cis-ubuntu1804-v220-2-1-1-1

name	cis-ubuntu1804-v220-2-1-1-1
description	Ensure a single time synchronization daemon is in use
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","services","time-synchronization"]
cis_id	2.1.1.1
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

2.1.1.1 Ensure a single time synchronization daemon is in use (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

System time should be synchronized between all systems in an environment. This is typically done by establishing an authoritative time server or set of servers and having all systems synchronize their clocks to them.

Note:

• On virtual systems where host based time synchronization is available consult your virtualization software documentation and verify that host based synchronization is in use and follows local site policy. In this scenario, this section should be skipped
• Only one time synchronization method should be in use on the system. Configuring multiple time synchronization methods could lead to unexpected or unreliable results

Rationale

Time synchronization is important to support time sensitive security mechanisms and ensures log files have consistent time records across the enterprise, which aids in forensic investigations.

Audit Procedure

Command Line

On physical systems, and virtual systems where host based time synchronization is not available. One of the three time synchronization daemons should be available; chrony, systemd-timesyncd, or ntp

Run the following script to verify that a single time synchronization daemon is available on the system:

#!/usr/bin/env bash

{
   output="" l_tsd="" l_sdtd="" chrony="" l_ntp=""
   dpkg-query -W chrony > /dev/null 2>&1 && l_chrony="y"
   dpkg-query -W ntp > /dev/null 2>&1 && l_ntp="y" || l_ntp=""
   systemctl list-units --all --type=service | grep -q 'systemd-timesyncd.service' && systemctl is-enabled systemd-timesyncd.service | grep -q 'enabled' && l_sdtd="y"
   if [[ "$l_chrony" = "y" && "$l_ntp" != "y" && "" !=  ]]; 
      l_tsd=
      output=
    [[  !=  &&  !=  &&  !=  ]]; 
      l_tsd=
      output=
    [[  !=  &&  !=  ]]; 
       systemctl list-units --all --=service | grep -q  && systemctl is-enabled systemd-timesyncd.service | grep -Eq ; 
         l_tsd=
         output=
      
   
      [[  =  &&  =  ]] && output=
      [[  =  &&  =  ]] && output=
      [[  =  &&  =  ]] && output=
   
    [ -n  ]; 
       -e 
   
       -e 
   
}