Ensure chrony is configured

MittelStufe 1Automatisiertbottlerocket

Beschreibung

chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. The audit runs apiclient get settings.ntp.time-servers (at least one server) and systemctl is-active chronyd (active). Run tmaegis on the host through the admin container root shell (sudo sheltie).

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(apiclient get settings.ntp.time-servers 2>/dev/null) || exit 1
printf '%s' "$out" | tr -d ' \n' | grep -Eq '"time-servers":\["[^"]+' || { echo 'no NTP time-servers configured'; exit 1; }
s=$(systemctl is-active chronyd 2>/dev/null)
[ "$s" = active ] && echo compliant || echo "chronyd: ${s:-unknown}"

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Configure additional time servers as needed. The following command would add "2.pool.ntp.org" to the list of time servers. # apiclient apply <<EOF [settings.ntp] time-servers = [ "2.pool.ntp.org" ] EOF If chrony is not running, update to a version of the OS with the correct service configuration.

Eigenschaften

Betriebssysteme: Beliebig
Tags: bottlerocketservices
Referenz: CIS Bottlerocket Benchmark v1.0.0 - 2.1.1.1 Ensure chrony is configured

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target bottlerocket