# Ensure systemd-timesyncd is enabled and running

Necessity: Accurate time synchronization is a fundamental requirement for secure and reliable system operation. The 'systemd-timesyncd' service ensures the system clock is consistently synchronized with a trusted Network Time Protocol (NTP) server. Misconfigured or unsynchronized time can lead to severe issues, including failed cryptographic operations, certificate validation errors, inaccurate log timestamps that render forensic analysis impossible, and vulnerabilities in time-sensitive authentication protocols like Kerberos. Maintaining synchronized time is critical for correlating events across a network and ensuring the integrity of security controls.

Auditing and Remediation: The audit script verifies the current state of the 'systemd-timesyncd' service, checking if it is both enabled to start at boot and currently active (running). The remediation script corrects any misconfiguration by unmasking the service if necessary, enabling it to start automatically on boot, and then starting it immediately to ensure the system's time is synchronized.

Recommended State Rationale: For this control, the recommended state is 'Enabled and Active' across all security levels (Basic, Moderate, and Strict). Time synchronization is a binary control; it is either correctly functioning or it is not. There is no intermediate state that provides partial security. Any state other than 'Enabled and Active' introduces significant operational and security risks. Therefore, the most basic level of security requires the service to be running, and this remains the strictest possible configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled and Active']` |
| **Moderate** | `['Enabled and Active']` |
| **Strict** | `['Enabled and Active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'systemd-timesyncd' service. The script must return a single string value representing the combined status: 'Enabled and Active', 'Enabled but Inactive', 'Disabled', or 'Not Found'. The output must not contain any other text or formatting.

## Remediation Script Working

Bash script that accepts a single string argument, which must be 'Enabled and Active'. The script should perform the necessary actions to unmask, enable, and start the 'systemd-timesyncd' service. The script must return 'true' upon successful configuration or 'false' if it fails.

