#!/bin/sh ################################################################################# # # Lynis # ------------------ # # Copyright 2007-2013, Michael Boelen # Copyright 2007-2021, CISOfy # # Website : https://cisofy.com # Blog : http://linux-audit.com # GitHub : https://github.com/CISOfy/lynis # # Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are # welcome to redistribute it under the terms of the GNU General Public License. # See LICENSE file for usage of this software. # ################################################################################# # # Time # ################################################################################# # InsertSection "${SECTION_TIME_AND_SYNCHRONIZATION}" # ################################################################################# # CRON_DIRS="${ROOTDIR}etc/cron.d ${ROOTDIR}etc/cron.hourly ${ROOTDIR}etc/cron.daily ${ROOTDIR}etc/cron.weekly ${ROOTDIR}etc/cron.monthly ${ROOTDIR}var/spool/crontabs" CHRONY_CONF_FILE="" NTP_DAEMON="" NTP_DAEMON_RUNNING=0 NTP_CONFIG_FOUND=0 NTP_CONFIG_TYPE_DAEMON=0 NTP_CONFIG_TYPE_SCHEDULED=0 NTP_CONFIG_TYPE_EVENTBASED=0 NTP_CONFIG_TYPE_STARTUP=0 NTPD_RUNNING=0 # Specific for ntpd OPENNTPD_COMMUNICATION=0 # if ntpctl can communicate SYSTEMD_NTP_ENABLED=0 # ################################################################################# # # Test : TIME-3104 # Description : Check for a running NTP daemon if [ -f /sys/hypervisor/type ]; then # TODO: Skip NTP tests if we are in a DomU xen instance FIND=$(cat /sys/hypervisor/type) if [ "${FIND}" = "xen" ]; then PREQS_MET="NO"; else PREQS_MET="YES"; fi elif [ -f /sbin/sysctl ] && [ "$(/sbin/sysctl -n security.jail.jailed 2>/dev/null || echo 0)" -eq 1 ]; then # Skip NTP tests if we're in a FreeBSD jail PREQS_MET="NO" else PREQS_MET="YES" fi Register --test-no TIME-3104 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for running NTP daemon or client" if [ ${SKIPTEST} -eq 0 ]; then # Linux/FreeBSD (ntpdate), OpenBSD (ntpd, rdate), Chrony, systemd-timesyncd LogText "Test: Searching for a running NTP daemon or available client" FOUND=0 SEARCH_FILES="${ROOTDIR}etc/chrony.conf ${ROOTDIR}etc/chrony/chrony.conf" for FILE in ${SEARCH_FILES}; do if [ -f ${FILE} ]; then LogText "result: found chrony configuration: ${FILE}"; CHRONY_CONF_FILE="${FILE}"; fi done if [ -n "${CHRONY_CONF_FILE}" ]; then if IsRunning "chronyd"; then FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd" Display --indent 2 --text "- NTP daemon found: chronyd" --result "${STATUS_FOUND}" --color GREEN else LogText "Result: found chrony configuration, but no running daemon" fi else LogText "Result: no chrony configuration found" fi # Check time daemon (eg DragonFly BSD) if IsRunning "dntpd"; then FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="dntpd" Display --indent 2 --text "- NTP daemon found: dntpd" --result "${STATUS_FOUND}" --color GREEN fi # Check for OpenNTPD, ntpctl comes with a "regular" install if [ -n "${NTPCTLBINARY}" ]; then # In contrast to timectl, "synchronised: yes" is not grepped. # Reason: openntpd syncs only if large time corrections are not required or -s is passed. # This might be not intended by the administrator (-s is NOT the default!) FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd: ntp engine" | ${GREPBINARY} -v "grep") # Status code 0 is when communication over the socket is successful if ${NTPCTLBINARY} -s status > /dev/null 2> /dev/null; then FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd" LogText "result: found openntpd (method: ntpctl)" OPENNTPD_COMMUNICATION=1 elif [ -n "${FIND}" ] ; then # Reasons for ntpctl to fail might be someone spawned a new process thus overwriting the socket, # then ended it, but another openntpd process is still running FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd" LogText "result: found openntpd (method: ps)" else LogText "result: running openntpd not found, but ntpctl is installed" fi if [ "${NTP_DAEMON}" = "openntpd" ]; then Display --indent 2 --text "- NTP daemon found: OpenNTPD" --result "${STATUS_FOUND}" --color GREEN fi fi # Check running processes (ntpd from ntp.org) # As checking by process name is ambiguous (openntpd has the same process name), # this check will be skipped if openntpd has been found. FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "ntpd: " | ${GREPBINARY} -v "grep") if [ "${NTP_DAEMON}" != "openntpd" ] && [ -n "${FIND}" ]; then FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1 NTP_DAEMON="ntpd" LogText "Result: found running NTP daemon in process list" Display --indent 2 --text "- NTP daemon found: ntpd" --result "${STATUS_FOUND}" --color GREEN fi # Check time daemon (eg NetBSD) if IsRunning "timed"; then FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="timed" Display --indent 2 --text "- NTP daemon found: timed" --result "${STATUS_FOUND}" --color GREEN fi # Check timedate daemon (systemd) FIND=$(${PSBINARY} ax | ${GREPBINARY} "systemd-timesyncd" | ${GREPBINARY} -v "grep") if [ -n "${FIND}" ]; then FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd" Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "${STATUS_FOUND}" --color GREEN LogText "Result: Found running systemd-timesyncd in process list" fi # Check crontab for OpenBSD/FreeBSD # Check anacrontab for Linux CRONTAB_FILES="/etc/anacrontab /etc/crontab" # Regex for matching multiple time synchronisation binaries # Partial sanity check for sntp and ntpdig, but this does not consider all corner cases CRONTAB_REGEX='ntpdate|rdate|sntp.+-(s|j|--adj)|ntpdig.+-(S|s)' for I in ${CRONTAB_FILES}; do if [ -f ${I} ]; then LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in crontab file ${I}" FIND=$(${GREPBINARY} -E "${CRONTAB_REGEX}" ${I} | ${GREPBINARY} -v '^#') if [ -n "${FIND}" ]; then FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1 Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN LogText "Result: found ntpdate, rdate, sntp or ntpdig reference in crontab file ${I}" else #Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_NOT_FOUND}" --color WHITE LogText "Result: no ntpdate, rdate, sntp or ntpdig reference found in crontab file ${I}" fi else LogText "Result: crontab file ${I} not found" fi done # Notes: only test for normal files. File /etc/cron.d/FIFO on solaris is a special file and test may hang # Linux systems may have a .placeholder file FOUND_IN_CRON=0 # Check cron jobs for I in ${CRON_DIRS}; do for J in "${I}"/*; do # iterate over folders in a safe way # Check: regular file, readable and not called .placeholder FIND=$(echo "${J}" | ${GREPBINARY} -E '/.placeholder$') if [ -f "${J}" ] && [ -r "${J}" ] && [ -z "${FIND}" ]; then LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in ${J}" FIND=$("${GREPBINARY} -E" "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") if [ -n "${FIND}" ]; then FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1 LogText "Result: found ntpdate, rdate, sntp or ntpdig in ${J}" fi fi done done if [ ${FOUND_IN_CRON} -eq 1 ]; then Display --indent 2 --text "- Checking NTP client in cron files" --result "${STATUS_FOUND}" --color GREEN LogText "Result: found ntpdate or rdate in cron directory" else LogText "Result: no ntpdate or rdate found in cron directories" fi # Checking if ntpdate is performed by event LogText "Test: checking for file /etc/network/if-up.d/ntpdate" if [ -f /etc/network/if-up.d/ntpdate ]; then LogText "Result: found ntpdate action when network interface comes up" FOUND=1 NTP_CONFIG_TYPE_EVENTBASED=1 Display --indent 2 --text "- Checking event based ntpdate (if-up)" --result "${STATUS_FOUND}" --color GREEN else LogText "Result: file /etc/network/if-up.d/ntpdate does not exist" fi # Configuration file for *BSD if [ -f /etc/rc.conf ]; then LogText "Test: Checking if ntpdate is enabled at startup in *BSD" FIND=$(${GREPBINARY} 'ntpdate_enable="YES"' /etc/rc.conf) if [ -n "${FIND}" ]; then LogText "Result: ntpdate is enabled in rc.conf" FOUND=1 NTP_CONFIG_TYPE_STARTUP=1 # Only show suggestion when ntpdate is enabled, however ntpd is not running if [ ${NTP_DAEMON_RUNNING} -eq 0 ]; then ReportSuggestion "${TEST_NO}" "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon" fi else LogText "Result: ntpdate is not enabled in rc.conf" fi fi if [ ${FOUND} -eq 0 ]; then if [ ${ISVIRTUALMACHINE} -eq 1 ]; then LogText "Result: Skipping display warning, as virtual machines usually don't need time synchronization in the VM itself" else Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_WARNING}" --color RED LogText "Result: Could not find a NTP daemon or client" ReportSuggestion "${TEST_NO}" "Use NTP daemon or NTP client to prevent time issues." AddHP 0 2 fi else Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_OK}" --color GREEN LogText "Result: Found a time syncing daemon/client." AddHP 3 3 fi fi # ################################################################################# # # Test : TIME-3106 # Description : Check status of systemd time synchronization if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a -n "${TIMEDATECTL}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check systemd NTP time synchronization status" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Check the status of time synchronization via timedatectl" FIND=$(${TIMEDATECTL} status | ${GREPBINARY} -E "(NTP|System clock) synchronized: yes") if [ -z "${FIND}" ]; then LogText "Result: time not synchronized via NTP" ReportSuggestion "${TEST_NO}" "Check timedatectl output. Synchronization via NTP is enabled, but status reflects it is not synchronized" fi fi # ################################################################################# # # Test : TIME-3112 # Description : Check for valid associations from ntpq peers list if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3112 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check active NTP associations ID's" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking for NTP association ID's from ntpq peers list" FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} "No association ID's returned") if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_FOUND}" --color GREEN LogText "Result: Found one or more association ID's" else Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_WARNING}" --color RED ReportSuggestion "${TEST_NO}" "Check ntp.conf for properly configured NTP servers and a correctly functioning name service." fi fi # ################################################################################# # # Test : TIME-3116 # Description : Check for stratum 16 peers if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check peers with stratum value of 16" if [ ${SKIPTEST} -eq 0 ]; then COUNT=0 LogText "Test: Checking stratum 16 sources from ntpq peers list" FIND=$(${NTPQBINARY} -p -n | ${AWKBINARY} '{ if ($2!=".POOL." && $3=="16") { print $1 }}') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN LogText "Result: All peers are lower than stratum 16" else for ITEM in ${FIND}; do LogText "Found stratum 16 peer: ${ITEM}" FIND2=$(${GREPBINARY} -E "^ntp-ignore-stratum-16-peer=${ITEM}" ${PROFILE}) if IsEmpty "${FIND2}"; then COUNT=$((COUNT + 1)) Report "ntp_stratum_16_peer[]=${ITEM}" else LogText "Output: host ${ITEM} ignored by profile" fi done # Check if one or more high stratum time servers are found if [ ${COUNT} -eq 0 ]; then Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN LogText "Result: all non local servers are lower than stratum 16, or whitelisted within the scan profile" else Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_WARNING}" --color RED LogText "Result: Found ${COUNT} high stratum (16) peers)" ReportSuggestion "${TEST_NO}" "Check ntpq peers output for stratum 16 peers" fi fi fi # ################################################################################# # # Test : TIME-3120 # Description : Check unreliable peers from peer list # Notes : Items with # are too far away (network distance) # Items with - are not chosen due clustering algorithm if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check unreliable NTP peers" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking unreliable ntp peers" FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} -E "^(-|#)" | ${AWKBINARY} '{ print $1 }' | ${SEDBINARY} 's/^-//g') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_NONE}" --color GREEN LogText "Result: No unreliable peers found" else Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_FOUND}" --color YELLOW LogText "Result: Found one or more unreliable peers (marked with a minus or dash sign)" for I in ${FIND}; do LogText "Unreliable peer: ${I}" Report "ntp_unreliable_peer[]=${I}" done ReportSuggestion "${TEST_NO}" "Check ntpq peers output for unreliable ntp peers and correct/replace them" fi fi # ################################################################################# # # Test : TIME-3124 # Description : Check selected time source if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check selected time source" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking selected time source" FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ if ($4=="l") { print $1 } }') FIND2=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ print $1 }') if [ -z "${FIND}" -a -n "${FIND2}" ]; then Display --indent 2 --text "- Checking selected time source" --result "${STATUS_OK}" --color GREEN FIND2=$(echo ${FIND2} | ${SEDBINARY} 's/*//g') LogText "Result: Found selected time source (value: ${FIND2})" else Display --indent 2 --text "- Checking selected time source" --result "${STATUS_WARNING}" --color RED LogText "Result: Found local source as selected time source. This could indicate that no external sources are available to sync with." LogText "Local source: ${FIND}" ReportSuggestion "${TEST_NO}" "Check ntpq peers output for selected time source" fi fi # ################################################################################# # # Test : TIME-3128 # Description : Check time source candidates if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check preferred time source" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking preferred time source" FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^+' | ${AWKBINARY} '{ print $1 }') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_NONE}" --color YELLOW LogText "Result: No other time source candidates found" ReportSuggestion "${TEST_NO}" "Check ntpq peers output for time source candidates" else Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_OK}" --color GREEN LogText "Result: Found one or more candidates to synchronize time with." for I in ${FIND}; do I=$(echo ${I} | ${SEDBINARY} 's/+//g') LogText "Candidate found: ${I}" done fi fi # ################################################################################# # # Test : TIME-3132 # Description : Check ntpq falsetickers if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP falsetickers" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking preferred time source" FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} -E '^x') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_OK}" --color GREEN LogText "Result: No falsetickers found (items preceding with an 'x')" else Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_NONE}" --color YELLOW LogText "Result: Found one or more falsetickers (items preceding with an 'x')" for I in ${FIND}; do I=$(echo ${I} | ${SEDBINARY} 's/x//g') LogText "Falseticker found: ${I}" Report "ntp_falseticker[]=${I}" done ReportSuggestion "${TEST_NO}" "Check ntpq peers output for falsetickers" fi fi # ################################################################################# # # Test : TIME-3136 # Description : Check ntpq reported ntp version (Linux) if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3136 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP protocol version" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking NTP protocol version (ntpq -c ntpversion)" FIND=$(${NTPQBINARY} -c ntpversion | ${AWKBINARY} '{ if ($1=="NTP" && $2=="version" && $5=="is") { print $6 } }') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking NTP version" --result "${STATUS_UNKNOWN}" --color YELLOW LogText "Result: No NTP version found" ReportSuggestion "${TEST_NO}" "Check ntpq output for NTP protocol version" else Display --indent 2 --text "- Checking NTP version" --result "${STATUS_FOUND}" --color GREEN LogText "Result: Found NTP version ${FIND}" Report "ntp_version=${FIND}" fi fi # ################################################################################# # # Test : TIME-3146 # Description : Check /etc/default/ntpdate (Linux) # Notes : ntpdate-debian binary #if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi #Register --test-no TIME-3146 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/default/ntpdate" #if [ ${SKIPTEST} -eq 0 ]; then # ################################################################################# # # Test : TIME-3148 # Description : Check if TZ variable is set (Linux) # Notes : without TZ variable set, a lot of unneeded calls might be performed. Register --test-no TIME-3148 --os Linux --weight L --network NO --category performance --description "Check TZ variable" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: testing for TZ variable" FIND="${TZ:=notset}" LogText "Result: found TZ variable with value ${FIND}" if [ "${FIND}" = "notset" ]; then Report "tz_variable_empty=1" fi fi # ################################################################################# # # Test : TIME-3160 # Description : Check empty NTP step-tickers # Notes : Mostly applies to Red Hat and clones FILE="${ROOTDIR}etc/ntp/step-tickers" if [ "${NTPD_RUNNING}" -eq 1 -a -n "${NTPQBINARY}" -a -f "${FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no TIME-3160 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check empty NTP step-tickers" if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 OUTPUT=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE}) if [ -z "${OUTPUT}" ]; then if [ ${OS_REDHAT_OR_CLONE} -eq 1 -a -f "${FILE}" ]; then # On RedHat if step-ticker file exists but is empty, the ntpdate start script uses the servers listed in ntp.conf for the initial time synchronization LogText "Result: ${FILE} exists and it is empty. On RedHat the initial time synchronization will be done with the servers listed in ntp.conf." Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN else LogText "Result: ${FILE} is empty. The step-tickers contain no configured NTP servers" Display --indent 2 --text "- Checking NTP step-tickers file" --result "EMPTY FILE" --color YELLOW ReportSuggestion "${TEST_NO}" "Use step-tickers file for quicker time synchronization" fi else LogText "Result: ${FILE} is not empty, which is fine" Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN sFIND=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE} | ${GREPBINARY} -E -v "^127." | ${GREPBINARY} -E -v "^::1") for I in ${sFIND}; do FIND=$(${GREPBINARY} ^${I} ${FILE} | wc -l) if [ ${FIND} -gt 0 ]; then LogText "Result: $I exist in ${FILE}" else LogText "Result: ${I} does NOT exist in ${FILE}" FOUND=1 fi done if [ ${FOUND} -eq 1 ]; then Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "SOME MISSING" --color YELLOW ReportSuggestion "${TEST_NO}" "Some time servers missing in step-tickers file" AddHP 3 4 else Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "${STATUS_OK}" --color GREEN LogText "Result: all time servers are in step-tickers file" AddHP 4 4 fi fi LogText "Information: step-tickers is used by ntpdate where as ntp.conf is the configuration file for the ntpd daemon. ntpdate is initially run to set the clock before ntpd to make sure time is within 1000 sec." LogText "Risk: ntp will not run at boot if the time difference between the server and client by more then 1000 sec." fi # ################################################################################# # # Test : TIME-3170 # Description : Check file permissions and ownership of configuration files # Notes : Files should be owned by root, or the user running # Group owner should have only read access # Other should preferably have no access, or read-only at max FILE_ARRAY="${ROOTDIR}etc/chrony.conf ${ROOTDIR}usr/pkg/etc/chrony.conf \ ${ROOTDIR}etc/inet/ntp.conf ${ROOTDIR}etc/ntp.conf ${ROOTDIR}usr/local/etc/ntp.conf\ ${ROOTDIR}etc/ntpd.conf ${ROOTDIR}etc/openntpd/ntpd.conf ${ROOTDIR}usr/local/etc/ntpd.conf" Register --test-no TIME-3170 --weight L --network NO --category security --description "Check configuration files" if [ ${SKIPTEST} -eq 0 ]; then for FILE in ${FILE_ARRAY}; do if [ -f ${FILE} ]; then LogText "Result: found ${FILE}" if IsWorldWritable ${FILE}; then ReportWarning "${TEST_NO}" "Found world writable configuration file" "${FILE}" "" fi Report "ntp_config_file[]=${FILE}" NTP_CONFIG_FOUND=1 fi done fi # ################################################################################# # # Test : TIME-3180 # Description : Report if ntpctl cannot communicate with OpenNTPD if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ]; then PREQS_MET="YES" else PREQS_MET="NO" fi Register --test-no TIME-3180 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD" if [ ${SKIPTEST} -eq 0 ]; then if [ "${OPENNTPD_COMMUNICATION}" -eq 0 ]; then ReportWarning "${TEST_NO}" "OpenNTPD found, but ntpctl cannot communicate with" "${NTPCTLBINARY} -s status" "Restart OpenNTPD" fi fi # ################################################################################# # # Test : TIME-3181 # Description : Check status of OpenNTPD time synchronisation if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then PREQS_MET="YES" else PREQS_MET="NO" fi Register --test-no TIME-3181 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation" if [ ${SKIPTEST} -eq 0 ]; then FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} "clock synced" ) if [ -z "${FIND}" ]; then ReportWarning "${TEST_NO}" "OpenNTPD is not synchronising system time" "${NTPCTLBINARY} -s status" "text:Set time manually once or check network connectivity." fi fi # ################################################################################# # # Test : TIME-3182 # Description : Check OpenNTPD has working peers if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then PREQS_MET="YES" else PREQS_MET="NO" fi Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers" if [ ${SKIPTEST} -eq 0 ]; then # Format is "xx/yy peers valid, ..." FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} -E -o '[0-9]+/[0-9]+' | ${CUTBINARY} -d '/' -f 1) if [ -z "${FIND}" ] || [ "${FIND}" -eq 0 ]; then ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status" fi fi # ################################################################################# # # Test : TIME-3185 # Description : Check systemd-timesyncd synchronized time if [ "${NTP_DAEMON}" = "systemd-timesyncd" ]; then PREQS_MET="YES" else PREQS_MET="NO" fi Register --test-no TIME-3185 --preqs-met "${PREQS_MET}" --weight L --network NO --category "security" --description "Check systemd-timesyncd synchronized time" SYNCHRONIZED_FILE="/run/systemd/timesync/synchronized" if [ ${SKIPTEST} -eq 0 ]; then # On earlier systemd versions (237), '/run/systemd/timesync/synchronized' does not exist, so use '/var/lib/systemd/timesync/clock' if [ ! -e "${SYNCHRONIZED_FILE}" ]; then SYNCHRONIZED_FILE="/var/lib/systemd/timesync/clock" fi # DynamicUser=yes moves the clock file to '/var/lib/private/systemd/timesync/clock' if [ ! -e "${SYNCHRONIZED_FILE}" ]; then SYNCHRONIZED_FILE="/var/lib/private/systemd/timesync/clock" fi # Fix for debian stretch if [ ! -e "${SYNCHRONIZED_FILE}" ]; then SYNCHRONIZED_FILE="/var/lib/systemd/clock" fi if [ -e "${SYNCHRONIZED_FILE}" ]; then FIND=$(( $(date +%s) - $(${STATBINARY} -L --format %Y "${SYNCHRONIZED_FILE}") )) # Check if last sync was more than 2048 seconds (= the default of systemd) ago if [ "${FIND}" -ge 2048 ]; then COLOR=RED ReportWarning "${TEST_NO}" "systemd-timesyncd did not synchronized the time recently." else COLOR=GREEN fi Display --indent 2 --text "- Last time synchronization" --result "${FIND}s" --color "${COLOR}" LogText "Result: systemd-timesyncd synchronized time ${FIND} seconds ago." else Display --indent 2 --text "- Last time synchronization" --result "${STATUS_NOT_FOUND}" --color RED ReportWarning "${TEST_NO}" "systemd-timesyncd never successfully synchronized time" fi fi unset SYNCHRONIZED_FILE # ################################################################################# # Report "ntp_config_found=${NTP_CONFIG_FOUND}" Report "ntp_config_type_daemon=${NTP_CONFIG_TYPE_DAEMON}" Report "ntp_config_type_eventbased=${NTP_CONFIG_TYPE_EVENTBASED}" Report "ntp_config_type_scheduled=${NTP_CONFIG_TYPE_SCHEDULED}" Report "ntp_config_type_startup=${NTP_CONFIG_TYPE_STARTUP}" Report "ntp_daemon=${NTP_DAEMON}" Report "ntp_daemon_running=${NTP_DAEMON_RUNNING}" # ################################################################################# # # For VMs check ntpd.conf : tinker panic 0 # OS Time daemons Configuration file # -------------------------------------------- # AIX xntpd /etc/ntp.conf # HP # Linux ntpd /etc/ntp.conf # chrony /etc/chrony.conf # OpenBSD ntpd /etc/ntpd.conf # Solaris xntpd /etc/inet/ntp.conf WaitForKeyPress # #================================================================================ # Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com