# Ensure default user umask is configured

The umask (user file-creation mode mask) determines the default permissions for newly created files and directories. A misconfigured umask, such as one that is too permissive (e.g., 002), could allow unauthorized users to read, write, or execute files, leading to sensitive information disclosure or unauthorized system modification. Enforcing a secure umask is a fundamental security control on multi-user systems. The audit script checks the system-wide default umask value defined in '/etc/login.defs'. The remediation script modifies this file to set the umask to a more secure value. The recommended states are based on security best practices. A value of '027' (Basic/Moderate) is aligned with CIS Benchmarks, ensuring that new files are not writable by group members or any other users by default, which is a strong security baseline for most environments. A value of '077' (Strict) provides maximum security by revoking all default permissions for group and other users, ensuring new files are private to the owner unless permissions are explicitly changed. This is suitable for high-security environments or systems where inter-user collaboration is not a requirement.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['027']` |
| **Moderate** | `['027']` |
| **Strict** | `['077']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the /etc/login.defs file for the UMASK setting. The script must parse the file to find the active, non-commented line starting with 'UMASK' and return only the octal value (e.g., '027').

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired umask value (e.g., '027'). The script must locate and update the 'UMASK' setting in /etc/login.defs to the provided value. If the setting does not exist, it should be added. The script must return 'true' upon successful modification and 'false' otherwise.

