# Ensure chrony is running as user _chrony

Necessity: Running network-facing services like chrony with a dedicated, unprivileged user account is a critical security measure based on the Principle of Least Privilege. If the chrony daemon were compromised while running as root, an attacker could gain complete control over the system. By running it as the `_chrony` user, which has minimal permissions, any potential damage from a compromise is significantly contained. Misconfiguration leaves the system vulnerable to privilege escalation attacks. Auditing and Remediation: The audit script verifies the user configuration by parsing the `/etc/sysconfig/chronyd` file, specifically checking the `-u` option within the `OPTIONS` variable. The remediation script directly modifies this file to enforce that the chrony daemon is configured to run as the specified user, ensuring it starts with the correct limited privileges. Recommended State Rationale: The recommended user for all levels (Basic, Moderate, and Strict) is `_chrony`. This is the default, purpose-built, and least-privileged user for the chrony service on CentOS systems. There is no more secure or appropriate user for this service. Using `root` is a severe security risk, and using any other user offers no additional security benefit while potentially introducing permission issues. Therefore, adhering to the standard `_chrony` user is the best practice for all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['_chrony']` |
| **Moderate** | `['_chrony']` |
| **Strict** | `['_chrony']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/sysconfig/chronyd` file. The script must parse the `OPTIONS` variable to find the user specified by the `-u` flag and output only the username. If the `-u` flag is not present, it should return an empty string.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired username. The script must modify the `OPTIONS` variable in the `/etc/sysconfig/chronyd` file to set the user with the `-u` flag to the provided argument. It should add the flag if it does not already exist. The script must output `true` on successful modification and `false` on failure.

