# Ensure /etc/shadow password fields are not empty

Necessity: An empty password field in the `/etc/shadow` file means that a user account has no password set. This is a critical security vulnerability, as it allows anyone who knows the username to log in to the system without any authentication, granting them unauthorized access. This could lead to a complete system compromise, data theft, privilege escalation, or the installation of malicious software. Ensuring no accounts have empty passwords is a fundamental security measure to prevent unauthorized access.

Auditing and Remediation: The audit script checks the second, colon-delimited field for each user entry in the `/etc/shadow` file. It counts and returns the number of lines where this field is blank. The remediation script identifies these same accounts and uses the `passwd -l` command to lock them. This action prepends an exclamation mark ('!') to the encrypted password hash, which effectively disables password-based authentication for the account until an administrator sets a new password.

Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is 0. There is no acceptable scenario where a user account should have a null password. A single account in this state represents a direct and severe authentication bypass vulnerability. Therefore, the only compliant state is to have zero accounts with empty password fields, regardless of the overall security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

shell script that parses the `/etc/shadow` file to identify user accounts with an empty password field. The script must count the number of such accounts and output only the resulting integer, with no additional text or formatting.

## Remediation Script Working

shell script that identifies all user accounts in `/etc/shadow` with an empty password field. For each account found, the script must lock it by executing `passwd -l <username>`. The script should not accept any arguments. It must return `true` if it successfully attempts to lock all identified accounts or if no accounts require locking. It must return `false` if any of the `passwd` commands fail.

