# Ensure permissions on /etc/shadow are configured

Necessity: The '/etc/shadow' file contains the salted and hashed password information for user accounts. If this file is readable by unauthorized users, they can copy the hashes and perform offline brute-force or dictionary attacks to crack passwords, which could lead to unauthorized system access and privilege escalation. Restricting its permissions is critical to protecting user credentials. Auditing and Remediation: The audit script checks the current file permissions using the 'stat' command to ensure they conform to security policy. The remediation script uses the 'chmod' command to reset the permissions to a secure value provided as an argument. Recommended State Rationale: The Basic and Moderate recommendation of '0640' is the standard secure configuration. It allows the root user (owner) to read and write the file, and members of the 'shadow' group to read it, which is necessary for certain system authentication processes. All other users are denied access. The Strict recommendation also includes '0000' as a possibility for highly-hardened, non-interactive systems, where all access is denied by default, though '0640' remains the most practical and secure configuration for a functioning system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0640']` |
| **Moderate** | `['0640']` |
| **Strict** | `['0640', '0000']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that retrieves the octal permissions for the '/etc/shadow' file. The script must use the 'stat' command to output only the numerical permission value (e.g., '0640') and nothing else.

## Remediation Script Working

shell script that accepts a single positional argument representing the desired octal permissions (e.g., '0640'). The script must use the 'chmod' command to apply these permissions to the '/etc/shadow' file. The script must output 'true' if the command succeeds and 'false' if it fails.

