# Ensure /etc/shadow password fields are not empty

Necessity: An empty password field in the /etc/shadow file for any account constitutes a critical security vulnerability. It allows anyone to log in as that user without providing a password, granting them immediate, unauthorized access to the system with the privileges of that account. This misconfiguration bypasses fundamental authentication controls and exposes the system to compromise.

Auditing and Remediation: The audit script directly parses the /etc/shadow file, a system file containing encrypted user password information, and counts the number of entries where the password hash field is blank. The remediation script identifies these same accounts and disables password-based authentication for them by using the 'passwd -l' command, which effectively locks the account from being accessed with a password.

Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is an integer value of 0. There is no acceptable scenario in a secure environment for a user account to have an empty password. Any value greater than zero indicates an active, high-risk vulnerability that must be addressed immediately. Therefore, the only compliant state is to have zero accounts with this misconfiguration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the /etc/shadow file to identify any user accounts with an empty password field. The script must return the integer count of accounts found in this insecure state. The output must consist only of the integer value, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single string argument, which must be 'lock'. The script must identify all user accounts in /etc/shadow with an empty password field and then lock each of these accounts using the 'passwd -l <username>' command. The script must return 'true' if the operation is successful for all identified accounts or if no accounts required locking. It must return 'false' if any locking operation fails.

