# Ensure chrony is running as user _chrony

Necessity: Running network services like chrony with a dedicated, unprivileged user account is a critical security practice based on the principle of least privilege. If the chrony service were to be compromised, and it was running as 'root', an attacker could gain complete control over the system. By running it as the '_chrony' user, which has minimal system permissions and no login shell, the potential damage from a compromise is significantly contained, preventing privilege escalation.

Auditing and Remediation: The audit script verifies the user context under which the chrony service is configured to run by parsing its systemd unit file for the 'User=' directive. The remediation script enforces the correct user context by creating a systemd override file, which is the standard practice for modifying service behavior, setting the user to the specified value, and then reloading and restarting the service to apply the change.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is '_chrony'. This is not a setting with varying degrees of security but a foundational best practice. The '_chrony' user is created by the package installer for this specific purpose. Any other configuration, especially running as 'root', introduces an unnecessary and significant security risk. Therefore, there is only one correct and secure state for this setting.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['_chrony']` |
| **Moderate** | `['_chrony']` |
| **Strict** | `['_chrony']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the systemd unit file for the 'chrony' service, typically located at '/lib/systemd/system/chrony.service' or '/etc/systemd/system/chrony.service.d/override.conf'. The script must extract and return only the value of the 'User=' directive. If the directive is not found, the script should return an empty string.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired username. The script must create a systemd override file at '/etc/systemd/system/chrony.service.d/override.conf' to set the '[Service]' section's 'User' directive to the provided argument. After creating the file, it must execute 'systemctl daemon-reload' and 'systemctl restart chrony'. The script must return 'true' on successful completion and 'false' on failure.

