# Ensure permissions on /etc/passwd- are configured

Necessity: The `/etc/passwd-` file is a backup of the `/etc/passwd` file, which contains critical user account information, including usernames, user IDs (UIDs), group IDs (GIDs), home directories, and default shells. Improperly permissive settings could allow unauthorized users to read this file, gathering intelligence about system accounts for further attacks. While it's a backup, it contains the same sensitive information as the live file and must be protected to prevent information disclosure.

Auditing and Remediation: The audit script checks the current file permissions of `/etc/passwd-` in octal format (e.g., '640'). The remediation script uses the `chmod` command to set the file permissions to a specified secure value, restricting access according to best practices.

Recommended State Rationale:
- Basic: `['640']` sets read/write permissions for the owner (root) and read-only for the group (root), while revoking all permissions for other users. This is a baseline that prevents regular users from accessing the file's contents.
- Moderate: `['600']` enhances security by removing read permissions for the group. This adheres to the principle of least privilege, ensuring only the root user can read or write to the file, which is sufficient for all system operations.
- Strict: `['600']` is the highest recommended state and aligns with security benchmarks like CIS. It completely isolates access to the root user, providing the strongest protection against unauthorized information disclosure on a multi-user system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['640']` |
| **Moderate** | `['600']` |
| **Strict** | `['600']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that retrieves the octal permissions for the file '/etc/passwd-'. The script must output only the numerical permission value (e.g., '600') and nothing else.

## Remediation Script Working

bash script that accepts a single positional argument representing the desired octal permissions (e.g., '600'). The script must apply these permissions to the file '/etc/passwd-' using the 'chmod' command. It should return 'true' on success and 'false' on failure.

