# Ensure systemd-timesyncd configured with authorized timeserver

Accurate time synchronization is critical for network security and system integrity. It ensures that log files have consistent timestamps across all systems, which is essential for forensic analysis, intrusion detection, and correlating events. Time-sensitive authentication protocols like Kerberos depend on synchronized clocks to prevent replay attacks. Misconfigured time can also lead to issues with certificate validation and cryptographic operations. The audit script verifies the configured NTP servers in `/etc/systemd/timesyncd.conf` by reading the value of the `NTP` or `FallbackNTP` directive. The remediation script modifies this file to set the `NTP` directive to a list of authorized servers provided as an argument and restarts the service. The Basic state uses the default CentOS public pool, which is sufficient for general use. The Moderate state recommends using highly reliable public servers from major providers like Google or Cloudflare for better availability. The Strict state, representing the highest level of security, mandates using internal, trusted NTP servers. This isolates the system from public time sources, which could be subject to manipulation (e.g., man-in-the-middle attacks), and is often a requirement for compliance frameworks like PCI-DSS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0.centos.pool.ntp.org 1.centos.pool.ntp.org 2.centos.pool.ntp.org 3.centos.pool.ntp.org']` |
| **Moderate** | `['time.google.com time.cloudflare.com']` |
| **Strict** | `['<internal_ntp_server_1> <internal_ntp_server_2>']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the `/etc/systemd/timesyncd.conf` file. The script must find the line starting with `NTP=` or `FallbackNTP=`, extract the configured time server(s), and print them as a single space-separated string. The output must contain only this string value and nothing else.

## Remediation Script Working

bash script that takes a single string argument containing a space-separated list of authorized time servers. The script should modify the `/etc/systemd/timesyncd.conf` file by setting the `NTP` parameter to the provided value. If the `NTP=` line does not exist, it should be added under the `[Time]` section. The script must then restart the `systemd-timesyncd` service to apply the changes. It must output `true` on successful completion and `false` on failure.

