A remote time server for Chrony is configured
Description
Chrony
is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony
can be found at
http://chrony.tuxfamily.org/.
Chrony
can be configured to be a client and/or a server.
Add or edit server or pool lines to /etc/chrony/chrony.conf
as appropriate:
Multiple servers may be configured.
Rationale
If chrony
is in use on the system proper configuration is vital to ensuring time
synchronization is working properly.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'chrony' 2>/dev/null | grep -q installed; }; then
var\_multiple\_time\_servers=''
config\_file="/etc/chrony/chrony.conf"
if ! grep -q '^[[:space:]]\*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' "$config\_file" ; then
if ! grep -q '#[[:space:]]\*server' "$config\_file" ; then
for server in $(echo "$var\_multiple\_time\_servers" | tr ',' '\n') ; do
printf '\nserver %s' "$server" >> "$config\_file"
done
else
sed -i 's/#[ \t]\*server/server/g' "$config\_file"
fi
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package\_facts:
manager: auto
tags:
- NIST-800-53-AU-8(1)(a)
- NIST-800-53-CM-6(a)
- PCI-DSS-Req-10.4.3
- PCI-DSSv4-10.6.2
- chronyd\_specify\_remote\_server
- configure\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- name: XCCDF Value var\_multiple\_time\_servers # promote to variable
set\_fact:
var\_multiple\_time\_servers: !!str
tags:
- always
- name: Detect if chrony is already configured with pools or servers
find:
path: /etc
patterns: chrony.conf
contains: ^[\s]\*(?:server|pool)[\s]+[\w]+
register: chrony\_servers
when:
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
- '"chrony" in ansible\_facts.packages'
tags:
- NIST-800-53-AU-8(1)(a)
- NIST-800-53-CM-6(a)
- PCI-DSS-Req-10.4.3
- PCI-DSSv4-10.6.2
- chronyd\_specify\_remote\_server
- configure\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- name: Configure remote time servers
lineinfile:
path: /etc/chrony/chrony.conf
line: server {{ item }}
state: present
create: true
loop: '{{ var\_multiple\_time\_servers.split(",") }}'
when:
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
- '"chrony" in ansible\_facts.packages'
- chrony\_servers.matched == 0
tags:
- NIST-800-53-AU-8(1)(a)
- NIST-800-53-CM-6(a)
- PCI-DSS-Req-10.4.3
- PCI-DSSv4-10.6.2
- chronyd\_specify\_remote\_server
- configure\_strategy
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed