# Ensure a single time synchronization daemon is in use

Necessity: Accurate time synchronization is critical for system security and operational integrity. It is essential for log file accuracy, which is vital for forensic analysis and intrusion detection. Many security protocols, such as Kerberos and TLS/SSL, depend on synchronized time to prevent replay attacks and validate certificates. Without proper time synchronization, authentication can fail, scheduled jobs can run at incorrect times, and correlating events across a network becomes impossible, significantly hindering security monitoring and incident response. Auditing and Remediation: The audit script determines which, if any, time synchronization daemon is configured to run on the system. It specifically checks for 'chronyd' and 'ntpd' to identify if the system has none, one, or multiple conflicting daemons enabled. The remediation script standardizes the system's time synchronization by disabling and masking one daemon while enabling and starting the other, based on the provided argument. This ensures a single, authoritative time service is active, preventing conflicts. Recommended State Rationale: The Basic, Moderate, and Strict recommendation is uniformly set to 'chrony'. In CentOS 7 and newer distributions, 'chrony' is the default and recommended Network Time Protocol (NTP) implementation, superseding the older 'ntpd'. It is designed to perform better in a wider range of conditions, including intermittent network connections, and can synchronize the system clock faster and with greater accuracy. Running both 'chronyd' and 'ntpd' simultaneously can lead to resource contention and unpredictable behavior. Therefore, the most secure and reliable configuration at all hardening levels is to use 'chrony' exclusively.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['chrony']` |
| **Moderate** | `['chrony']` |
| **Strict** | `['chrony']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the status of the 'chronyd' and 'ntpd' services using 'systemctl is-enabled'. The script must return the string 'chrony' if only 'chronyd' is enabled, 'ntp' if only 'ntpd' is enabled, 'multiple' if both are enabled, or 'none' if neither is enabled. The output must be one of these exact strings with no extra text.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which must be either 'chrony' or 'ntp'. The script must ensure the specified service is installed, enabled, and running, while also ensuring the other service is disabled and masked to prevent conflicts. The script must return 'true' on success and 'false' on failure.

