cis-ubuntu2004-v300-2-3-2-1

name	cis-ubuntu2004-v300-2-3-2-1
description	Ensure systemd-timesyncd configured with authorized timeserver
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","time-sync","systemd-timesyncd"]
cis_id	2.3.2.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure systemd-timesyncd configured with authorized timeserver

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

NTP=

• A space-separated list of NTP server host names or IP addresses. During runtime this list is combined with any per-interface NTP servers acquired from systemd-networkd.service(8). systemd-timesyncd will contact all configured system or per-interface servers in turn, until one responds. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. This setting defaults to an empty list.

FallbackNTP=

• A space-separated list of NTP server host names or IP addresses to be used as the fallback NTP servers. Any per-interface NTP servers obtained from systemd-networkd.service(8) take precedence over this setting, as do any servers set via NTP= above. This setting is hence only relevant if no other NTP server information is known. When the empty string is assigned, the list of NTP servers is reset, and all prior assignments will have no effect. If this option is not given, a compiled-in list of NTP servers is used.

Rationale

Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations

Audit

Run the following command to verify the NTP and/or FallbackNTP option is set to local site approved authoritative time server(s):

Command Line

#!/usr/bin/env bash
{
  l_output="" l_output2="" a_out=() a_out2=() l_ntp_valid="" l_fbkntp_valid="" l_parlist="(NTP|FallbackNTP)" l_systemd_config_file="/etc/systemd/timesyncd.conf"
  l_analyze_cmd="$(readlink -f /bin/systemd-analyze)" l_systemd_config_file="/etc/systemd/timesyncd.conf"
  while IFS= read -r l_conf_loc; do
    l_used_parameter_setting=""
    while IFS= read -r l_file_name l_file_parameter; do
      l_used_parameter_setting=""
      l_used_parameter_setting= |  -n 1)$(find /etc/systemd/ /run/systemd/ /usr/local/lib/systemd/ /usr/lib/systemd/ \( - f -o - l \) -name  -print0 | xargs -0 -r grep -Pil -- ) - Parameter: \"\" is  to: \"// /}\"\n    correctly  to: \"// /}\"\n     the file: \"\" - Parameter: \"\" is not   an included file \    *** Note: \"\" May be   a file that%s\n(%s* - Parameter: \"\" is not   file \"\"%s\n%s\n%s\n