cyberstrikeus 2.1.2.2 Ensure chrony is running as user _chrony (Automated)
Profile
- Level 1 - Server
- Level 1 - Workstation
Description
The chrony package is installed with a dedicated user account _chrony. This account is granted the access required by the chronyd service.
Rationale
The chronyd service should run with only the required privileges.
Audit Procedure
Command Line
IF chrony is in use on the system, run the following command to verify the chronyd service is being run as the _chrony user:
# ps -ef | awk '/[c]hronyd/ && $1!="_chrony") { print $1 }'
Nothing should be returned.
Expected Result
No output (empty result).
Remediation
Command Line
Add or edit the user line to /etc/chrony/chrony.conf or a file ending in .conf in /etc/chrony/conf.d/:
user _chrony
OR
If another time synchronization service is in use on the system, run the following command to remove chrony from the system:
# apt purge chrony
Default Value
user _chrony
References
- NIST SP 800-53 Rev. 5: AU-8
CIS Controls
- v8: 8.4 - Standardize Time Synchronization
- v7: 6.1 - Utilize Three Synchronized Time Sources