# Ensure chrony is configured with authorized timeserver

Necessity: Accurate time synchronization is critical for security and system operations. Without it, log correlation across systems is impossible, making forensic analysis and incident response extremely difficult. Time-sensitive authentication protocols like Kerberos will fail, and the validity of cryptographic certificates cannot be properly verified. Misconfigured time can mask malicious activity or cause cascading failures in distributed systems. Using a dedicated Network Time Protocol (NTP) service like chrony is essential for maintaining accurate system clocks.

Auditing and Remediation: The audit script verifies that the chrony package is installed and that the systemd service is enabled to ensure it runs automatically on boot. The remediation script installs the chrony package using the system's package manager and uses 'systemctl' to enable and start the service, ensuring the system immediately begins synchronizing its time.

Recommended State Rationale: 
Basic, Moderate, and Strict: The recommended state for all hardening levels is 'enabled'. Accurate time is a foundational requirement, not a granular security setting. There is no secure scenario where a server's time is allowed to drift. The distinction between security levels for this control lies not in its enabled status, but in the subsequent configuration of which authorized, hardened, and trusted time servers the chrony service is configured to use. Therefore, ensuring the service is active is the universal baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'chrony' service is enabled. The script should first determine if the chrony package is installed. If not, it must output 'not installed'. If it is installed, it must check if the service is enabled to start on boot using systemctl. The script must output only the string 'enabled' or 'disabled', with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single command-line argument: 'enabled'. If the argument is 'enabled', the script must install the 'chrony' package if it is not already present, then enable and start the service using systemctl. The script must not handle a 'disabled' state. On success, it must output 'true'; on failure, it must output 'false'.

