# Ensure a single time synchronization daemon is in use

Accurate time synchronization is critical for security. It ensures that log files and timestamps from different systems can be correlated, which is essential for forensic analysis and incident response. Protocols like Kerberos and certificate validation also rely on precise system time. Misconfigured time can lead to authentication failures and an inability to trace security events. The audit script verifies which, if any, time synchronization daemon is currently active. The remediation script standardizes the system on a single, specified daemon, preventing conflicts by disabling others and enabling the chosen one. The Basic state recommends the default 'systemd-timesyncd', which is adequate for general use. The Moderate and Strict states recommend 'chrony' because it offers superior accuracy, faster synchronization, and better performance in varied network conditions, making it the best practice for servers and security-sensitive environments as per CIS benchmarks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['systemd-timesyncd']` |
| **Moderate** | `['chrony']` |
| **Strict** | `['chrony']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that identifies the active and enabled time synchronization daemon. The script should check for 'systemd-timesyncd', 'chrony', and 'ntp'. It must output only the name of the single active daemon (e.g., 'chrony') or 'None' if zero or multiple daemons are active.

## Remediation Script Working

Bash script that accepts one command-line argument: the name of the time synchronization daemon to use ('systemd-timesyncd' or 'chrony'). The script must ensure the specified daemon's package is installed, stop and disable all other conflicting time daemons, then enable and start the specified daemon. The script must return 'true' on success and 'false' on failure.

