Ensure chrony is configured

OrtaDüzey 1Otomatikbottlerocket

Açıklama

chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. The audit runs apiclient get settings.ntp.time-servers (at least one server) and systemctl is-active chronyd (active). Run tmaegis on the host through the admin container root shell (sudo sheltie).

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(apiclient get settings.ntp.time-servers 2>/dev/null) || exit 1
printf '%s' "$out" | tr -d ' \n' | grep -Eq '"time-servers":\["[^"]+' || { echo 'no NTP time-servers configured'; exit 1; }
s=$(systemctl is-active chronyd 2>/dev/null)
[ "$s" = active ] && echo compliant || echo "chronyd: ${s:-unknown}"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Configure additional time servers as needed. The following command would add "2.pool.ntp.org" to the list of time servers. # apiclient apply <<EOF [settings.ntp] time-servers = [ "2.pool.ntp.org" ] EOF If chrony is not running, update to a version of the OS with the correct service configuration.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: bottlerocketservices
Referans: CIS Bottlerocket Benchmark v1.0.0 - 2.1.1.1 Ensure chrony is configured

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target bottlerocket