Ensure that chronyd is running under chrony user account

An XCCDF Rule

Description

chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on chrony can be found at http://chrony.tuxfamily.org/. Chrony can be configured to be a client and/or a server. To ensure that chronyd is running under chrony user account, remove any -u ... option from OPTIONS other than -u chrony, as chrony is run under its own user by default. This recommendation only applies if chrony is in use on the system.

Rationale

If chrony is in use on the system proper configuration is vital to ensuring time synchronization is working properly.

ID: xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user
Severity: Medium
References: CCE-82878-0

10.6.3

2.1.3
Updated: about 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-82878-0
  - PCI-DSSv4-10.6.3  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Detect if file /etc/sysconfig/chronyd is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: chronyd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: chronyd_file
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"chrony" in ansible_facts.packages'
  tags:
  - CCE-82878-0
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Remove any previous configuration of user used to run chronyd process
  replace:
    path: /etc/sysconfig/chronyd
    regexp: \s*-u\s*\w+\s*
    replace: ' '
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"chrony" in ansible_facts.packages'
  - chronyd_file is defined and chronyd_file.matched > 0
  tags:
  - CCE-82878-0
  - PCI-DSSv4-10.6.3
  - chronyd_run_as_chrony_user
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q chrony; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes	sed -i -E -e 's/\s*-u\s*\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1\2/' /etc/sysconfig/chronyd
fi

if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes
	sed -i -E -e 's/\s*-u\s*\w+\s*/ /' -e 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u chrony\2/' /etc/sysconfig/chronyd
else
	echo 'OPTIONS="-u chrony"' >> /etc/sysconfig/chronyd
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure that chronyd is running under chrony user account

Description

Rationale

Remediation - Ansible

Remediation - Shell Script