1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
documentation_complete: true
prodtype: alinux2,fedora,rhel7,sle12
title: 'Configure ntpd To Run As ntp User'
description: |-
ntp is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on NTP can be found at
{{{ weblink(link="http://www.ntp.org")}}}.
ntp can be configured to be a client and/or a server.
To ensure that ntpd is running as ntp user, Add or edit the
<tt>OPTIONS</tt> variable in <tt>/etc/sysconfig/ntpd</tt> to include ' -u ntp:ntp ':
<pre>OPTIONS="-u ntp:ntp"</pre>
This recommendation only applies if ntp is in use on the system.
rationale: |-
If ntp is in use on the system proper configuration is vital to ensuring time synchronization
is working properly. Running ntpd under dedicated user accounts limits the attack surface for
potential attacker exploiting security flaws in the daemon or the protocol.
severity: medium
platform: ntp
references:
cis@alinux2: 2.1.1.2
cis@rhel7: 2.2.1.3
cis@sle12: 2.2.1.4
identifiers:
cce@rhel7: CCE-84295-5
ocil_clause: 'ntpd is not running under ntp user account'
ocil: |-
To verify that <tt>ntpd</tt> is configured to correctly run under the <tt>ntp</tt> user,
run the following commands:
<pre>$ sudo grep "^OPTIONS" /etc/sysconfig/ntpd</pre>
The output should contain
<pre>OPTIONS="-u ntp:ntp"</pre>
<pre>$ sudo grep "^ExecStart" /usr/lib/systemd/system/ntpd.service</pre>
The output should contain
<pre>ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS</pre>
|
