# Ensure permissions on /etc/passwd- are configured

Necessity: The '/etc/passwd-' file is a backup of the '/etc/passwd' file, containing critical information about user accounts on the system, such as usernames, UIDs, GIDs, home directories, and shells. If this file is readable by non-privileged users, it allows for user enumeration, which is a key reconnaissance step for an attacker seeking to escalate privileges or move laterally within a network. Improper write permissions could allow an attacker to modify the backup, potentially causing system instability or aiding in an attack.

Auditing and Remediation: The audit script verifies the current file permissions of '/etc/passwd-' in octal format. The remediation script uses the 'chmod' command to set the file's permissions to a secure state, taking the desired octal value as an argument.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '600'. This permission setting grants read and write access exclusively to the file's owner (the 'root' user) and denies all access to group members and all other users. This is a fundamental security best practice and is recommended by hardening standards like the CIS Benchmarks. It effectively prevents any unauthorized user from reading or modifying this sensitive account information backup. Since this is the most secure functional configuration, the recommendation does not vary across different hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['600']` |
| **Moderate** | `['600']` |
| **Strict** | `['600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the 'stat' command to retrieve the octal permissions of the '/etc/passwd-' file. The script must output only the numerical permission value (e.g., '600') with no additional text or formatting.

## Remediation Script Working

Bash script that takes a single positional argument, which is the desired octal permission mode (e.g., '600'). The script must use the 'chmod' command to apply this permission to the '/etc/passwd-' file. It must return 'true' if the command succeeds and 'false' if it fails.

