# Ensure systemd-timesyncd is enabled and running

Necessity: Accurate time synchronization is critical for system security and stability. Without it, log correlation for forensic analysis and security incident response becomes unreliable or impossible. Authentication protocols like Kerberos, which are time-sensitive, can fail, leading to service disruptions. Furthermore, cryptographic operations and certificate validation often depend on accurate system time, and discrepancies can cause security features to fail. Misconfiguration poses a significant risk of leaving the system vulnerable to replay attacks and making it difficult to trace security breaches.

Auditing and Remediation: The audit script verifies the status of the 'systemd-timesyncd' service by checking if it is both set to start automatically on boot ('enabled') and currently operational ('active'). The remediation script corrects any deviation from the desired state by using systemd's native 'systemctl' command to enable and start the service, ensuring it is both running immediately and persists across reboots.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'enabled_and_running'. This control is binary; the time service is either functioning correctly or it is not. There is no middle ground or less secure but acceptable state. A system's time must be continuously and accurately synchronized to maintain security and operational integrity. Therefore, the only acceptable configuration is to have the service fully enabled and active.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled_and_running']` |
| **Moderate** | `['enabled_and_running']` |
| **Strict** | `['enabled_and_running']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'systemd-timesyncd' service. The script should determine if the service is enabled (starts on boot) and if it is active (currently running). The script must output a single string representing this combined state. The output must be one of the following: 'enabled_and_running', 'enabled_not_running', 'disabled_running', or 'disabled_not_running'. The output must contain only this string value, with no additional text or formatting.

## Remediation Script Working

Bash script that takes a single positional command-line argument to configure the 'systemd-timesyncd' service. If the argument is 'enabled_and_running', the script must both enable and start the service, for example by using 'systemctl enable --now systemd-timesyncd'. The script must return the string 'true' upon successful execution and 'false' if the operation fails.

