# Ensure chrony is enabled and running

Necessity: Accurate time synchronization is a critical foundation for security. The chrony service synchronizes the system clock with a reliable time source. Without accurate time, correlating logs across different systems for security incident analysis becomes impossible. It is also essential for time-sensitive security protocols like Kerberos, TLS/SSL certificate validation, and digital signatures. Significant time drift can lead to authentication failures, service disruptions, and vulnerability to replay attacks.

Auditing and Remediation: The audit script verifies that the chrony package is installed and that the 'chronyd' service is both enabled (to start automatically on boot) and active (currently running). The remediation script ensures this state by using the system's service manager ('systemctl') to enable and start the 'chronyd' service, thereby correcting any misconfiguration and enforcing active time synchronization.

Recommended State Rationale: 
- Basic: The recommended state is 'Enabled and Active'. This is the minimum requirement for a functioning, secure system, as time synchronization is not an optional feature but a core operational necessity.
- Moderate & Strict: For the state of the service itself, there is no meaningful distinction between security levels. A system's time must be synchronized, regardless of its hardening level. Therefore, 'Enabled and Active' is the only acceptable state for all levels. Advanced hardening for this control would involve configuring chrony to use specific, authenticated Network Time Protocol (NTP) sources within its configuration file, which is beyond the scope of simply managing the service's state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled and Active']` |
| **Moderate** | `['Enabled and Active']` |
| **Strict** | `['Enabled and Active']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'chrony' package is installed. If not, it should output 'Not Installed'. If it is installed, the script must use 'systemctl is-enabled chronyd' and 'systemctl is-active chronyd' to determine the service's state. The script must return a single, combined string representing the status: 'Enabled and Active', 'Enabled and Inactive', 'Disabled and Active', or 'Disabled and Inactive'. The output must contain only this string, without any additional text or formatting.

## Remediation Script Working

Bash script that accepts one positional command-line argument for the desired state. If the argument is 'Enabled and Active', the script must use 'systemctl enable --now chronyd' to both enable the service for boot and start it immediately. The script must return 'true' upon successful execution and confirmation that the service is active and enabled, or 'false' if the operation fails.

