2.1.1.1 Ensure a single time synchronization daemon is in use

Audit

On physical systems, and virtual systems where host based time synchronization is not available.

One of the three time synchronization daemons should be available; chrony, systemd-timesyncd, or ntp

Run the following script to verify that a single time synchronization daemon is available on the system:

#!/usr/bin/env bash
{
 output="" l_tsd="" l_sdtd="" chrony="" l_ntp=""
 dpkg-query -W chrony > /dev/null 2>&1 && l_chrony="y"
 dpkg-query -W ntp > /dev/null 2>&1 && l_ntp="y" || l_ntp=""
 systemctl list-units --all --type=service | grep -q 'systemdtimesyncd.service' && systemctl is-enabled systemd-timesyncd.service | grep -q 'enabled' && l_sdtd="y"
# ! systemctl is-enabled systemd-timesyncd.service | grep -q 'enabled' && l_nsdtd="y" || l_nsdtd=""
 if [[ "$l_chrony" = "y" && "$l_ntp" != "y" && "$l_sdtd" != "y" ]]; then
 l_tsd="chrony"
 output="$output\n- chrony is in use on the system"
 elif [[ "$l_chrony" != "y" && "$l_ntp" = "y" && "$l_sdtd" != "y" ]]; then
 l_tsd="ntp"
 output="$output\n- ntp is in use on the system"
 elif [[ "$l_chrony" != "y" && "$l_ntp" != "y" ]]; then
 if systemctl list-units --all --type=service | grep -q 'systemdtimesyncd.service' && systemctl is-enabled systemd-timesyncd.service | grep -Eq '(enabled|disabled|masked)'; then
 l_tsd="sdtd"
 output="$output\n- systemd-timesyncd is in use on the system"
 fi
 else
 [[ "$l_chrony" = "y" && "$l_ntp" = "y" ]] && output="$output\n- both chrony and ntp are in use on the system"
 [[ "$l_chrony" = "y" && "$l_sdtd" = "y" ]] && output="$output\n- both chrony and systemd-timesyncd are in use on the system"
 [[ "$l_ntp" = "y" && "$l_sdtd" = "y" ]] && output="$output\n- both ntp and systemd-timesyncd are in use on the system"
 fi
 if [ -n "$l_tsd" ]; then
 echo -e "\n- PASS:\n$output\n"
 else
 echo -e "\n- FAIL:\n$output\n"
 fi
}

NOTE: Follow the guidance in the subsection for the time synchronization daemon available on the system and skip the other two time synchronization daemon subsections.

Remediation

On physical systems, and virtual systems where host based time synchronization is not available.

Select one of the three time synchronization daemons; chrony (1), systemd-timesyncd (2), or ntp (3), and following the remediation procedure for the selected daemon.

Note: enabling more than one synchronization daemon could lead to unexpected or unreliable results:

1. chrony

Run the following command to install chrony:

# apt install chrony

Run the following commands to stop and mask the systemd-timesyncd daemon:

# systemctl stop systemd-timesyncd.service
# systemctl --now mask systemd-timesyncd.service

Run the following command to remove the ntp package:

# apt purge ntp

NOTE:

Subsection: Configure chrony should be followed

Subsections: Configure systemd-timesyncd and Configure ntp should be skipped

1. systemd-timesyncd

Run the following command to remove the chrony package:

# apt purge chrony

Run the following command to remove the ntp package:

# apt purge ntp

NOTE:

Subsection: Configure systemd-timesyncd should be followed

Subsections: Configure chrony and Configure ntp should be skipped

1. ntp

Run the following command to install ntp:

# apt install ntp

Run the following commands to stop and mask the systemd-timesyncd daemon:

# systemctl stop systemd-timesyncd.service
# systemctl --now mask systemd-timesyncd.service

Run the following command to remove the chrony package:

# apt purge chrony

NOTE:

Subsection: Configure ntp should be followed

Subsections: Configure chrony and Configure systemd-timesyncd should be skipped