mediumservicesverified ✓rollback-safe

Ensure chrony network management is disabled

chrony-network-management-disabled · RHEL ≥ 8 · 1 impl

Description

The chrony cmdport directive must be set to 0 to disable network access to the chronyd command interface. This prevents remote management of the chrony daemon over the network.

Rationale

Remote access to the chrony management interface could allow an attacker to modify time synchronization settings. Disabling network management of chrony reduces the attack surface.

Check → Remediate

Checkcommand

grep -qE '^\s*cmdport\s+0\s*$' /etc/chrony.conf 2>/dev/null

expected_exit:: 0

Remediateconfig_set

path:: /etc/chrony.conf
key:: cmdport
value:: 0
restart:: chronyd

Framework references

STIG

V-280961 / RHEL-10-200543V-257947 / RHEL-09-252030V-230486

NIST 800-53

CM-7AU-8

Live verification

rhel8:check

#chrony#ntp#network#time