# Ensure permissions on /etc/shadow- are configured

The '/etc/shadow-' file is a backup of the '/etc/shadow' file, which contains sensitive user authentication information, including hashed passwords and account expiry details. Proper permissions are critical to prevent unauthorized access and modification, which could lead to privilege escalation, password cracking, or the creation of unauthorized accounts. An attacker with read access could attempt offline password cracking, while write access could allow them to alter user passwords or privileges. The audit script verifies the file's current permissions and ownership using the 'stat' command. The remediation script uses 'chmod' and 'chown' to enforce the correct security configuration. The recommended state of '640 root:shadow' is consistently applied across all hardening levels because it represents the standard and required configuration for a secure system, aligning with benchmarks like CIS. The 'root' owner has read/write access (6), the 'shadow' group has read-only access (4) for legitimate system services, and all other users have no access (0). Any deviation from this configuration is considered insecure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['640 root:shadow']` |
| **Moderate** | `['640 root:shadow']` |
| **Strict** | `['640 root:shadow']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the permissions and ownership of the '/etc/shadow-' file. The script must output the octal permissions and the owner/group in the format '<permissions> <owner>:<group>' (e.g., '640 root:shadow'). The output should contain only this value, without any additional text or labels.

## Remediation Script Working

Bash script that accepts a single positional argument defining the desired state for '/etc/shadow-'. The argument must be a string in the format '<permissions> <owner>:<group>' (e.g., '640 root:shadow'). The script must use 'chmod' and 'chown' to apply the specified permissions and ownership. The script must return 'true' on success and 'false' on failure.

