# Ensure permissions on /etc/cron.weekly are configured

Necessity: The `/etc/cron.weekly` directory contains scripts that are executed weekly with root privileges by the cron daemon. If this directory is writable by any user other than root, an unauthorized user could add or modify scripts, leading to privilege escalation and a complete compromise of the system. Ensuring that permissions are restrictively set to `700` (read, write, execute for owner only) and that the owner is `root` is a critical security control to prevent unauthorized code execution. Auditing and Remediation: The audit script verifies the current access mode, owner, and group of the `/etc/cron.weekly` directory. The remediation script uses the `chmod`, `chown`, and `chgrp` commands to enforce the correct permissions and ownership, ensuring that only the root user has control over the directory's contents. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is `700:root:root`. This is the industry-standard and CIS benchmark-recommended configuration. It provides the necessary security by limiting all access (read, write, execute) exclusively to the root user. There is no more secure configuration possible, and any less restrictive setting introduces an unacceptable security risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['700:root:root']` |
| **Moderate** | `['700:root:root']` |
| **Strict** | `['700:root:root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `stat` command to retrieve the permissions, owner, and group for the `/etc/cron.weekly` directory. The output must be formatted as a single string: `permissions:owner:group` (e.g., `700:root:root`), with no additional text or labels.

## Remediation Script Working

Bash script that accepts a single string argument in the format `permissions:user:group` (e.g., `700:root:root`). The script must parse this argument and apply the specified permissions using `chmod`, owner using `chown`, and group using `chgrp` to the `/etc/cron.weekly` directory. The script must return `true` if all commands succeed and `false` otherwise.

