1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
<def-group>
<definition class="compliance" id="chronyd_specify_remote_server" version="1">
{{{ oval_metadata("A remote NTP Server for time synchronization should be
specified (and dependencies are met)", rule_title=rule_title) }}}
<criteria comment="chrony.conf conditions are met">
<criterion test_ref="test_chronyd_remote_server" />
</criteria>
</definition>
<ind:variable_test check="all" check_existence="at_least_one_exists"
comment="tests the server hostnames in the chronyd configuration"
id="test_chronyd_remote_server" version="1">
<ind:object object_ref="obj_chronyd_config_servers_var" />
<ind:state state_ref="ste_chronyd_allowed_servers" />
</ind:variable_test>
<ind:variable_object id="obj_chronyd_config_servers_var" version="1">
<ind:var_ref>var_chronyd_config_servers</ind:var_ref>
</ind:variable_object>
<local_variable id="var_chronyd_config_servers" datatype="string" version="1" comment="Chronyd server hostnames">
<object_component item_field="subexpression" object_ref="obj_chronyd_config_servers" />
</local_variable>
<ind:textfilecontent54_object comment="Grep all server hostnames from chrony configs"
id="obj_chronyd_config_servers" version="1">
<ind:filepath operation="pattern match">^({{{ chrony_conf_path }}}|{{{ chrony_d_path }}}.+\.conf)$</ind:filepath>
<ind:pattern operation="pattern match">^\s*server\s+(\S+)\b.*$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int" >1</ind:instance>
</ind:textfilecontent54_object>
<ind:variable_state comment="allowed chronyd server hostnames" id="ste_chronyd_allowed_servers" version="1">
<ind:value operation="equals" datatype="string" var_ref="var_chronyd_allowed_servers" var_check="at least one" />
</ind:variable_state>
<local_variable id="var_chronyd_allowed_servers" datatype="string" version="1" comment="Allowed time servers split on comma">
<split delimiter=",">
<variable_component var_ref="var_multiple_time_servers" />
</split>
</local_variable>
<external_variable comment="Allowed time servers" datatype="string" id="var_multiple_time_servers" version="1" />
</def-group>
|
