lynis/include/tests_time

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2007-2021, CISOfy
#
# Website  : https://cisofy.com
# Blog     : http://linux-audit.com
# GitHub   : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Time
#
#################################################################################
#
    InsertSection "${SECTION_TIME_AND_SYNCHRONIZATION}"
#
#################################################################################
#
    CRON_DIRS="${ROOTDIR}etc/cron.d ${ROOTDIR}etc/cron.hourly ${ROOTDIR}etc/cron.daily ${ROOTDIR}etc/cron.weekly ${ROOTDIR}etc/cron.monthly ${ROOTDIR}var/spool/crontabs"
    CHRONY_CONF_FILE=""
    NTP_DAEMON=""
    NTP_DAEMON_RUNNING=0
    NTP_CONFIG_FOUND=0
    NTP_CONFIG_TYPE_DAEMON=0
    NTP_CONFIG_TYPE_SCHEDULED=0
    NTP_CONFIG_TYPE_EVENTBASED=0
    NTP_CONFIG_TYPE_STARTUP=0
    NTPD_RUNNING=0 # Specific for ntpd
    OPENNTPD_COMMUNICATION=0 # if ntpctl can communicate
    SYSTEMD_NTP_ENABLED=0
#
#################################################################################
#
    # Test        : TIME-3104
    # Description : Check for a running NTP daemon
    if [ -f /sys/hypervisor/type ]; then
        # TODO: Skip NTP tests if we are in a DomU xen instance
        FIND=$(cat /sys/hypervisor/type)
        if [ "${FIND}" = "xen" ]; then PREQS_MET="NO"; else PREQS_MET="YES"; fi
    elif [ -f /sbin/sysctl ] && [ "$(/sbin/sysctl -n security.jail.jailed 2>/dev/null || echo 0)" -eq 1 ]; then
        # Skip NTP tests if we're in a FreeBSD jail
        PREQS_MET="NO"
    else
        PREQS_MET="YES"
    fi
    Register --test-no TIME-3104 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for running NTP daemon or client"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Linux/FreeBSD (ntpdate), OpenBSD (ntpd, rdate), Chrony, systemd-timesyncd
        LogText "Test: Searching for a running NTP daemon or available client"
        FOUND=0

        SEARCH_FILES="${ROOTDIR}etc/chrony.conf ${ROOTDIR}etc/chrony/chrony.conf"
        for FILE in ${SEARCH_FILES}; do
            if [ -f ${FILE} ]; then LogText "result: found chrony configuration: ${FILE}"; CHRONY_CONF_FILE="${FILE}"; fi
        done
        if [ -n "${CHRONY_CONF_FILE}" ]; then
            if IsRunning "chronyd"; then
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd"
                Display --indent 2 --text "- NTP daemon found: chronyd" --result "${STATUS_FOUND}" --color GREEN
            else
                LogText "Result: found chrony configuration, but no running daemon"
            fi
        else
            LogText "Result: no chrony configuration found"
        fi

        # Check time daemon (eg DragonFly BSD)
        if IsRunning "dntpd"; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="dntpd"
            Display --indent 2 --text "- NTP daemon found: dntpd" --result "${STATUS_FOUND}" --color GREEN
        fi

        # Check for OpenNTPD, ntpctl comes with a "regular" install
        if [ -n "${NTPCTLBINARY}" ]; then
            # In contrast to timectl, "synchronised: yes" is not grepped.
            # Reason: openntpd syncs only if large time corrections are not required or -s is passed.
            #         This might be not intended by the administrator (-s is NOT the default!)
            FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd: ntp engine" | ${GREPBINARY} -v "grep")
            # Status code 0 is when communication over the socket is successful
            if ${NTPCTLBINARY} -s status > /dev/null 2> /dev/null; then
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
                LogText "result: found openntpd (method: ntpctl)"
                OPENNTPD_COMMUNICATION=1
            elif [ -n "${FIND}" ] ; then
                # Reasons for ntpctl to fail might be someone spawned a new process thus overwriting the socket,
                # then ended it, but another openntpd process is still running
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
                LogText "result: found openntpd (method: ps)"
            else
                LogText "result: running openntpd not found, but ntpctl is installed"
            fi

            if [ "${NTP_DAEMON}" = "openntpd" ]; then
                Display --indent 2 --text "- NTP daemon found: OpenNTPD" --result "${STATUS_FOUND}" --color GREEN
            fi
        fi

        # Check running processes (ntpd from ntp.org)
        # As checking by process name is ambiguous (openntpd has the same process name),
        # this check will be skipped if openntpd has been found.
        FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "ntpd: " | ${GREPBINARY} -v "grep")
        if [ "${NTP_DAEMON}" != "openntpd" ] && [  -n "${FIND}" ]; then
            FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1
            NTP_DAEMON="ntpd"
            LogText "Result: found running NTP daemon in process list"
            Display --indent 2 --text "- NTP daemon found: ntpd" --result "${STATUS_FOUND}" --color GREEN
        fi

        # Check time daemon (eg NetBSD)
        if IsRunning "timed"; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="timed"
            Display --indent 2 --text "- NTP daemon found: timed" --result "${STATUS_FOUND}" --color GREEN
        fi

        # Check timedate daemon (systemd)
        FIND=$(${PSBINARY} ax | ${GREPBINARY} "systemd-timesyncd" | ${GREPBINARY} -v "grep")
        if [  -n "${FIND}" ]; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd"
            Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: Found running systemd-timesyncd in process list"
        fi

        # Check crontab for OpenBSD/FreeBSD
        # Check anacrontab for Linux
        CRONTAB_FILES="/etc/anacrontab /etc/crontab"
        # Regex for matching multiple time synchronisation binaries
        # Partial sanity check for sntp and ntpdig, but this does not consider all corner cases
        CRONTAB_REGEX='ntpdate|rdate|sntp.+-(s|j|--adj)|ntpdig.+-(S|s)'
        for I in ${CRONTAB_FILES}; do
            if [ -f ${I} ]; then
                LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in crontab file ${I}"
                FIND=$(${GREPBINARY} -E "${CRONTAB_REGEX}" ${I} | ${GREPBINARY} -v '^#')
                if [ -n "${FIND}" ]; then
                    FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1
                    Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN
                    LogText "Result: found ntpdate, rdate, sntp or ntpdig reference in crontab file ${I}"
                else
                    #Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_NOT_FOUND}" --color WHITE
                    LogText "Result: no ntpdate, rdate, sntp or ntpdig reference found in crontab file ${I}"
                fi
            else
                LogText "Result: crontab file ${I} not found"
            fi
        done

        # Notes: only test for normal files. File /etc/cron.d/FIFO on solaris is a special file and test may hang
        # Linux systems may have a .placeholder file
        FOUND_IN_CRON=0

        # Check cron jobs
        for I in ${CRON_DIRS}; do
            for J in "${I}"/*; do  # iterate over folders in a safe way
                # Check: regular file, readable and not called .placeholder
                FIND=$(echo "${J}" | ${GREPBINARY} -E '/.placeholder$')
                if [ -f "${J}" ] && [ -r "${J}" ] && [ -z "${FIND}" ]; then
                    LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in ${J}"
                    FIND=$("${GREPBINARY}" -E "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#")
                    if [ -n "${FIND}" ]; then
                        FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
                        LogText "Result: found ntpdate, rdate, sntp or ntpdig in ${J}"
                    fi
                fi
            done
        done

        if [ ${FOUND_IN_CRON} -eq 1 ]; then
            Display --indent 2 --text "- Checking NTP client in cron files" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: found ntpdate or rdate in cron directory"
        else
            LogText "Result: no ntpdate or rdate found in cron directories"
        fi

        # Checking if ntpdate is performed by event
        LogText "Test: checking for file /etc/network/if-up.d/ntpdate"
        if [ -f /etc/network/if-up.d/ntpdate ]; then
            LogText "Result: found ntpdate action when network interface comes up"
            FOUND=1
            NTP_CONFIG_TYPE_EVENTBASED=1
            Display --indent 2 --text "- Checking event based ntpdate (if-up)" --result "${STATUS_FOUND}" --color GREEN
        else
            LogText "Result: file /etc/network/if-up.d/ntpdate does not exist"
        fi

        # Configuration file for *BSD
        if [ -f /etc/rc.conf ]; then
            LogText "Test: Checking if ntpdate is enabled at startup in *BSD"
            FIND=$(${GREPBINARY} 'ntpdate_enable="YES"' /etc/rc.conf)
            if [ -n "${FIND}" ]; then
                LogText "Result: ntpdate is enabled in rc.conf"
                FOUND=1
                NTP_CONFIG_TYPE_STARTUP=1
                # Only show suggestion when ntpdate is enabled, however ntpd is not running
                if [ ${NTP_DAEMON_RUNNING} -eq 0 ]; then
                    ReportSuggestion "${TEST_NO}" "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon"
                fi
            else
                LogText "Result: ntpdate is not enabled in rc.conf"
            fi
        fi

        if [ ${FOUND} -eq 0 ]; then
            if [ ${ISVIRTUALMACHINE} -eq 1 ]; then
                LogText "Result: Skipping display warning, as virtual machines usually don't need time synchronization in the VM itself"
            else
                Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_WARNING}" --color RED
                LogText "Result: Could not find a NTP daemon or client"
                ReportSuggestion "${TEST_NO}" "Use NTP daemon or NTP client to prevent time issues."
                AddHP 0 2
            fi
        else
            Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_OK}" --color GREEN
            LogText "Result: Found a time syncing daemon/client."
            AddHP 3 3
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3106
    # Description : Check status of systemd time synchronization
    if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a -n "${TIMEDATECTL}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check systemd NTP time synchronization status"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Check the status of time synchronization via timedatectl"
        FIND=$(${TIMEDATECTL} status | ${GREPBINARY} -E "(NTP|System clock) synchronized: yes")
        if [ -z "${FIND}" ]; then
            LogText "Result: time not synchronized via NTP"
            ReportSuggestion "${TEST_NO}" "Check timedatectl output. Synchronization via NTP is enabled, but status reflects it is not synchronized"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3112
    # Description : Check for valid associations from ntpq peers list
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3112 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check active NTP associations ID's"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking for NTP association ID's from ntpq peers list"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} "No association ID's returned")
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: Found one or more association ID's"
        else
            Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_WARNING}" --color RED
            ReportSuggestion "${TEST_NO}" "Check ntp.conf for properly configured NTP servers and a correctly functioning name service."
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3116
    # Description : Check for stratum 16 peers
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check peers with stratum value of 16"
    if [ ${SKIPTEST} -eq 0 ]; then
        COUNT=0
        LogText "Test: Checking stratum 16 sources from ntpq peers list"
        FIND=$(${NTPQBINARY} -p -n | ${AWKBINARY} '{ if ($2!=".POOL." && $3=="16") { print $1 }}')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN
            LogText "Result: All peers are lower than stratum 16"
        else
            for ITEM in ${FIND}; do
                LogText "Found stratum 16 peer: ${ITEM}"
                FIND2=$(${GREPBINARY} -E "^ntp-ignore-stratum-16-peer=${ITEM}" ${PROFILE})
                if IsEmpty "${FIND2}"; then
                    COUNT=$((COUNT + 1))
                    Report "ntp_stratum_16_peer[]=${ITEM}"
                else
                    LogText "Output: host ${ITEM} ignored by profile"
                fi
            done
            # Check if one or more high stratum time servers are found
            if [ ${COUNT} -eq 0 ]; then
                Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN
                LogText "Result: all non local servers are lower than stratum 16, or whitelisted within the scan profile"
            else
                Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_WARNING}" --color RED
                LogText "Result: Found ${COUNT} high stratum (16) peers)"
                ReportSuggestion "${TEST_NO}" "Check ntpq peers output for stratum 16 peers"
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3120
    # Description : Check unreliable peers from peer list
    # Notes       : Items with # are too far away (network distance)
    #               Items with - are not chosen due clustering algorithm
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check unreliable NTP peers"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking unreliable ntp peers"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} -E "^(-|#)" | ${AWKBINARY} '{ print $1 }' | ${SEDBINARY} 's/^-//g')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_NONE}" --color GREEN
            LogText "Result: No unreliable peers found"
        else
            Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_FOUND}" --color YELLOW
            LogText "Result: Found one or more unreliable peers (marked with a minus or dash sign)"
            for I in ${FIND}; do
                LogText "Unreliable peer: ${I}"
                Report "ntp_unreliable_peer[]=${I}"
            done
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for unreliable ntp peers and correct/replace them"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3124
    # Description : Check selected time source
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check selected time source"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking selected time source"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ if ($4=="l") { print $1 } }')
        FIND2=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ print $1 }')
        if [ -z "${FIND}" -a -n "${FIND2}" ]; then
            Display --indent 2 --text "- Checking selected time source" --result "${STATUS_OK}" --color GREEN
            FIND2=$(echo ${FIND2} | ${SEDBINARY} 's/*//g')
            LogText "Result: Found selected time source (value: ${FIND2})"
        else
            Display --indent 2 --text "- Checking selected time source" --result "${STATUS_WARNING}" --color RED
            LogText "Result: Found local source as selected time source. This could indicate that no external sources are available to sync with."
            LogText "Local source: ${FIND}"
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for selected time source"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3128
    # Description : Check time source candidates
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check preferred time source"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking preferred time source"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^+' | ${AWKBINARY} '{ print $1 }')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_NONE}" --color YELLOW
            LogText "Result: No other time source candidates found"
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for time source candidates"
        else
            Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_OK}" --color GREEN
            LogText "Result: Found one or more candidates to synchronize time with."
            for I in ${FIND}; do
                I=$(echo ${I} | ${SEDBINARY} 's/+//g')
                LogText "Candidate found: ${I}"
            done
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3132
    # Description : Check ntpq falsetickers
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP falsetickers"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking preferred time source"
        FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} -E '^x')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_OK}" --color GREEN
            LogText "Result: No falsetickers found (items preceding with an 'x')"
        else
            Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_NONE}" --color YELLOW
            LogText "Result: Found one or more falsetickers  (items preceding with an 'x')"
            for I in ${FIND}; do
                I=$(echo ${I} | ${SEDBINARY} 's/x//g')
                LogText "Falseticker found: ${I}"
                Report "ntp_falseticker[]=${I}"
            done
            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for falsetickers"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3136
    # Description : Check ntpq reported ntp version (Linux)
    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3136 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP protocol version"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking NTP protocol version (ntpq -c ntpversion)"
        FIND=$(${NTPQBINARY} -c ntpversion | ${AWKBINARY} '{ if ($1=="NTP" && $2=="version" && $5=="is") { print $6 } }')
        if [ -z "${FIND}" ]; then
            Display --indent 2 --text "- Checking NTP version" --result "${STATUS_UNKNOWN}" --color YELLOW
            LogText "Result: No NTP version found"
            ReportSuggestion "${TEST_NO}" "Check ntpq output for NTP protocol version"
        else
            Display --indent 2 --text "- Checking NTP version" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: Found NTP version ${FIND}"
            Report "ntp_version=${FIND}"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3146
    # Description : Check /etc/default/ntpdate (Linux)
    # Notes       : ntpdate-debian binary
    #if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    #Register --test-no TIME-3146 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/default/ntpdate"
    #if [ ${SKIPTEST} -eq 0 ]; then
#
#################################################################################
#
    # Test        : TIME-3148
    # Description : Check if TZ variable is set (Linux)
    # Notes       : without TZ variable set, a lot of unneeded calls might be performed.
    Register --test-no TIME-3148 --os Linux --weight L --network NO --category performance --description "Check TZ variable"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: testing for TZ variable"
        FIND="${TZ:=notset}"
        LogText "Result: found TZ variable with value ${FIND}"
        if [ "${FIND}" = "notset" ]; then
            Report "tz_variable_empty=1"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3160
    # Description : Check empty NTP step-tickers
    # Notes       : Mostly applies to Red Hat and clones
    FILE="${ROOTDIR}etc/ntp/step-tickers"
    if [ "${NTPD_RUNNING}" -eq 1 -a -n "${NTPQBINARY}" -a -f "${FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3160 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check empty NTP step-tickers"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        OUTPUT=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE})
        if [ -z "${OUTPUT}" ]; then
            if [ ${OS_REDHAT_OR_CLONE} -eq 1 -a -f "${FILE}" ]; then
                # On RedHat if step-ticker file exists but is empty, the ntpdate start script uses the servers listed in ntp.conf for the initial time synchronization
                LogText "Result: ${FILE} exists and it is empty. On RedHat the initial time synchronization will be done with the servers listed in ntp.conf."
                Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN
            else
                LogText "Result: ${FILE} is empty. The step-tickers contain no configured NTP servers"
                Display --indent 2 --text "- Checking NTP step-tickers file" --result "EMPTY FILE" --color YELLOW
                ReportSuggestion "${TEST_NO}" "Use step-tickers file for quicker time synchronization"
            fi
        else
            LogText "Result: ${FILE} is not empty, which is fine"
            Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN
            sFIND=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE} | ${GREPBINARY} -E -v "^127." | ${GREPBINARY} -E -v "^::1")
            for I in ${sFIND}; do
                FIND=$(${GREPBINARY} ^${I} ${FILE} | wc -l)
                if [ ${FIND} -gt 0 ]; then
                    LogText "Result: $I exist in ${FILE}"
                else
                    LogText "Result: ${I} does NOT exist in ${FILE}"
                    FOUND=1
                fi
            done
            if [ ${FOUND} -eq 1 ]; then
                Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "SOME MISSING" --color YELLOW
                ReportSuggestion "${TEST_NO}" "Some time servers missing in step-tickers file"
                AddHP 3 4
            else
                Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "${STATUS_OK}" --color GREEN
                LogText "Result: all time servers are in step-tickers file"
                AddHP 4 4
            fi
        fi
        LogText "Information: step-tickers is used by ntpdate where as ntp.conf is the configuration file for the ntpd daemon. ntpdate is initially run to set the clock before ntpd to make sure time is within 1000 sec."
        LogText "Risk: ntp will not run at boot if the time difference between the server and client by more then 1000 sec."
    fi
#
#################################################################################
#
    # Test        : TIME-3170
    # Description : Check file permissions and ownership of configuration files
    # Notes       : Files should be owned by root, or the user running
    #               Group owner should have only read access
    #               Other should preferably have no access, or read-only at max

    FILE_ARRAY="${ROOTDIR}etc/chrony.conf ${ROOTDIR}usr/pkg/etc/chrony.conf \
        ${ROOTDIR}etc/inet/ntp.conf ${ROOTDIR}etc/ntp.conf ${ROOTDIR}usr/local/etc/ntp.conf\
        ${ROOTDIR}etc/ntpd.conf ${ROOTDIR}etc/openntpd/ntpd.conf ${ROOTDIR}usr/local/etc/ntpd.conf"

    Register --test-no TIME-3170 --weight L --network NO --category security --description "Check configuration files"
    if [ ${SKIPTEST} -eq 0 ]; then
        for FILE in ${FILE_ARRAY}; do
            if [ -f ${FILE} ]; then
                LogText "Result: found ${FILE}"
                if IsWorldWritable ${FILE}; then
                    ReportWarning "${TEST_NO}" "Found world writable configuration file" "${FILE}" ""
                fi
                Report "ntp_config_file[]=${FILE}"
                NTP_CONFIG_FOUND=1
            fi
        done
    fi
#
#################################################################################
#
    # Test        : TIME-3180
    # Description : Report if ntpctl cannot communicate with OpenNTPD
    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi
    Register --test-no TIME-3180 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD"
    if [ ${SKIPTEST} -eq 0 ]; then
        if [ "${OPENNTPD_COMMUNICATION}" -eq 0 ]; then
            ReportWarning "${TEST_NO}" "OpenNTPD found, but ntpctl cannot communicate with" "${NTPCTLBINARY} -s status" "Restart OpenNTPD"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3181
    # Description : Check status of OpenNTPD time synchronisation
    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi

    Register --test-no TIME-3181 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation"
    if [ ${SKIPTEST} -eq 0 ]; then
        FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} "clock synced" )
        if [ -z "${FIND}" ]; then
            ReportWarning "${TEST_NO}" "OpenNTPD is not synchronising system time" "${NTPCTLBINARY} -s status" "text:Set time manually once or check network connectivity."
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3182
    # Description : Check OpenNTPD has working peers

    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi

    Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Format is "xx/yy peers valid, ..."
        FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} -E -o '[0-9]+/[0-9]+' | ${CUTBINARY} -d '/' -f 1)
        if [ -z "${FIND}" ] || [ "${FIND}" -eq 0 ]; then
            ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status"
        fi
    fi

#
#################################################################################
#

    # Test        : TIME-3185
    # Description : Check systemd-timesyncd synchronized time

    if [ "${NTP_DAEMON}" = "systemd-timesyncd" ]; then
        PREQS_MET="YES"
    else
        PREQS_MET="NO"
    fi


    Register --test-no TIME-3185 --preqs-met "${PREQS_MET}" --weight L --network NO --category "security" --description "Check systemd-timesyncd synchronized time"
    SYNCHRONIZED_FILE="/run/systemd/timesync/synchronized"
       
    if [ ${SKIPTEST} -eq 0 ]; then
        # On earlier systemd versions (237), '/run/systemd/timesync/synchronized' does not exist, so use '/var/lib/systemd/timesync/clock'
        if [ ! -e "${SYNCHRONIZED_FILE}" ]; then
            SYNCHRONIZED_FILE="/var/lib/systemd/timesync/clock"
        fi
        # DynamicUser=yes moves the clock file to '/var/lib/private/systemd/timesync/clock'
        if [ ! -e "${SYNCHRONIZED_FILE}" ]; then
            SYNCHRONIZED_FILE="/var/lib/private/systemd/timesync/clock"
        fi
        # Fix for debian stretch
        if [ ! -e "${SYNCHRONIZED_FILE}" ]; then
            SYNCHRONIZED_FILE="/var/lib/systemd/clock"
        fi
        if [ -e "${SYNCHRONIZED_FILE}" ]; then
           FIND=$(( $(date +%s) - $(${STATBINARY} -L --format %Y "${SYNCHRONIZED_FILE}") ))
           # Check if last sync was more than 2048 seconds (= the default of systemd) ago
           if [ "${FIND}" -ge 2048 ]; then
               COLOR=RED
               ReportWarning "${TEST_NO}" "systemd-timesyncd did not synchronized the time recently."
           else
               COLOR=GREEN
           fi
           Display --indent 2 --text "- Last time synchronization" --result "${FIND}s" --color "${COLOR}"
           LogText "Result: systemd-timesyncd synchronized time ${FIND} seconds ago."
        else
           Display --indent 2 --text "- Last time synchronization" --result "${STATUS_NOT_FOUND}" --color RED
           ReportWarning "${TEST_NO}" "systemd-timesyncd never successfully synchronized time"
        fi
    fi
    unset SYNCHRONIZED_FILE

#
#################################################################################
#

    Report "ntp_config_found=${NTP_CONFIG_FOUND}"
    Report "ntp_config_type_daemon=${NTP_CONFIG_TYPE_DAEMON}"
    Report "ntp_config_type_eventbased=${NTP_CONFIG_TYPE_EVENTBASED}"
    Report "ntp_config_type_scheduled=${NTP_CONFIG_TYPE_SCHEDULED}"
    Report "ntp_config_type_startup=${NTP_CONFIG_TYPE_STARTUP}"
    Report "ntp_daemon=${NTP_DAEMON}"
    Report "ntp_daemon_running=${NTP_DAEMON_RUNNING}"
#
#################################################################################
#
    # For VMs check ntpd.conf : tinker panic 0

    # OS        Time daemons  Configuration file
    # --------------------------------------------
    # AIX       xntpd         /etc/ntp.conf
    # HP
    # Linux     ntpd          /etc/ntp.conf
    #           chrony        /etc/chrony.conf
    # OpenBSD   ntpd          /etc/ntpd.conf
    # Solaris   xntpd         /etc/inet/ntp.conf

    WaitForKeyPress

#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com