Detections
Analytics

2.1.1.2 Ensure systemd-timesyncd is configured - FallbackNTP

Information

systemd-timesyncd is a daemon that has been added for synchronizing the system clock across the network. It implements an SNTP client. In contrast to NTP implementations such as chrony or the NTP reference server this only implements a client side, and does not bother with the full NTP complexity, focusing only on querying time from one remote server and synchronizing the local clock to it. The daemon runs with minimal privileges, and has been hooked up with networkd to only operate when network connectivity is available. The daemon saves the current clock to disk every time a new NTP sync has been acquired, and uses this to possibly correct the system clock early at bootup, in order to accommodate for systems that lack an RTC such as the Raspberry Pi and embedded devices, and make sure that time monotonically progresses on these systems, even if it is not always correct. To make use of this daemon a new system user and group 'systemd-timesync' needs to be created on installation of systemd.

 Notes:

 If chrony or ntp are used, systemd-timesyncd should be stopped and masked, and this section skipped

 This recommendation only applies if timesyncd is in use on the system

 Only one time synchronization method should be in use on the system

 Rationale:

 Proper configuration is vital to ensuring time synchronization is working properly.

Solution

Remove additional time synchronization methods:

 Run the following commands to remove ntp and chrony:

 # apt purge ntp
 # apt purge chrony

 Configure systemd-timesyncd:

 Run the following command to enable systemd-timesyncd

 # systemctl enable systemd-timesyncd.service

 Edit the file /etc/systemd/timesyncd.conf and add/modify the following lines:

 NTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org #Servers listed should be In Accordence With Local Policy

 FallbackNTP=2.debian.pool.ntp.org 3.debian.pool.ntp.org #Servers listed should be In Accordence With Local Policy

 RootDistanceMax=1 #should be In Accordence With Local Policy

 Run the following commands to start systemd-timesyncd.service

 # systemctl start systemd-timesyncd.service

 # timedatectl set-ntp true

 Additional Information:

 The systemd-timesyncd service specifically implements only SNTP. This minimalistic service will set the system clock for large offsets or slowly adjust it for smaller deltas. More complex use cases are not covered by systemd-timesyncd

See Also

https://workbench.cisecurity.org/files/3219

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-8, CSCv7|6.1

Plugin: Unix

Control ID: 9f34603b70b2d0f156cbd1739e011011b952433486be9e4971ae9d16d9bd83c9