lowsystemverified ✓

Ensure chrony steps the clock when the offset exceeds one second

chrony-makestep-configured · UBUNTU ≥ 22 · 1 impl

Description

chrony must be configured with 'makestep 1 -1' so the system steps (rather than slews) its clock whenever the offset from the authoritative time source is greater than one second.

Rationale

Slewing a large clock offset can take a long time to converge, leaving security-relevant timestamps inaccurate. Stepping the clock on any offset above one second keeps audit and authentication timestamps trustworthy.

Check → Remediate

Checkcommand

# STIG: 'grep -ir makestep /etc/chrony*' must yield exactly 'makestep 1 -1'.
ms=$(grep -rhiE '^[[:space:]]*makestep[[:space:]]' /etc/chrony.conf /etc/chrony/ 2>/dev/null | head -1)
[ -n "$ms" ] || { echo "FAIL: makestep not configured under /etc/chrony"; exit 1; }
norm=$(printf '%s\n' "$ms" | tr -s '[:space:]' ' ' | sed 's/^ *//; s/ *$//')
[ "$norm" = "makestep 1 -1" ] || {
  echo "FAIL: makestep is '$norm', expected 'makestep 1 -1'"; exit 1; }
echo "OK: $norm"; exit 0

expected_exit:: 0

Remediatemanual

note:: Set 'makestep 1 -1' in /etc/chrony/chrony.conf (or a file under /etc/chrony/conf.d/) and restart chrony: systemctl restart chrony.service

Framework references

STIG

V-270752 / UBTU-24-600180V-260520 / UBTU-22-252015

NIST 800-53

AU-8

Live verification

ubuntu22:checkubuntu24:check

#chrony#time#ntp#stig