# Ensure shadow group is empty

The /etc/shadow file contains sensitive user password information in a hashed format. The 'shadow' group is historically used to grant read access to this file for specific programs. No standard user or unprivileged service should ever be a member of this group, as it creates an unnecessary security risk. A compromised account that is a member of the 'shadow' group could provide an attacker with access to all user password hashes, which could then be subjected to offline cracking attacks, potentially leading to privilege escalation and system-wide compromise. The audit script checks the membership of the 'shadow' group. The remediation script ensures this group is empty, revoking any direct access to the /etc/shadow file. All security levels (Basic, Moderate, and Strict) mandate that this group must be empty. There is no acceptable operational scenario where a user should belong to this group, making this a non-negotiable security baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['empty']` |
| **Moderate** | `['empty']` |
| **Strict** | `['empty']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the members of the 'shadow' group. The script should use a command like `getent group shadow | cut -d: -f4` to retrieve the list of members. It must output only the comma-separated list of members, or an empty string if the group is empty. Ensure no headers, labels, or other text are included in the output.

## Remediation Script Working

Bash script that accepts a single positional string argument. The script must verify that the argument is exactly 'empty'. If the argument is valid, it must remove all current members from the 'shadow' group, for example by using the `gpasswd -M "" shadow` command. The script must output `true` on success and `false` if the input argument is not 'empty' or if the command fails.

