Detections
Analytics

2.3.3 Ensure chrony is not run as the root user

Information

The file /etc/sysconfig/chronyd allows configuration of options for chrony to include the user chrony is run as. By default, this is set to the user chrony

Services should not be set to run as the root user.

Solution

Edit the file /etc/sysconfig/chronyd and add or modify the following line to remove " -u root " from any OPTIONS= argument:

Example:

OPTIONS="-F 2"

Run the following command to reload the chronyd.service configuration:

# systemctl reload-or-restart chronyd.service

Impact:

Running chronyd as the dedicated chrony user rather than root applies the principle of least privilege, limiting the potential impact if the service is compromised.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6

Plugin: Unix

Control ID: 69ffc00c150268d6a754ca8f592ee09d150fd5ac40fa0521bc8a317681e6af6d