# Ensure permissions on /etc/security/opasswd are configured

Necessity: The '/etc/security/opasswd' file is used by the 'pam_pwhistory' module to store a history of previously used passwords for each user. This prevents users from reusing old passwords. If an attacker gains administrative privileges, they could read this file to harvest old passwords. These passwords might be reused on other systems or reveal patterns, increasing the attack surface. Restricting permissions on this file is critical to protect this sensitive historical data from unauthorized access.

Auditing and Remediation: The audit script verifies the octal file permissions of '/etc/security/opasswd' to ensure they align with security policies. The remediation script corrects any deviations by setting the file's ownership to 'root:root' and applying the specified secure permission set, thereby preventing access by non-privileged users and processes.

Recommended State Rationale:
- Basic ['600']: This state allows the file to be read and written to only by its owner, which should be the root user. This is the standard secure configuration (recommended by CIS Benchmarks) that allows the 'pam_pwhistory' module to function correctly while preventing any other user from accessing the file.
- Moderate ['400']: This state enhances security by making the file read-only, even for the root user. This protects against accidental or malicious modification of the password history. However, this may interfere with the normal operation of the password history module, which needs write access to update the file. This is suitable for systems where the history is for archival/review purposes only.
- Strict ['000']: This is the most restrictive state, removing all read, write, and execute permissions for everyone, including the root user. It effectively seals the file from any access without explicitly changing permissions first. This configuration should be used in highly secure environments or when the password history mechanism is being decommissioned and the file is archived for forensic purposes, as it renders the 'pam_pwhistory' module non-functional.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['600']` |
| **Moderate** | `['400']` |
| **Strict** | `['000']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks for the existence of the '/etc/security/opasswd' file. If the file exists, the script must output its octal permissions (e.g., '600') as a string and nothing else. If the file does not exist, the script should output the string 'Not Found'.

## Remediation Script Working

Bash script that accepts one positional argument: the desired octal permissions (e.g., '600'). The script must first check if the file '/etc/security/opasswd' exists. If it does not exist, the script must return 'false'. If it does exist, the script must set its ownership to 'root:root' and its permissions to the value provided in the argument. The script must output 'true' on successful permission and ownership change, and 'false' otherwise.

