Remove the ntp service
An XCCDF Rule
Description
The ntpd service should not be installed.
Rationale
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
- ID
- xccdf_org.ssgproject.content_rule_package_ntp_removed
- Severity
- Low
- References
- Updated
Remediation - Puppet
include remove_ntp
class remove_ntp {
package { 'ntp':
ensure => 'purged',
}
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- DISA-STIG-UBTU-22-215025
- disable_strategy
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed; then
# CAUTION: This remediation script will remove ntp
# from the system, and may remove any packages