# Ensure systemd-timesyncd configured with authorized timeserver

Necessity: Accurate time synchronization is critical for security. It ensures that log files across different systems can be correlated accurately during a forensic investigation. Many authentication protocols, such as Kerberos, depend on synchronized clocks to prevent replay attacks. Furthermore, cryptographic functions rely on valid timestamps for certificate validation. An unsynchronized clock can lead to service denials, authentication failures, and an inability to trace security incidents.

Auditing and Remediation: The audit script inspects the '/etc/systemd/timesyncd.conf' configuration file to verify which Network Time Protocol (NTP) servers are configured. The remediation script modifies this same file to set the 'NTP=' parameter to a specified list of authorized servers and then restarts the 'systemd-timesyncd' service to enforce the new configuration.

Recommended State Rationale:
- Basic: Recommends using a single, reliable public time server such as 'ntp.ubuntu.com'. This is a minimal configuration that ensures the system's clock is synchronized but lacks redundancy.
- Moderate: Recommends using multiple servers from a public NTP pool (e.g., 'ubuntu.pool.ntp.org'). This provides high availability and resilience; if one server becomes unreachable, the system can synchronize with others in the pool.
- Strict: Recommends using dedicated, internal NTP servers controlled by the organization. This is the most secure configuration as it reduces reliance on external infrastructure, minimizes the attack surface from the public internet (e.g., man-in-the-middle attacks on NTP), and provides a trusted, authoritative time source, which is often a requirement for high-security environments and regulatory compliance.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['ntp.ubuntu.com']` |
| **Moderate** | `['0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org 2.ubuntu.pool.ntp.org']` |
| **Strict** | `['time1.internal.corp time2.internal.corp']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that reads the '/etc/systemd/timesyncd.conf' file, finds the line beginning with 'NTP=', and returns only the value after the equals sign. The script should handle cases where the line is commented out or absent by returning an empty string. The output must be stripped of any leading/trailing whitespace and contain no other text.

## Remediation Script Working

bash script that accepts a space-separated string of authorized time server hostnames or IP addresses as a single command-line argument. The script must modify the '/etc/systemd/timesyncd.conf' file by replacing any existing 'NTP=' line (commented or not) or adding it if it does not exist. The script must then restart the 'systemd-timesyncd' service to apply the change. It must return 'true' on success and 'false' on failure.

