TMA-ROCKY8-2.3.2
Ensure chrony is configured
Description
• server o The server directive specifies an NTP server which can be used as a time source. The client-server relationship is strictly hierarchical: a client might synchronize its system time to that of the server, but the server’s system time will never be influenced by that of a client. o This directive can be used multiple times to specify multiple servers. o The directive is immediately followed by either the name of the server, or its IP address. • pool o The syntax of this directive is similar to that for the server directive, except that it is used to specify a pool of NTP servers rathe
Méthode de vérification
Méthode d'audit: Commande shell
alt0() { o=$(bash -c '#!/usr/bin/env bash
{
a_output=() a_output2=() a_config_files=("/etc/chrony.conf")
l_include='"'"'(confdir|sourcedir)'"'"' l_parameter_name='"'"'(server|pool)'"'"' l_parameter_value='"'"'.+'"'"'
while IFS= read -r l_conf_loc; do
l_dir="" l_ext=""
if [ -d "$l_conf_loc" ]; then
l_dir="$l_conf_loc" l_ext="*"
elif grep -Psq '"'"'\/\*\.([^#/\n\r]+)?\h*$'"'"' <<< "$l_conf_loc" || [ -f "$(readlink -f "$l_conf_loc")" ]; then
l_dir="$(dirname "$l_conf_loc")" l_ext="$(basename "$l_conf_loc")"
fi
if [[ -n "$l_dir" && -n "$l_ext" ]]; then
while IFS= read -r -d $'"'"'\0'"'"' l_file_name; do
[ -f "$(readlink -f "$l_file_name")" ] && a_config_files+=("$(readlink -f "$l_file_name")")
done < <(find -L "$l_dir" -type f -name "$l_ext" -print0 2>/dev/null)
fi
done < <(awk '"'"'$1~/^\s*'"'"'"$l_include"'"'"'$/{print $2}'"'"' "${a_config_files[*]}" 2>/dev/null)
for l_file in "${a_config_files[@]}"; do
l_parameter_line="$(grep -Psi '"'"'^\h*'"'"'"$l_parameter_name"'"'"'(\h+|\h*:\h*)'"'"'"$l_parameter_value"'"'"'\b'"'"' "$l_file")"
[ -n "$l_parameter_line" ] && a_output+=(" - Parameter: \"$(tr -d '"'"'()'"'"' <<< ${l_parameter_name//|/ or })\"" \
" Exists in the file: \"$l_file\" as:" "$l_parameter_line")
done
[ "${#a_output[@]}" -le "0" ] && a_output2+=(" - Parameter: \"$(tr -d '"'"'()'"'"' <<< ${l_parameter_name//|/ or })\"" \
" Does not exist in the chrony configuration")
if [ "${#a_output2[@]}" -le 0 ]; then
printf '"'"'%s\n'"'"' "" "- Audit Result:" " ** PASS **" "${a_output[@]}" ""
else
printf '"'"'%s\n'"'"' "" "- Audit Result:" " ** FAIL **" " - Reason(s) for audit failure:" "${a_output2[@]}"
fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi- Sortie attendue
compliant
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Edit /etc/chrony.conf or a file ending in .sources in /etc/sources.d/ and add or edit server or pool lines as appropriate according to local site policy: Edit the Chrony configuration and add or edit the server and/or pool lines returned by the Audit Procedure as appropriate according to local site policy <[server|pool]> <[remote-server|remote-pool]> Example script to add a drop-in configuration for the pool directive: #!/usr/bin/env bash { [ ! -d "/etc/sources.d/" ] && mkdir /etc/sources.d/ printf '%s\n' "" "#The maxsources option is unique to the pool directive" \ "pool time.nist.gov iburst maxsources 4" >> /etc/sources.d/60- sources.sources chronyc reload sources &>/dev/null } Example scr…
Propriétés
- Systèmes d'exploitation
- rocky-8
- Étiquettes
- cis-convertedlinux
- Référence
- CIS Rocky Linux 8 Benchmark v3.0.0 - 2.3.2
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
tmaegis scan --target linux