# Ensure permissions on /etc/gshadow- are configured

Necessity: The '/etc/gshadow-' file is a backup of the '/etc/gshadow' file, which contains encrypted password information for local groups. Unauthorized access to this file could allow an attacker to obtain sensitive password hashes for offline cracking, potentially leading to privilege escalation and system compromise. Ensuring its permissions are highly restrictive is a critical security measure to prevent such information disclosure.

Auditing and Remediation: The audit script verifies the current file permission mode of '/etc/gshadow-'. The remediation script uses the 'chmod' command to set the file's permissions to a secure state, effectively revoking all read, write, and execute permissions for the owner, group, and other users.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '0' (equivalent to '000').
- Basic: A permission of '0' is the standard recommendation from security benchmarks like CIS. It completely locks down the file, preventing any user, including root, from accessing its contents without first explicitly changing the permissions. This is the most fundamental and effective setting.
- Moderate/Strict: For this specific control, there is no more secure configuration than '0'. Any other permission setting (e.g., '400' for root read-only) would represent a less secure state by allowing potential access. Therefore, the single recommended state of '0' applies across all hardening levels as it provides the maximum possible protection for this sensitive backup file.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0']` |
| **Moderate** | `['0']` |
| **Strict** | `['0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the existence of the '/etc/gshadow-' file. If the file exists, the script must output its octal permission mode (e.g., '0') using the 'stat' command. If the file does not exist, the script should output 'not_found'. The output must contain only the value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired octal permission mode. The script must use the 'chmod' command to apply these permissions to the '/etc/gshadow-' file. This action should only be attempted if the file exists. The script must return 'true' on success and 'false' if the file does not exist or the command fails.

