# Ensure permissions on /etc/group- are configured

Necessity: The '/etc/group-' file is a backup of the '/etc/group' file, which contains critical group account information. Improperly permissive settings could allow unauthorized users to read the file, gathering intelligence about system groups to aid in privilege escalation attacks. If writable, it could be maliciously modified or deleted, hindering system recovery or causing instability. Enforcing strict permissions mitigates these risks by ensuring only the root user can access the file. Auditing and Remediation: The audit script checks the file's current permissions using the 'stat' command to retrieve the octal mode. The remediation script uses the 'chmod' command to set the file permissions to a secure, recommended value provided as an argument. Recommended State Rationale: The states represent an increasing level of security based on the principle of least privilege. Basic: ['640'] (rw-r-----) establishes a secure baseline, allowing the root user full access and the root group read-only access. Moderate/Strict: ['600'] (rw-------) provides a higher level of security by removing read access for the group, restricting all access exclusively to the root user. This is the most secure practical configuration, as no other user or process typically requires access to this backup file.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['640']` |
| **Moderate** | `['600']` |
| **Strict** | `['600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that retrieves the octal permissions for the '/etc/group-' file. The script must only output the numeric permission value (e.g., '640') and nothing else.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired octal permissions (e.g., '640'). The script must apply these permissions to the '/etc/group-' file using the 'chmod' command. It must output 'true' on success and 'false' on failure.

