Enable systemd_timesyncd Service

An XCCDF Rule

Description

The systemd_timesyncd service can be enabled with the following command:

$ sudo systemctl enable systemd_timesyncd.service

Rationale

Enabling the systemd_timesyncd service ensures that this host uses the ntp protocol to fetch time data from a ntp server. Synchronizing time is essential for authentication services such as Kerberos, but it is also important for maintaining accurate logs and auditing possible security breaches.

Additional information on Ubuntu network time protocol is available at https://help.ubuntu.com/lts/serverguide/NTP.html.en.

ID: xccdf_org.ssgproject.content_rule_service_timesyncd_enabled
Severity: High
References: NT012(R03)

1 14 15 16 3 5 6

APO11.04 BAI03.05 DSS05.04 DSS05.07 MEA02.01

CCI-000160

4.3.3.3.9 4.3.3.5.8 4.3.4.4.7 4.4.2.1 4.4.2.2 4.4.2.4

SR 2.10 SR 2.11 SR 2.12 SR 2.8 SR 2.9

A.12.4.1 A.12.4.2 A.12.4.3 A.12.4.4 A.12.7.1

AU-8(1)(a) CM-6(a)

PR.PT-1

Req-10.4

10.6.1

2.2.1.2

CCE-91659-3
Updated: about 1 year ago


[customizations.services]
enabled = ["systemd-timesyncd"]

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-91659-3
  - NIST-800-53-AU-8(1)(a)  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4
  - PCI-DSSv4-10.6.1
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_timesyncd_enabled

- name: Enable service systemd-timesyncd
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable service systemd-timesyncd
    systemd:
      name: systemd-timesyncd
      enabled: 'yes'
      state: started
      masked: 'no'
    when:
    - '"systemd" in ansible_facts.packages'
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - ( not ( "chrony" in ansible_facts.packages ) and not ( "ntp" in ansible_facts.packages
    ) )
  tags:
  - CCE-91659-3
  - NIST-800-53-AU-8(1)(a)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.4
  - PCI-DSSv4-10.6.1
  - enable_strategy
  - high_severity
  - low_complexity
  - low_disruption
  - no_reboot_needed
  - service_timesyncd_enabled

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ( ! ( rpm --quiet -q chrony ) && ! ( rpm --quiet -q ntp ) ); }; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'systemd-timesyncd.service'
"$SYSTEMCTL_EXEC" start 'systemd-timesyncd.service'"$SYSTEMCTL_EXEC" enable 'systemd-timesyncd.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

include enable_systemd-timesyncd

class enable_systemd-timesyncd {
  service {'systemd-timesyncd':
    enable => true,
    ensure => 'running',  }
}

Enable systemd_timesyncd Service

Description

Rationale

Remediation - OS Build Blueprint

Remediation - Ansible

Remediation - Shell Script

Remediation - Puppet