{"description": "<tt>Chrony</tt> is a daemon which implements the Network Time Protocol (NTP). It is designed\nto synchronize system clocks across a variety of systems and use a source that is highly\naccurate. More information on <tt>chrony</tt> can be found at\n\n    <a xmlns='http://www.w3.org/1999/xhtml' href='https://chrony-project.org/'>https://chrony-project.org/</a>.\n<tt>Chrony</tt> can be configured to be a client and/or a server.\nAdd or edit server or pool lines to <tt>/etc/chrony/chrony.conf</tt> as appropriate:\n<pre>server &lt;remote-server&gt;</pre>\nAlternatively, server or pool directives can be specified in files included via\n<tt>sourcedir</tt> or <tt>confdir</tt> directives in <tt>/etc/chrony/chrony.conf</tt>.\nWhen using <tt>sourcedir</tt>, create <tt>.sources</tt> files in the specified directory:\n<pre># In /etc/chrony/chrony.conf:\nsourcedir /etc/chrony/sources.d\n\n# In /etc/chrony/sources.d/ntp.sources:\nserver 0.pool.ntp.org</pre>\nWhen using <tt>confdir</tt>, create <tt>.conf</tt> files in the specified directory:\n<pre># In /etc/chrony/chrony.conf:\nconfdir /etc/chrony/conf.d\n\n# In /etc/chrony/conf.d/ntp-servers.conf:\npool 1.pool.ntp.org</pre>\nMultiple servers may be configured.", "rationale": "If <tt>chrony</tt> is in use on the system proper configuration is vital to ensuring time\nsynchronization is working properly.", "severity": "medium", "references": {"nist": ["CM-6(a)", "AU-8(1)(a)"], "pcidss": ["Req-10.4.3"], "srg": ["SRG-OS-000355-GPOS-00143"], "anssi": ["R71"], "ism": ["0988", "1405"], "pcidss4": ["10.6.2", "10.6"]}, "control_references": {"anssi": ["R71"], "ism": ["0988", "1405"], "pcidss4": ["10.6.2", "10.6"]}, "components": [], "identifiers": {}, "ocil_clause": "a remote time server is not configured", "ocil": "Verify that a remote time server is configured. First, check the main configuration file:\n<pre># grep -E \"^(server|pool)\" /etc/chrony/chrony.conf</pre>\nIf no server or pool directive is found, check for sourcedir or confdir directives:\n<pre># grep -E \"^(sourcedir|confdir)\" /etc/chrony/chrony.conf</pre>\nFor each sourcedir found, check <tt>.sources</tt> files in that directory:\n<pre># grep -E \"^(server|pool)\" /path/to/sourcedir/*.sources</pre>\nFor each confdir found, check <tt>.conf</tt> files in that directory:\n<pre># grep -E \"^(server|pool)\" /path/to/confdir/*.conf</pre>\nAt least one server or pool directive must be present in the main configuration file\nor in files within directories specified by sourcedir or confdir directives.", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": "package[chrony]", "platforms": ["package[chrony]"], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": ["package_chrony"], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "A remote time server for Chrony is configured", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/ntp/chronyd_specify_remote_server/rule.yml", "template": null}