# Ensure permissions on /etc/shells are configured

The `/etc/shells` file contains a list of valid login shells on the system. It is used by applications like `chsh` to determine if a user can change their shell to a specific executable, and by some FTP daemons to verify user access. Securing this file is crucial to prevent unauthorized modifications that could lead to privilege escalation. An attacker with write access could add a malicious script or program to the list, potentially allowing them to assign it as a valid shell for a user account and gain persistent, privileged access. Restricting read access limits an attacker's ability to gather information about the system's configuration. The audit script checks the file's current permissions using the `stat` command. The remediation script uses `chmod` to apply the specified octal permission set. A 'Basic' state of '644' is a common default, allowing all users to read the file but only root to write. A 'Moderate' state of '640' enhances security by restricting read access to only root and members of the root group. A 'Strict' state of '600' adheres to the principle of least privilege by ensuring only the root user can read or write the file, minimizing the attack surface for information disclosure and unauthorized modification.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['640']` |
| **Strict** | `['600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that uses the `stat -c "%a" /etc/shells` command to retrieve the octal permissions for the `/etc/shells` file. The script must output only the numerical permission value (e.g., '644') with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired octal permissions (e.g., '644'). The script must use the `chmod` command to set the permissions on the `/etc/shells` file. It must return 'true' on successful execution and 'false' on failure.

