2.2.1.2 Ensure systemd-timesyncd is configured

Information

systemd-timesyncd is a daemon that has been added for synchronizing the system clock across the network.

The systemd-timesyncd daemon:

- Implements an SNTP client.
- Only implements a client side
- Does not bother with the full NTP complexity
- Only on querys time from one remote server, synchronizing the local clock to it

- runs with minimal privileges
- saves the current clock to disk every time a new NTP sync has been acquired
- Uses this to correct the system clock early at bootup
- to make sure that time monotonically progresses on these systems, even if it is not always correct

- Requires a new system user and group "systemd-timesync" to be created on installation of systemd
- Hooked up with networkd to only operate when network connectivity is available

Notes:

-

The systemd-timesyncd service specifically implements only SNTP. This minimalistic service will set the system clock for large offsets or slowly adjust it for smaller deltas. More complex use cases are not covered by systemd-timesyncd.

-

This recommendation only applies if timesyncd is in use on the system

Proper configuration is vital to ensuring time synchronization is working properly.

Solution

Edit the file /etc/systemd/timesyncd.conf and add/modify the following lines:

NTP=0.suse.pool.ntp.org 1.suse.pool.ntp.org #Servers listed should be In Accordance With Local Policy

FallbackNTP=2.suse.pool.ntp.org 3.suse.pool.ntp.org #Servers listed should be In Accordance With Local Policy

RootDistanceMax=1 #should be In Accordance With Local Policy

Run the following commands to enable and start systemd-timesyncd :

# systemctl --now enable systemd-timesyncd.service

# timedatectl set-ntp true

See Also

https://workbench.cisecurity.org/files/3682

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-7, 800-53|AU-8, CSCv7|6.1

Plugin: Unix

Control ID: 2fa6735e159e23f31ecab5af97b42db406c33058e1f8022b73a3bc24356c67dd