cis-ubuntu2004-v300-2-3-3-1

name	cis-ubuntu2004-v300-2-3-3-1
description	Ensure chrony is configured with authorized timeserver
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","time-sync","chrony"]
cis_id	2.3.3.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure chrony is configured with authorized timeserver

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

server

• The server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server's system time will never be influenced by that of a client.
• This directive can be used multiple times to specify multiple servers.
• The directive is immediately followed by either the name of the server, or its IP address.

pool

• The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rather than a single NTP server. The pool name is expected to resolve to multiple addresses which might change over time.
• This directive can be used multiple times to specify multiple pools.
• All options valid in the server directive can be used in this directive too.

Rationale

Time synchronization is important to support time sensitive security mechanisms and to ensure log files have consistent time records across the enterprise to aid in forensic investigations

Audit

• IF - chrony is in use on the system, run the following script to ensure chrony is configured with an authorized timeserver:

Command Line

#!/usr/bin/env bash
{
  a_config_files=("/etc/chrony/chrony.conf" "/etc/chrony/sources.d/*.sources")
  l_include="$(confdirsubdired|y' | parameter_name='(server|pool)' l_parameter_value='.+'
  while IFS= read -r l_conf_loc; do
    l_dir="$(dirname "$l_conf_loc")"
    l_ext="$(basename "$l_conf_loc")"
    if [ -d "$l_dir" ] && [ -n "$l_ext" ]; then
      while IFS= read -r l_file_name; do
        { -f "$(readlink -f "$l_file_name")^\h* ); 
           IFS=  -r l_conf_line l_parameter_value; 
             grep -Pq --  <<<  ]; 
              a_out2+=( )
            
           < <(grep -Po --   || printf0 >>/dev/null)
        
         < <(llawk )
       <<< [@]
    
       < <($(awk  ))
    
  
   [  -le 0 ];