# Ensure permissions on /etc/passwd are configured

Necessity: The `/etc/passwd` file contains critical user account information, including usernames, user IDs (UIDs), group IDs (GIDs), home directories, and login shells. If improperly configured to be world-writable, an unauthorized user could create new accounts (potentially with root privileges), delete existing accounts, or modify user attributes to escalate privileges, leading to a complete system compromise. Ensuring correct permissions is fundamental to preventing unauthorized system access and modification.

Auditing and Remediation: The audit script programmatically verifies the current file permissions of `/etc/passwd` by checking its octal mode. The remediation script uses the `chmod` command to reset the file's permissions to a secure state, revoking any excessive write permissions from the group or other users.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '644'. This permission set translates to read/write for the owner (root), read-only for the group (root), and read-only for all other users. This is the universally accepted standard for this file, as defined by security benchmarks like CIS. It is considered strict because it enforces the principle of least privilege; it provides the necessary read access for system processes and commands to function correctly while ensuring that only the root user can modify its content. Any more permissive setting is a security vulnerability, and any more restrictive setting (e.g., '600') would break essential system functionality that relies on reading user data from this file.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['644']` |
| **Strict** | `['644']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `stat` command with the format option `%a` to retrieve the octal permissions for the file `/etc/passwd`. The script must output only the numerical permission value (e.g., '644') and nothing else.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired octal file permission (e.g., '644'). The script must use the `chmod` command to apply these permissions to the `/etc/passwd` file. It must return 'true' if the operation is successful and 'false' if it fails.

