# Ensure shadow group is empty

Necessity: The '/etc/shadow' file contains sensitive user authentication information, including hashed passwords. The 'shadow' group is historically associated with providing read access to this file. Adding any user to this group violates the principle of least privilege and dramatically increases the risk of security breaches. An attacker who compromises an account in this group could potentially access the password hashes of all local users, enabling offline password cracking attacks and subsequent privilege escalation. Ensuring this group is empty is a critical step in securing local user accounts.

Auditing and Remediation: The audit script directly queries the system's group database to identify any members of the 'shadow' group. The remediation script actively removes all listed members from this group, restoring the intended secure state where access to '/etc/shadow' is restricted to the root user.

Recommended State Rationale: The recommendation is consistent across all hardening levels (Basic, Moderate, and Strict) because there is no acceptable scenario where a user should be a member of the 'shadow' group. The only secure configuration is an empty member list, represented as ['']. Any deviation from this standard introduces a significant and unnecessary security vulnerability. This aligns with established security standards, including the CIS Benchmarks, which mandate that this group must have no members.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['']` |
| **Moderate** | `['']` |
| **Strict** | `['']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the '/etc/group' file for the 'shadow' group. The script must parse the entry and return only the contents of the fourth field, which lists the group members. If the group does not exist or has no members, the script must return an empty string.

## Remediation Script Working

Bash script that removes all members from the 'shadow' group. The script should not accept any arguments, as the only valid action is to empty the group. It must use a command like 'gpasswd -M "" shadow' to set the member list to empty. The script must return 'true' on success and 'false' on failure.

