# Ensure permissions on /etc/shadow- are configured

Necessity: The '/etc/shadow-' file is a backup of the '/etc/shadow' file, which contains sensitive hashed password information for local user accounts. If an attacker gains read access to this file, they can perform offline dictionary or brute-force attacks to crack user passwords. Improperly permissive settings on this file create a significant risk of account compromise and privilege escalation. 

Auditing and Remediation: The audit script checks the current octal permissions and user/group ownership of the '/etc/shadow-' file, comparing them against secure baselines. The remediation script uses the 'chmod' and 'chown' commands to apply the specified secure permissions and ownership, or 'rm' to delete the file if that is the desired state, thereby restricting access and mitigating the risk. 

Recommended State Rationale: 
- Basic: ['0600 root:root'] sets permissions so that only the root user can read and write the file. This is a fundamental security measure to prevent access by non-privileged users. 
- Moderate: ['0000 root:root'] provides a stricter configuration by removing all permissions for all users, including root. This prevents accidental exposure and requires a deliberate action (changing permissions) to access the file, adding another layer of security. This aligns with CIS (Center for Internet Security) benchmark recommendations. 
- Strict: ['File not found', '0000 root:root'] represents the most secure configuration. Since '/etc/shadow-' is a backup file created by tools like 'pwconv', its persistent existence is often unnecessary and presents a potential attack surface. Deleting the file entirely eliminates this risk. If the file is required, it should have no permissions.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0600 root:root']` |
| **Moderate** | `['0000 root:root']` |
| **Strict** | `['File not found', '0000 root:root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that outputs the permissions and ownership of the '/etc/shadow-' file. The output must be in the format 'permissions ownership', where permissions are in octal (e.g., '0000') and ownership is 'user:group' (e.g., 'root:root'). If the file does not exist, the script must output the exact string 'File not found'.

## Remediation Script Working

Bash script that accepts a single positional command-line argument specifying the desired state. If the argument is 'File not found', the script should delete the '/etc/shadow-' file. Otherwise, the argument will be in the format 'permissions ownership' (e.g., '0000 root:root'). The script must use 'chmod' to set the permissions and 'chown' to set the ownership. The script must return 'true' on success and 'false' on failure.

