value, ensuring that all newly created user shells adopt this default permission mask.

Recommended State Rationale:
- Basic/Moderate ('027'): This state, recommended by CIS benchmarks, ensures that new files are not writable by the user's group and are not readable, writable, or executable by others. This provides a strong security baseline by preventing inadvertent data exposure within shared group environments and to other users on the system.
- Strict ('077'): This state provides the highest level of security by ensuring that newly created files and directories are only accessible by their owner. This configuration is ideal for high-security systems or single-user environments where data confidentiality is paramount and default collaboration is not required.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['027']` |
| **Moderate** | `['027']` |
| **Strict** | `['077']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/login.defs` file for the `UMASK` setting. The script should parse this file and return only the numerical value of the `UMASK` setting (e.g., `027`), with no additional text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired umask value (e.g., `027`). The script should modify the `UMASK` setting in the `/etc/login.defs` file to match the provided argument. If the `UMASK` setting does not already exist, the script should add it. The script must return `true` upon successful modification and `false` if an error occurs.

