| name | cis-ubuntu1804-v220-2-1-4-2 |
| description | Ensure ntp is configured with authorized timeserver |
| category | cis-networking |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","services","ntp"] |
| cis_id | 2.1.4.2 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
2.1.4.2 Ensure ntp is configured with authorized timeserver (Manual)
Profile
- Level 1 - Server
- Level 1 - Workstation
Description
The various modes are determined by the command keyword and the type of the required IP address. Addresses are classed by type as (s) a remote server or peer (IPv4 class A, B and C), (b) the broadcast address of a local interface, (m) a multicast address (IPv4 class D), or (r) a reference clock address (127.127.x.x).
- pool - For type s addresses, this command mobilizes a persistent client mode association with a number of remote servers. In this mode the local clock can synchronized to the remote server, but the remote server can never be synchronized to the local clock.
- server - For type s and r addresses, this command mobilizes a persistent client mode association with the specified remote server or local radio clock. In this mode the local clock can synchronized to the remote server, but the remote server can never be synchronized to the local clock. This command should not be used for type b or m addresses.
Rationale
Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations.
Audit Procedure
Command Line
IF ntp is in use on the system, run the following command to display the server and/or pool mode:
Verify that at least one pool line and/or at least three server lines are returned, and the timeserver on the returned lines follows local site policy.
Expected Result
Output examples:
pool mode:
pool time.nist.gov iburst maxsources 4 #The maxsources option is unique to the pool directive
server mode:
server time-a-g.nist.gov iburst
server 132.163.97.3 iburst
server time-d-b.nist.gov iburst
Remediation
Command Line
Edit /etc/ntp.conf and add or edit server or pool lines as appropriate according to local site policy:
<[server|pool]> <[remote-server|remote-pool]>
Examples:
pool mode:
pool time.nist.gov iburst
server mode:
server time-a-g.nist.gov iburst
server 132.163.97.3 iburst
server time-d-b.nist.gov iburst
