# Ensure permissions on /etc/shadow are configured

Necessity: The `/etc/shadow` file contains the salted password hashes for all user accounts on the system. Unauthorized access to this file allows an attacker to perform offline brute-force or dictionary attacks to crack user passwords. A successful attack can lead to unauthorized access, privilege escalation, and full system compromise. Therefore, enforcing strict permissions is critical to protect these credentials. Auditing and Remediation: The audit script verifies the current file permissions (in octal format), the file owner, and the group owner of `/etc/shadow`. The remediation script directly addresses misconfigurations by using standard system commands (`chmod`, `chown`, `chgrp`) to reset the permissions and ownership to the secure, recommended state. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is `'0 root root'`, which translates to file permissions of `0000` with ownership by the `root` user and `root` group. This is a foundational security control with no room for leniency. Any permission other than `0000` is a misconfiguration, as it could allow unauthorized users to read the password hashes. System processes that need to access this file do so with elevated privileges, bypassing the need for standard user/group read permissions. Therefore, all security levels mandate this single, secure configuration as specified by industry benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0 root root']` |
| **Moderate** | `['0 root root']` |
| **Strict** | `['0 root root']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that retrieves the permissions, owner, and group for the `/etc/shadow` file. The script must use the `stat -c "%a %U %G" /etc/shadow` command and output only the resulting string (e.g., '0 root root'), with no extra text or formatting.

## Remediation Script Working

shell script that accepts a single string argument specifying the desired state for `/etc/shadow` in the format 'permissions owner group' (e.g., '0 root root'). The script must parse this argument and use the `chmod`, `chown`, and `chgrp` commands to set the file's permissions, owner, and group accordingly. The script must output `true` on success and `false` on failure.

