# Ensure chrony is configured with authorized timeserver

Necessity: Accurate time synchronization is critical for network security and operations. Many security services, such as Kerberos, rely on synchronized time to prevent replay attacks. Furthermore, accurate timestamps are essential for log correlation across multiple systems, which is fundamental for security incident investigation and forensic analysis. Misconfigured time synchronization can lead to authentication failures, an inability to trace malicious activity, and potential denial-of-service conditions.

Auditing and Remediation: The audit script checks the `/etc/chrony.conf` configuration file to identify the currently configured NTP time sources. The remediation script modifies this file, replacing existing server configurations with a list of authorized time servers, ensuring the system synchronizes only with trusted sources.

Recommended State Rationale:
- Basic: Configuring a single public NTP server ensures that the system has a source for time synchronization, which is the minimum requirement for operational integrity.
- Moderate: Using the default CentOS NTP pool provides redundancy and resilience. If one server in the pool becomes unavailable, chrony can automatically switch to others, ensuring continuous and reliable time synchronization. This is the standard best practice for most internet-connected systems.
- Strict: In high-security or isolated environments, relying on public NTP servers can introduce a dependency on external infrastructure and a potential attack vector. A strict configuration mandates the use of internal, dedicated, and trusted time servers controlled by the organization. This mitigates risks like NTP-based DDoS reflection attacks or man-in-the-middle attacks on time data, ensuring the highest level of time source integrity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2.centos.pool.ntp.org']` |
| **Moderate** | `['0.centos.pool.ntp.org','1.centos.pool.ntp.org','2.centos.pool.ntp.org','3.centos.pool.ntp.org']` |
| **Strict** | `['time1.internal.corp','time2.internal.corp']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/chrony.conf` file. The script must find all lines beginning with 'server' or 'pool', extract the FQDN or IP address from each, concatenate them into a single comma-separated string, and print this string to standard output. Ensure no other text is outputted.

## Remediation Script Working

Bash script that accepts a single, comma-separated string of authorized timeserver FQDNs or IP addresses as a positional command-line argument. The script must modify the `/etc/chrony.conf` file by commenting out all existing 'server' and 'pool' directives and then adding a new 'server' directive for each timeserver provided in the argument. The script must output `true` on success and `false` on failure.

