TMAegis
Plus de règles pour linux

TMA-ROCKY8-2.3.2

Ensure chrony is configured

MoyenneNiveau 1Automatiséelinux

Description

• server o The server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server’s system time will never be influenced by that of a client. o This directive can be used multiple times to specify multiple servers. o The directive is immediately followed by either the name of the server, or its IP address. • pool o The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rathe

Méthode de vérification

Méthode d'audit: Commande shell

shell
alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_output=() a_output2=() a_config_files=("/etc/chrony.conf")
   l_include='"'"'(confdir|sourcedir)'"'"' l_parameter_name='"'"'(server|pool)'"'"' l_parameter_value='"'"'.+'"'"'
   while IFS= read -r l_conf_loc; do
      l_dir="" l_ext=""
      if [ -d "$l_conf_loc" ]; then
         l_dir="$l_conf_loc" l_ext="*"
      elif  grep -Psq '"'"'\/\*\.([^#/\n\r]+)?\h*$'"'"' <<< "$l_conf_loc" || [ -f "$(readlink -f "$l_conf_loc")" ]; then
         l_dir="$(dirname "$l_conf_loc")" l_ext="$(basename "$l_conf_loc")"
      fi
      if [[ -n "$l_dir" && -n "$l_ext" ]]; then
         while IFS= read -r -d $'"'"'\0'"'"' l_file_name; do
            [ -f "$(readlink -f "$l_file_name")" ] && a_config_files+=("$(readlink -f "$l_file_name")")
         done < <(find -L "$l_dir" -type f -name "$l_ext" -print0 2>/dev/null)
      fi
   done < <(awk '"'"'$1~/^\s*'"'"'"$l_include"'"'"'$/{print $2}'"'"' "${a_config_files[*]}" 2>/dev/null)
   for l_file in "${a_config_files[@]}"; do
      l_parameter_line="$(grep -Psi '"'"'^\h*'"'"'"$l_parameter_name"'"'"'(\h+|\h*:\h*)'"'"'"$l_parameter_value"'"'"'\b'"'"' "$l_file")"
      [ -n "$l_parameter_line" ] && a_output+=("  - Parameter: \"$(tr -d '"'"'()'"'"' <<< ${l_parameter_name//|/ or })\"" \
      "    Exists in the file: \"$l_file\" as:" "$l_parameter_line")
   done
   [ "${#a_output[@]}" -le "0" ] && a_output2+=("  - Parameter: \"$(tr -d '"'"'()'"'"' <<< ${l_parameter_name//|/ or })\"" \
   "    Does not exist in the chrony configuration")
   if [ "${#a_output2[@]}" -le 0 ]; then
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** PASS **" "${a_output[@]}" ""
   else
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** FAIL **" " - Reason(s) for audit failure:" "${a_output2[@]}"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi
Sortie attendue
compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Edit /etc/chrony.conf or a file ending in .sources in /etc/sources.d/ and add or edit server or pool lines as appropriate according to local site policy: Edit the Chrony configuration and add or edit the server and/or pool lines returned by the Audit Procedure as appropriate according to local site policy <[server|pool]> <[remote-server|remote-pool]> Example script to add a drop-in configuration for the pool directive: #!/usr/bin/env bash { [ ! -d "/etc/sources.d/" ] && mkdir /etc/sources.d/ printf '%s\n' "" "#The maxsources option is unique to the pool directive" \ "pool time.nist.gov iburst maxsources 4" >> /etc/sources.d/60- sources.sources chronyc reload sources &>/dev/null } Example scr…

Propriétés

Systèmes d'exploitation
rocky-8
Étiquettes
cis-convertedlinux
Référence
CIS Rocky Linux 8 Benchmark v3.0.0 - 2.3.2

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell
tmaegis scan --target linux