Configure ntpd To Run As ntp User

An XCCDF Rule

Description

ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to synchronize system clocks across a variety of systems and use a source that is highly accurate. More information on NTP can be found at http://www.ntp.org. ntp can be configured to be a client and/or a server. To ensure that ntpd is running as ntp user, Add or edit the OPTIONS variable in /etc/sysconfig/ntpd to include ' -u ntp:ntp ':

OPTIONS="-u ntp:ntp"

This recommendation only applies if ntp is in use on the system.

Rationale

If ntp is in use on the system proper configuration is vital to ensuring time synchronization is working properly. Running ntpd under dedicated user accounts limits the attack surface for potential attacker exploiting security flaws in the daemon or the protocol.

ID: xccdf_org.ssgproject.content_rule_ntpd_run_as_ntp_user
Severity: Medium
Updated: about 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - configure_strategy
  - low_complexity  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ntpd_run_as_ntp_user

- name: Detect if file is not empty or missing
  find:
    path: /etc/sysconfig/
    patterns: ntpd
    contains: ^([\s]*OPTIONS=["]?[^"]*)("?)
  register: ntpd_file
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"ntp" in ansible_facts.packages'
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ntpd_run_as_ntp_user

- name: Replace existing setting or create a new file, rest is handled by different
    task
  lineinfile:
    path: /etc/sysconfig/ntpd
    regexp: ^([\s]*OPTIONS=["]?[^"]*)("?)
    line: \1 -u ntp:ntp\2
    state: present
    create: true
    backrefs: true
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"ntp" in ansible_facts.packages'
  - ntpd_file.matched > 0
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ntpd_run_as_ntp_user

- name: Put line into file, assume file was empty
  lineinfile:
    path: /etc/sysconfig/ntpd
    line: OPTIONS="-u ntp:ntp"
    state: present
    create: true
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"ntp" in ansible_facts.packages'
  - ntpd_file.matched == 0
  tags:
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - ntpd_run_as_ntp_user

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q ntp; }; then

if grep -q 'OPTIONS=.*' /etc/sysconfig/ntpd; then
	# trying to solve cases where the parameter after OPTIONS
	#may or may not be enclosed in quotes	sed -i -E 's/^([\s]*OPTIONS=["]?[^"]*)("?)/\1 -u ntp:ntp\2/' /etc/sysconfig/ntpd
else
	echo 'OPTIONS="-u ntp:ntp"' >> /etc/sysconfig/ntpd
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Configure ntpd To Run As ntp User

Description

Rationale

Remediation - Ansible

Remediation - Shell Script