# Ensure no files or directories without an owner and a group exist

Necessity: Files and directories without a valid owner or group, often called 'orphaned' files, pose a significant security and administrative risk. They are typically remnants of deleted user accounts or improperly uninstalled software packages. These files can create a security vulnerability if a new user is created with the same User ID (UID) or Group ID (GID) as the former owner, as this new user would inherit ownership and potentially gain unauthorized access to sensitive data. Orphaned files also complicate system administration, break accountability trails, and can cause issues with backup and auditing processes. Ensuring all files have a valid owner is crucial for maintaining system integrity.

Auditing and Remediation: The audit script systematically scans the filesystem using the 'find' command with the '-nouser' and '-nogroup' predicates. This identifies any file or directory whose UID or GID does not correspond to a valid entry in the system's '/etc/passwd' and '/etc/group' files, and returns a count of these orphaned items. The remediation script performs the same search but executes the 'chown' command on each discovered file, reassigning its ownership to a designated administrative account (typically root) provided as an argument, thus restoring proper ownership and resolving the security risk.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is a count of zero. There is no acceptable threshold for the number of orphaned files on a system. The presence of even a single file without a valid owner indicates a configuration flaw or a lapse in administrative procedures. This strict 'zero-tolerance' policy is aligned with security best practices, including CIS Benchmarks, as it completely mitigates the risk of unintended data access and ensures a clean, auditable, and secure system state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[0, 0]` |
| **Moderate** | `[0, 0]` |
| **Strict** | `[0, 0]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that searches the entire system for files and directories that do not have a valid user or group owner. The script must only output the total count of such files as a single integer.

## Remediation Script Working

Bash script that accepts two positional command-line arguments: a username and a group name. The script should find all files and directories on the system without a valid owner or group and change their ownership to the provided username and group. The script must return `true` upon successful completion of the ownership changes, and `false` if it fails.

