feat: Implements CIS Benchmark - 2.1.2 Ensure chrony is configured

[brakkio86]

Enhancement:
I changed the template for chrony sysconfig in order to implement CIS Benchmark recomendation for RHEL.

Reason:
Be compatible with CIS Benchmark "2.1.2 Ensure chrony is configured" on a RHEL.

Result:
CIS Benchmark compatible.

Issue Tracker Tickets (Jira or BZ if any):
N.A.

[spetrosi]

[citest]

[mlichvar]

-u chrony is the default on RHEL. It doesn't need to be set. Other distributions may have different names for the user.

[richm]

Thanks @mlichvar - so the PR as it stands needs some work so that it will only set -u chrony on those platforms that do not set a default user.

[brakkio86]

Hello, in RHEL the compiled-in default user is "chrony" user, on the other hand, CIS benchmark want to be sure that is also the effective configuration. Is it possible to add a check in order to implements it only on RHEL. Another way to allow the implementation is to allow to customization of the sysconfig file.
Thanks,
Francesco

[richm]

Hello, in RHEL the compiled-in default user is "chrony" user, on the other hand, CIS benchmark want to be sure that is also the effective configuration. Is it possible to add a check in order to implements it only on RHEL. Another way to allow the implementation is to allow to customization of the sysconfig file. Thanks, Francesco

I'm not sure what you are trying to do. Are you running some sort of CIS compliance scanner that is complaining that chronyd is not using -u chrony? If so, then it seems to be that the right answer isn't to force -u chrony using this role.

[brakkio86]

Hello, in RHEL the compiled-in default user is "chrony" user, on the other hand, CIS benchmark want to be sure that is also the effective configuration. Is it possible to add a check in order to implements it only on RHEL. Another way to allow the implementation is to allow to customization of the sysconfig file. Thanks, Francesco

I'm not sure what you are trying to do. Are you running some sort of CIS compliance scanner that is complaining that chronyd is not using -u chrony? If so, then it seems to be that the right answer isn't to force -u chrony using this role.

Yes, I'm appling CIS compliant configuration. On the other hand, this role broke the configuation as it removes -u chrony settings. What do you suggest?

[richm]

Hello, in RHEL the compiled-in default user is "chrony" user, on the other hand, CIS benchmark want to be sure that is also the effective configuration. Is it possible to add a check in order to implements it only on RHEL. Another way to allow the implementation is to allow to customization of the sysconfig file. Thanks, Francesco

I'm not sure what you are trying to do. Are you running some sort of CIS compliance scanner that is complaining that chronyd is not using -u chrony? If so, then it seems to be that the right answer isn't to force -u chrony using this role.

Yes, I'm appling CIS compliant configuration. On the other hand, this role broke the configuation as it removes -u chrony settings. What do you suggest?

Well, as @mlichvar says, the default on RHEL is -u chrony. So for CIS compliance, do you just need a way to determine what that default value is?

[brakkio86]

Well, as @mlichvar says, the default on RHEL is -u chrony. So for CIS compliance, do you just need a way to determine what that default value is?

Unfotunally no, CIS Security mandatory requires explicit user in /etc/sysconfig/chronyd. Maybe is it possbible to parametrize OPTIONS section in /etc/sysconfig/chronyd.

[mlichvar]

If a new option needs to be added to the role for this, I'd prefer a more general approach specifying directly the additional chronyd options included in /etc/sysconfig/chronyd, e.g. timesync_chronyd_custom_options.

[richm]

If a new option needs to be added to the role for this, I'd prefer a more general approach specifying directly the additional chronyd options included in /etc/sysconfig/chronyd, e.g. timesync_chronyd_custom_options.

The role already has timesync_chrony_custom_settings - so maybe timesync_chrony_sysconfig_settings for settings applied to /etc/sysconfig/chrony?

[mlichvar]

Some systems don't have sysconfig, e.g. on Debian the options are in /etc/default/chrony, so the I think the name should be general enough to work on all potentially supported distros.

[richm]

Some systems don't have sysconfig, e.g. on Debian the options are in /etc/default/chrony, so the I think the name should be general enough to work on all potentially supported distros.

Ok - what about timesync_chrony_service_settings?

[mlichvar]

That's better. I'm not sure if it's clear enough that it's the command-line options. I suspect someone could confuse it with the systemd service settings.

[brakkio86]

Hello, I've updated with the suggestion and using timesync_chrony_service_settings. What do you think now?

[richm]

[citest]

[richm]

How can we test this? e.g. add or modify a test in https://github.com/linux-system-roles/timesync/tree/main/tests ?

[richm]

I had to close and reopen the PR to trigger checks - not sure why the checks were not being run . . .

[richm]

Need a test for this in tests/