{"description": "ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to\nsynchronize system clocks across a variety of systems and use a source that is highly\naccurate. More information on NTP can be found at\n\n    <a xmlns='http://www.w3.org/1999/xhtml' href='http://www.ntp.org'>http://www.ntp.org</a>.\nntp can be configured to be a client and/or a server.\nTo ensure that ntpd is running as ntp user, Add or edit the\n<tt>OPTIONS</tt> variable in <tt>/etc/sysconfig/ntpd</tt> to include ' -u ntp:ntp ':\n<pre>OPTIONS=\"-u ntp:ntp\"</pre>\nThis recommendation only applies if ntp is in use on the system.", "rationale": "If ntp is in use on the system proper configuration is vital to ensuring time synchronization\nis working properly. Running ntpd under dedicated user accounts limits the attack surface for\npotential attacker exploiting security flaws in the daemon or the protocol.", "severity": "medium", "references": {}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "ntpd is not running under ntp user account", "ocil": "To verify that <tt>ntpd</tt> is configured to correctly run under the <tt>ntp</tt> user,\nrun the following commands:\n<pre>$ sudo grep \"^OPTIONS\" /etc/sysconfig/ntpd</pre>\nThe output should contain\n<pre>OPTIONS=\"-u ntp:ntp\"</pre>\n<pre>$ sudo grep \"^ExecStart\" /usr/lib/systemd/system/ntpd.service</pre>\nThe output should contain\n<pre>ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS</pre>", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": "package[ntp]", "platforms": ["package[ntp]"], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": ["package_ntp"], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Configure ntpd To Run As ntp User", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/ntp/ntpd_run_as_ntp_user/rule.yml", "template": null}