lynis/include/tests_time

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2007-2020, CISOfy
#
# Website  : https://cisofy.com
# Blog     : http://linux-audit.com
# GitHub   : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Time
#
#################################################################################
#
    InsertSection "Time and Synchronization"
#
#################################################################################
#
    CRON_DIRS="${ROOTDIR}etc/cron.d ${ROOTDIR}etc/cron.hourly ${ROOTDIR}etc/cron.daily ${ROOTDIR}etc/cron.weekly ${ROOTDIR}etc/cron.monthly ${ROOTDIR}var/spool/crontabs"
    CHRONY_CONF_FILE=""
    NTP_DAEMON=""
    NTP_DAEMON_RUNNING=0
    NTP_CONFIG_FOUND=0
    NTP_CONFIG_TYPE_DAEMON=0
    NTP_CONFIG_TYPE_SCHEDULED=0
    NTP_CONFIG_TYPE_EVENTBASED=0
    NTP_CONFIG_TYPE_STARTUP=0
    NTPD_RUNNING=0 # Specific for ntpd
    OPENNTPD_COMMUNICATION=0 # if ntpctl can communicate
    SYSTEMD_NTP_ENABLED=0
#
#################################################################################
#
    # Test        : TIME-3104
    # Description : Check for a running NTP daemon
    if [ -f /sys/hypervisor/type ]; then
        # TODO: Skip NTP tests if we are in a DomU xen instance
        FIND=$(cat /sys/hypervisor/type)
        if [ "${FIND}" = "xen" ]; then PREQS_MET="NO"; else PREQS_MET="YES"; fi
    elif [ -f /sbin/sysctl ] && [ "$(/sbin/sysctl -n security.jail.jailed 2>/dev/null || echo 0)" -eq 1 ]; then
        # Skip NTP tests if we're in a FreeBSD jail
        PREQS_MET="NO"
    else
        PREQS_MET="YES"
    fi
    Register --test-no TIME-3104 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for running NTP daemon or client"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Linux/FreeBSD (ntpdate), OpenBSD (ntpd, rdate), Chrony, systemd-timesyncd
        LogText "Test: Searching for a running NTP daemon or available client"
        FOUND=0

        SEARCH_FILES="${ROOTDIR}etc/chrony.conf ${ROOTDIR}etc/chrony/chrony.conf"
        for FILE in ${SEARCH_FILES}; do
            if [ -f ${FILE} ]; then LogText "result: found chrony configuration: ${FILE}"; CHRONY_CONF_FILE="${FILE}"; fi
        done
        if [ -n "${CHRONY_CONF_FILE}" ]; then
            if IsRunning "chronyd"; then
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd"
                Display --indent 2 --text "- NTP daemon found: chronyd" --result "${STATUS_FOUND}" --color GREEN
            else
                LogText "Result: found chrony configuration, but no running daemon"
            fi
        else
            LogText "Result: no chrony configuration found"
        fi

        # Check time daemon (eg DragonFly BSD)
        if IsRunning "dntpd"; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="dntpd"
            Display --indent 2 --text "- NTP daemon found: dntpd" --result "${STATUS_FOUND}" --color GREEN
        fi

        # Check for OpenNTPD, ntpctl comes with a "regular" install
        if [ -n "${NTPCTLBINARY}" ]; then
            # In contrast to timectl, "synchronised: yes" is not grepped.
            # Reason: openntpd syncs only if large time corrections are not required or -s is passed.
            #         This might be not intended by the administrator (-s is NOT the default!)
            FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd: ntp engine" | ${GREPBINARY} -v "grep")
            ${NTPCTLBINARY} -s status > /dev/null 2> /dev/null
            # Status code 0 is when communication over the socket is successfull
            if [ "$?" -eq 0 ]; then
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
                LogText "result: found openntpd (method: ntpctl)"
                OPENNTPD_COMMUNICATION=1
            elif [ -n "${FIND}" ] ; then
                # Reasons for ntpctl to fail might be someone spawned a new process thus overwriting the socket,
                # then ended it, but another openntpd process is still running
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
                LogText "result: found openntpd (method: ps)"
            else
                LogText "result: running openntpd not found, but ntpctl is instaalled"
            fi

            if [ "${NTP_DAEMON}" == "openntpd" ]; then
                Display --indent 2 --text "- NTP daemon found: OpenNTPD" --result "${STATUS_FOUND}" --color GREEN
            fi
        fi

        # Check running processes (ntpd from ntp.org)
        # As checking by process name is ambigiouse (openntpd has the same process name),
        # this check will be skipped if openntpd has been found.
        FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "ntpd: " | ${GREPBINARY} -v "grep")
        if [ "${NTP_DAEMON}" != "openntpd" ] && [  -n "${FIND}" ]; then
            FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1
            NTP_DAEMON="ntpd"
            LogText "Result: found running NTP daemon in process list"
            Display --indent 2 --text "- NTP daemon found: ntpd" --result "${STATUS_FOUND}" --color GREEN
        fi

        # Check time daemon (eg NetBSD)
        if IsRunning "timed"; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="timed"
            Display --indent 2 --text "- NTP daemon found: timed" --result "${STATUS_FOUND}" --color GREEN
        fi

        # Check timedate daemon (systemd)
        if [ -n "${TIMEDATECTL}" ]; then
            FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
            if [ -n "${FIND}" ]; then
                # Check for systemd-timesyncd
                if [ -f ${ROOTDIR}etc/systemd/timesyncd.conf ]; then
                    LogText "Result: found ${ROOTDIR}etc/systemd/timesyncd.conf"
                    FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd"
                    Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "${STATUS_FOUND}" --color GREEN
                    SYSTEMD_NTP_ENABLED=1
                else
                    LogText "Result: ${ROOTDIR}etc/systemd/timesyncd.conf does not exist"
                fi
            else
                LogText "Result: time synchronization not performed according timedatectl command"
            fi
        else
            LogText "Result: timedatectl command not available on this system"
        fi

        # Check crontab for OpenBSD/FreeBSD
        # Check anacrontab for Linux
        CRONTAB_FILES="/etc/anacrontab /etc/crontab"
        for I in ${CRONTAB_FILES}; do
            if [ -f ${I} ]; then
                LogText "Test: checking for ntpdate or rdate in crontab file ${I}"
                FIND=$(${EGREPBINARY} "ntpdate|rdate" ${I} | ${GREPBINARY} -v '^#')
                if [ -n "${FIND}" ]; then
                    FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1
                    Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN
                    LogText "Result: found ntpdate or rdate reference in crontab file ${I}"
                else
                    #Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_NOT_FOUND}" --color WHITE
                    LogText "Result: no ntpdate or rdate reference found in crontab file ${I}"
                fi
            else
                LogText "Result: crontab file ${I} not found"
            fi
        done

        # Notes: only test for normal files. File /etc/cron.d/FIFO on solaris is a special file and test may hang
        # Linux systems may have a .placeholder file
        FOUND_IN_CRON=0

        # Check cron jobs
        for I in ${CRON_DIRS}; do
            if [ -d ${I} ]; then
                if FileIsReadable ${I}; then
                    FIND=$(${FINDBINARY} ${I} -type f -a ! -name ".placeholder" -print 2> /dev/null | ${SEDBINARY} 's/ /__space__/g' | ${TRBINARY} '\n' '\0' | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} '\0' ' ')
                    if [ -n "${FIND}" ]; then
                        for J in ${FIND}; do
                            # Place back spaces if needed
                            J=$(echo ${J} | ${SEDBINARY} 's/__space__/ /g')
                            LogText "Test: checking for ntpdate or rdate in ${J}"
                            if FileIsReadable ${J}; then
                                FIND2=$(${EGREPBINARY} "rdate|ntpdate" "${J}" | ${GREPBINARY} -v "^#")
                                if [ -n "${FIND2}" ]; then
                                    LogText "Positive match found: ${FIND2}"
                                    FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
                                fi
                            else
                                LogText "Result: could not test in file '${J}' as it is not readable"
                            fi
                        done
                    else
                        LogText "Result: ${I} is empty, skipping search in directory"
                    fi
                else
                    LogText "Result: could not search in directory due to permissions"
                fi
            fi
        done

        if [ ${FOUND_IN_CRON} -eq 1 ]; then
            Display --indent 2 --text "- Checking NTP client in cron files" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: found ntpdate or rdate in cron directory"
        else
            LogText "Result: no ntpdate or rdate found in cron directories"
        fi

        # Checking if ntpdate is performed by event
        LogText "Test: checking for file /etc/network/if-up.d/ntpdate"
        if [ -f /etc/network/if-up.d/ntpdate ]; then
            LogText "Result: found ntpdate action when network interface comes up"
            FOUND=1
            NTP_CONFIG_TYPE_EVENTBASED=1
            Display --indent 2 --text "- Checking event based ntpdate (if-up)" --result "${STATUS_FOUND}" --color GREEN
        else
            LogText "Result: file /etc/network/if-up.d/ntpdate does not exist"
        fi

        # Configuration file for *BSD
        if [ -f /etc/rc.conf ]; then
            LogText "Test: Checking if ntpdate is enabled at startup in *BSD"
            FIND=$(${GREPBINARY} 'ntpdate_enable="YES"' /etc/rc.conf)
            if [ -n "${FIND}" ]; then
                LogText "Result: ntpdate is enabled in rc.conf"
                FOUND=1
                NTP_CONFIG_TYPE_STARTUP=1
                # Only show suggestion when ntpdate is enabled, however ntpd is not running
                if [ ${NTP_DAEMON_RUNNING} -eq 0 ]; then
                    ReportSuggestion "${TEST_NO}" "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon"
                fi
            else
                LogText "Result: ntpdate is not enabled in rc.conf"
            fi
        fi

        if [ ${FOUND} -eq 0 ]; then
            if [ ${ISVIRTUALMACHINE} -eq 1 ]; then
                LogText "Result: Skipping display warning, as virtual machines usually don't need time synchronization in the VM itself"
            else
                Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_WARNING}" --color RED
                LogText "Result: Could not find a NTP daemon or client"
                ReportSuggestion "${TEST_NO}" "Use NTP daemon or NTP client to prevent time issues."
                AddHP 0 2
            fi
        else
            Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_OK}" --color GREEN
            LogText "Result: Found a time syncing daemon/client."
            AddHP 3 3
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3106
    # Description : Check status of systemd time synchronization
    if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a -n "${TIMEDATECTL}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check systemd NTP time synchronization status"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Check the status of time synchronization via timedatectl"
        FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
        if [ -z "${FIND}" ]; then
            LogText "Result: time not synchronized via NTP"
            ReportSuggestion "${TEST_NO}" "Check timedatectl output. Synchronization via NTP is enabled, but status reflects it is not synchronized"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3112
    # Description : Check for valid associations from ntpq peers list
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3112 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check active NTP associations ID's"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking for NTP association ID's from ntpq peers list"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} "No association ID's returned")
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: Found one or more association ID's"
        else
            Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_WARNING}" --color RED
            ReportSuggestion "${TEST_NO}" "Check ntp.conf for properly configured NTP servers and a correctly functioning name service."
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3116
    # Description : Check for stratum 16 peers
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check peers with stratum value of 16"
    if [ ${SKIPTEST} -eq 0 ]; then
        COUNT=0
        LogText "Test: Checking stratum 16 sources from ntpq peers list"
        FIND=$(${NTPQBINARY} -p -n | ${AWKBINARY} '{ if ($2!=".POOL." && $3=="16") { print $1 }}')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN
            LogText "Result: All peers are lower than stratum 16"
        else
            for ITEM in ${FIND}; do
                LogText "Found stratum 16 peer: ${ITEM}"
                FIND2=$(${EGREPBINARY} "^ntp-ignore-stratum-16-peer=${ITEM}" ${PROFILE})
                if IsEmpty "${FIND2}"; then
                    COUNT=$((COUNT + 1))
                    Report "ntp_stratum_16_peer[]=${ITEM}"
                else
                    LogText "Output: host ${ITEM} ignored by profile"
                fi
            done
            # Check if one or more high stratum time servers are found
            if [ ${COUNT} -eq 0 ]; then
                Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN
                LogText "Result: all non local servers are lower than stratum 16, or whitelisted within the scan profile"
            else
                Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_WARNING}" --color RED
                LogText "Result: Found ${COUNT} high stratum (16) peers)"
                ReportSuggestion "${TEST_NO}" "Check ntpq peers output for stratum 16 peers"
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3120
    # Description : Check unreliable peers from peer list
    # Notes       : Items with # are too far away (network distance)
    #               Items with - are not chosen due clustering algorithm
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check unreliable NTP peers"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking unreliable ntp peers"
        FIND=$(${NTPQBINARY} -p -n | ${EGREPBINARY} "^(-|#)" | ${AWKBINARY} '{ print $1 }' | ${SEDBINARY} 's/^-//g')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_NONE}" --color GREEN
            LogText "Result: No unreliable peers found"
        else
            Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_FOUND}" --color YELLOW
            LogText "Result: Found one or more unreliable peers (marked with a minus or dash sign)"
            for I in ${FIND}; do
                LogText "Unreliable peer: ${I}"
                Report "ntp_unreliable_peer[]=${I}"
            done
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for unreliable ntp peers and correct/replace them"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3124
    # Description : Check selected time source
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check selected time source"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking selected time source"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ if ($4=="l") { print $1 } }')
        FIND2=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ print $1 }')
        if [ -z "${FIND}" -a -n "${FIND2}" ]; then
            Display --indent 2 --text "- Checking selected time source" --result "${STATUS_OK}" --color GREEN
            FIND2=$(echo ${FIND2} | ${SEDBINARY} 's/*//g')
            LogText "Result: Found selected time source (value: ${FIND2})"
        else
            Display --indent 2 --text "- Checking selected time source" --result "${STATUS_WARNING}" --color RED
            LogText "Result: Found local source as selected time source. This could indicate that no external sources are available to sync with."
            LogText "Local source: ${FIND}"
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for selected time source"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3128
    # Description : Check time source candidates
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check preferred time source"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking preferred time source"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^+' | ${AWKBINARY} '{ print $1 }')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_NONE}" --color YELLOW
            LogText "Result: No other time source candidates found"
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for time source candidates"
        else
            Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_OK}" --color GREEN
            LogText "Result: Found one or more candidates to synchronize time with."
            for I in ${FIND}; do
                I=$(echo ${I} | ${SEDBINARY} 's/+//g')
                LogText "Candidate found: ${I}"
            done
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3132
    # Description : Check ntpq falsetickers
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP falsetickers"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking preferred time source"
        FIND=$(${NTPQBINARY} -p -n | ${EGREPBINARY} '^x')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_OK}" --color GREEN
            LogText "Result: No falsetickers found (items preceding with an 'x')"
        else
            Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_NONE}" --color YELLOW
            LogText "Result: Found one or more falsetickers  (items preceding with an 'x')"
            for I in ${FIND}; do
                I=$(echo ${I} | ${SEDBINARY} 's/x//g')
                LogText "Falseticker found: ${I}"
                Report "ntp_falseticker[]=${I}"
            done
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for falsetickers"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3136
    # Description : Check ntpq reported ntp version (Linux)
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3136 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP protocol version"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking NTP protocol version (ntpq -c ntpversion)"
        FIND=$(${NTPQBINARY} -c ntpversion | ${AWKBINARY} '{ if ($1=="NTP" && $2=="version" && $5=="is") { print $6 } }')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking NTP version" --result "${STATUS_UNKNOWN}" --color YELLOW
            LogText "Result: No NTP version found"
            ReportSuggestion "${TEST_NO}" "Check ntpq output for NTP protocol version"
        else
            Display --indent 2 --text "- Checking NTP version" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: Found NTP version ${FIND}"
            Report "ntp_version=${FIND}"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3146
    # Description : Check /etc/default/ntpdate (Linux)
    # Notes       : ntpdate-debian binary
    #if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    #Register --test-no TIME-3146 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/default/ntpdate"
    #if [ ${SKIPTEST} -eq 0 ]; then
#
#################################################################################
#
    # Test        : TIME-3148
    # Description : Check if TZ variable is set (Linux)
    # Notes       : without TZ variable set, a lot of unneeded calls might be performed.
    Register --test-no TIME-3148 --os Linux --weight L --network NO --category performance --description "Check TZ variable"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: testing for TZ variable"
        FIND="${TZ:=notset}"
        LogText "Result: found TZ variable with value ${FIND}"
        if [ "${FIND}" = "notset" ]; then
            Report "tz_variable_empty=1"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3160
    # Description : Check empty NTP step-tickers
    # Notes       : Mostly applies to Red Hat and clones
    FILE="${ROOTDIR}etc/ntp/step-tickers"
    if [ "${NTPD_RUNNING}" -eq 1 -a -n "${NTPQBINARY}" -a -f "${FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3160 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check empty NTP step-tickers"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        OUTPUT=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE})
        if [ -z "${OUTPUT}" ]; then
            if [ ${OS_REDHAT_OR_CLONE} -eq 1 -a -f "${FILE}" ]; then
                # On RedHat if step-ticker file exists but is empty, the ntpdate start script uses the servers listed in ntp.conf for the initial time synchronization
                LogText "Result: ${FILE} exists and it is empty. On RedHat the initial time synchronization will be done with the servers listed in ntp.conf."
                Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN
            else
                LogText "Result: ${FILE} is empty. The step-tickers contain no configured NTP servers"
                Display --indent 2 --text "- Checking NTP step-tickers file" --result "EMPTY FILE" --color YELLOW
                ReportSuggestion "${TEST_NO}" "Use step-tickers file for quicker time synchronization"
            fi
        else
            LogText "Result: ${FILE} is not empty, which is fine"
            Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN
            sFIND=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE} | ${EGREPBINARY} -v "^127." | ${EGREPBINARY} -v "^::1")
            for I in ${sFIND}; do
                FIND=$(${GREPBINARY} ^${I} ${FILE} | wc -l)
                if [ ${FIND} -gt 0 ]; then
                    LogText "Result: $I exist in ${FILE}"
                else
                    LogText "Result: ${I} does NOT exist in ${FILE}"
                    FOUND=1
                fi
            done
            if [ ${FOUND} -eq 1 ]; then
                Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "SOME MISSING" --color YELLOW
                ReportSuggestion "${TEST_NO}" "Some time servers missing in step-tickers file"
                AddHP 3 4
            else
                Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "${STATUS_OK}" --color GREEN
                LogText "Result: all time servers are in step-tickers file"
                AddHP 4 4
            fi
        fi
        LogText "Information: step-tickers is used by ntpdate where as ntp.conf is the configuration file for the ntpd daemon. ntpdate is initially run to set the clock before ntpd to make sure time is within 1000 sec."
        LogText "Risk: ntp will not run at boot if the time difference between the server and client by more then 1000 sec."
    fi
#
#################################################################################
#
    # Test        : TIME-3170
    # Description : Check file permissions and ownership of configuration files
    # Notes       : Files should be owned by root, or the user running
    #               Group owner should have only read access
    #               Other should preferably have no access, or read-only at max

    FILE_ARRAY="${ROOTDIR}etc/chrony.conf ${ROOTDIR}usr/pkg/etc/chrony.conf \
        ${ROOTDIR}etc/inet/ntp.conf ${ROOTDIR}etc/ntp.conf ${ROOTDIR}usr/local/etc/ntp.conf\
        ${ROOTDIR}etc/ntpd.conf ${ROOTDIR}etc/openntpd/ntpd.conf ${ROOTDIR}usr/local/etc/ntpd.conf"

    Register --test-no TIME-3170 --weight L --network NO --category security --description "Check configuration files"
    if [ ${SKIPTEST} -eq 0 ]; then
        for FILE in ${FILE_ARRAY}; do
            if [ -f ${FILE} ]; then
                LogText "Result: found ${FILE}"
                if IsWorldWritable ${FILE}; then
                    ReportWarning "${TEST_NO}" "Found world writable configuration file" "${FILE}" ""
                fi
                Report "ntp_config_file[]=${FILE}"
                NTP_CONFIG_FOUND=1
            fi
        done
    fi
#
#################################################################################
#
    # Test        : TIME-3180
    # Description : Report if ntpctl cannot communicate with OpenNTPD
    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi
    Register --test-no TIME-3180 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD"
    if [ ${SKIPTEST} -eq 0 ]; then
        if [ "${OPENNTPD_COMMUNICATION}" -eq 0 ]; then
            ReportWarning "${TEST_NO}" "OpenNTPD found, but ntpctl cannot communicate with" "${NTPCTLBINARY} -s status" "Restart OpenNTPD"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3181
    # Description : Check status of OpenNTPD time synchronisation
    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi

    Register --test-no TIME-3181 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation"
    if [ ${SKIPTEST} -eq 0 ]; then
        FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} "clock synced" )
        if [ -z "${FIND}" ]; then
            ReportWarning "${TEST_NO}" "OpenNTPD is not synchronising system time" "${NTPCTLBINARY} -s status" "text:Set time manually once or check network connectivity."
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3182
    # Description : Check OpenNTPD has working peers

    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi

    Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Format is "xx/yy peers valid, ..."
        FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o '[0-9]+/[0-9]+' | ${CUTBINARY} -d '/' -f 1)
        if [ -z "${FIND}" ] || [ "${FIND}" -eq 0 ]; then
            ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status"
        fi
    fi
#
#################################################################################
#

    Report "ntp_config_found=${NTP_CONFIG_FOUND}"
    Report "ntp_config_type_daemon=${NTP_CONFIG_TYPE_DAEMON}"
    Report "ntp_config_type_eventbased=${NTP_CONFIG_TYPE_EVENTBASED}"
    Report "ntp_config_type_scheduled=${NTP_CONFIG_TYPE_SCHEDULED}"
    Report "ntp_config_type_startup=${NTP_CONFIG_TYPE_STARTUP}"
    Report "ntp_daemon=${NTP_DAEMON}"
    Report "ntp_daemon_running=${NTP_DAEMON_RUNNING}"
#
#################################################################################
#
    # For VMs check ntpd.conf : tinker panic 0

    # OS        Time daemons  Configuration file
    # --------------------------------------------
    # AIX       xntpd         /etc/ntp.conf
    # HP
    # Linux     ntpd          /etc/ntp.conf
    #           chrony        /etc/chrony.conf
    # OpenBSD   ntpd          /etc/ntpd.conf
    # Solaris   xntpd         /etc/inet/ntp.conf

    WaitForKeyPress

#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com