Skip to content
ATO Pathways
  Log In

Verify Permissions On /etc/chrony.keys File

An XCCDF Rule

Description

To properly set the permissions of /etc/chrony.keys, run the command: 

$ sudo chmod 0600 /etc/chrony.keys

Rationale

Setting correct permissions on the /etc/chrony.keys file is important because this file hosts chrony cryptographic keys. Protection of this file is critical for system security. Assigning the correct mode ensures exclusive control of the chrony cryptographic keys.

ID
xccdf_org.ssgproject.content_rule_file_permissions_etc_chrony_keys
Severity
Medium
References
Updated



Remediation - Ansible

- name: Test for existence /etc/chrony.keys
  stat:
    path: /etc/chrony.keys
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:

Remediation - Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

chmod u-xs,g-xwrs,o-xwrt /etc/chrony.keys

else