Detections
Analytics

2.3.2 Ensure chrony is configured

Information

-

server

 - The server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server's system time will never be influenced by that of a client.
 - This directive can be used multiple times to specify multiple servers.
 - The directive is immediately followed by either the name of the server, or its IP address.

 -

pool

 - The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time.
 - This directive can be used multiple times to specify multiple pools.
 - All options valid in the server directive can be used in this directive too.

Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations.

Solution

Edit /etc/chrony.conf and add or edit server and/or pool directives to reference authorized time sources according to local site policy. The directive format is:

server <remote-server> iburst
pool <remote-pool> iburst

For example:

server time-a-g.nist.gov iburst
pool 2.pool.ntp.org iburst

Run the following command to reload the chronyd configuration:

# systemctl reload-or-restart chronyd

Note: As packaged, chrony reads /etc/chrony.conf directly and does not enable a general drop-in directory by default (only NetworkManager/DHCP-provided sources via sourcedir ). Add the server / pool directives to /etc/chrony.conf unless a confdir or sourcedir has been explicitly configured on the system.

Impact:

Configuring chrony with authorized time sources has negligible operational impact and is required for accurate, synchronized time across the enterprise.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-7, 800-53|AU-8, 800-53|AU-12, CSCv7|6.1

Plugin: Unix

Control ID: 4ad3055b92fc88857b1b619a8fd20b43c0a6a494f2ae5da1945ffb307bd58c14