Remove the systemd_timesyncd Service
An XCCDF Rule
Description
The systemd_timesyncd service should not be installed.
Rationale
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
- ID
- xccdf_org.ssgproject.content_rule_package_timesyncd_removed
- Severity
- Low
- References
- Updated
Remediation - Puppet
include remove_systemd-timesyncd
class remove_systemd-timesyncd {
package { 'systemd-timesyncd':
ensure => 'purged',
}
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- DISA-STIG-UBTU-22-215020
- disable_strategy
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed; then
# CAUTION: This remediation script will remove systemd-timesyncd
# from the system, and may remove any packages