# Ensure chrony is enabled and running

Accurate timekeeping is a critical component of system security and operational integrity. The Network Time Protocol (NTP), implemented by the chrony service, synchronizes the system clock with a reliable time source. This is necessary for accurate timestamping in logs, which is essential for security audits, forensic analysis, and event correlation. It is also a prerequisite for many authentication protocols like Kerberos, which rely on time synchronization to prevent replay attacks. Misconfiguration can lead to certificate validation failures, failed authentications, and unreliable logs, severely hampering security incident response. The audit script verifies that the chrony package is installed and that the service is both enabled to start at boot and currently running. The remediation script installs, enables, and starts the chrony service to enforce correct time synchronization. The recommended state for all levels (Basic, Moderate, and Strict) is 'Enabled' because time synchronization is a foundational requirement, not a granular setting. Any production system, regardless of its hardening level, must have an active and correctly configured time service.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'chrony' service. The script must first determine if the 'chrony' package is installed. If it is not, the script must return only the string 'Not Installed'. If the package is installed, the script must then check if the service is both enabled (to start on boot) and currently active. If both conditions are met, it must return only the string 'Enabled'. Otherwise, it must return only the string 'Disabled'. The output must not contain any extra text or formatting.

## Remediation Script Working

Bash script that accepts one positional command-line argument for the desired state. If the argument is 'Enabled', the script must ensure the 'chrony' package is installed, then enable and start the service. The script must return the boolean value 'true' upon successful completion of all actions, and 'false' if any part of the process fails.

