Install the systemd_timesyncd Service

Description

The systemd_timesyncd service should be installed.

Rationale

Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). systemd_timesyncd is a part of the systemd suite and acts as a NTP client.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

#!/bin/bash

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then

var_timesync_service='systemd-timesyncd'



  if [ $var_timesync_service == systemd-timesyncd ]; then
    DEBIAN_FRONTEND=noninteractive apt-get install -y "systemd-timesyncd"
  fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_timesyncd_installed
- name: XCCDF Value var_timesync_service # promote to variable
  set_fact:
    var_timesync_service: !!str systemd-timesyncd
  tags:
    - always

- name: Ensure systemd-timesyncd is installed
  ansible.builtin.package:
    name: systemd-timesyncd
    state: present
  when:
  - '"linux-base" in ansible_facts.packages'
  - var_timesync_service == "systemd-timesyncd"
  tags:
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - package_timesyncd_installed