Configure The ntpd Service Properly

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130372");
  script_version("2025-12-04T05:40:45+0000");
  script_tag(name:"last_modification", value:"2025-12-04 05:40:45 +0000 (Thu, 04 Dec 2025)");
  script_tag(name:"creation_date", value:"2025-05-07 11:44:21 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Configure The ntpd Service Properly");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_eulerosvirtual_openeuler");

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.6 Time Synchronization: 3.6.1 Configure The ntpd Service Properly (Recommendation)");
  script_xref(name:"Policy", value:"EulerOS Virtual: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.6 Time Synchronization: 3.6.1 Configure The ntpd Service Properly (Recommendation)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.6 Time Synchronization: 3.6.1 Configure The ntpd Service Properly (Recommendation)");

  script_tag(name:"summary", value:"In the cluster scenario, the time of servers must be accurate
and consistent. For example, if the server time is inconsistent, the data generated by different
servers may be sorted or compared inaccurately.

Even if you run the date command to set the time of all servers to the same value, the time of the
servers may be inaccurate or inconsistent as the time goes by. Therefore, to ensure that the time
of all servers in the environment is synchronized and accurate, a time server that can be
synchronized must be available. Other servers in the network synchronize time with the time server.

When the ntpd service is used to implement time synchronization but the ntpd service is not
configured properly, the server time may be inaccurate. As a result, the time of different servers
may be inconsistent.

Inaccurate server time brings serious problems to time-sensitive data such as finance and order
data. For example, due to inaccurate server time, a piece of accounting data may fall in other
financial period, resulting in an incorrect ending balance in the balance sheet.

If the time of servers is inconsistent, the time of packets generated by each server is different.
If data flows derived from multiple servers are processed in a certain sequence and the time of the
server in the next phase is earlier than that of the previous server, the received packets may be
discarded because the time of the received packets is later than the local time.");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

title = "Configure The ntpd Service Properly";

solution = "1. Configure the local device as the time source and add the NTP permission control
configuration to the /etc/ntp.conf file.

# vim /etc/ntp.conf
restrict

- IP or netmask_IP: IP address for permission control. The value can be default, indicating all IP
addresses<semicolon> a specific IP address without a mask, for example, 192.168.1.2or an IP address
with a mask, indicating an IP address range, for example, 192.168.0.0 mask 255.255.255.0 (servers
with IP addresses ranging from 192.168.0.1 to 192.168.0.154 can connect to this server to obtain
the NTP service).
- parameter: parameter for permission control.
- For example, restrict default nomodify notrap nopeer noquery indicates that servers with any IP
addresses can synchronize time with the local device functioning as the time source, but services
cannot be queried or modified in the system.

2. Add the following configuration to the /etc/ntp.conf file to configure the time server
(remote-server indicates the IP address of the remote time server) for the local device functioning
as the client:

# vim /etc/ntp.conf
server

3. After the preceding two configurations are complete, run the service ntpd restart command to
restart the ntpd service. (The two configurations can be performed at the same time. That is, the
local host functions as a client to obtain time from a remote server or as a server to synchronize
other servers.)
# service ntpd restart";

check_type = "SSH_Cmd";

action = '1. Run the command in the terminal:
# service ntpd status 2>/dev/null | grep -e "[a]ctive (running)"

2. Run the command in the terminal:
# grep "^\\s*restrict" /etc/ntp.conf 2>/dev/null

3. Run the command in the terminal:
# grep -E "^\\s*(server|pool)" /etc/ntp.conf 2>/dev/null';

expected_value = '1. The output should not be empty
2. The output should not be empty
3. The output should not be empty';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

overall_pass = FALSE;
actual_value = "";

# ------------------------------------------------------------------
# CHECK 1 :  Check ntpd is active or not
# ------------------------------------------------------------------

step_cmd_check_1 = 'service ntpd status 2>/dev/null | grep -e "[a]ctive (running)"';
step_res_check_1 = ssh_cmd(socket:sock, cmd:step_cmd_check_1, return_errors:TRUE, return_linux_errors_only:TRUE);
actual_value += '1. ' + step_res_check_1 + '\n';
check_result_1 = FALSE;

if(step_res_check_1){
  check_result_1 = TRUE;
}

# ------------------------------------------------------------------
# CHECK 2 :  Check restrict keyword in /etc/ntp.conf
# ------------------------------------------------------------------

step_cmd_check_2 = 'grep "^\\s*restrict" /etc/ntp.conf 2>/dev/null';
step_res_check_2 = ssh_cmd(socket:sock, cmd:step_cmd_check_2, return_errors:TRUE, return_linux_errors_only:TRUE);
actual_value += '2. ' + step_res_check_2 + '\n';
check_result_2 = FALSE;

if(step_res_check_2){
  check_result_2 = TRUE;
}

# ------------------------------------------------------------------
# CHECK 3 :  Check "(server|pool)" in  /etc/ntp.conf`
# ------------------------------------------------------------------

step_cmd_check_3 = 'grep -E "^\\s*(server|pool)" /etc/ntp.conf 2>/dev/null';
step_res_check_3 = ssh_cmd(socket:sock, cmd:step_cmd_check_3, return_errors:TRUE, return_linux_errors_only:TRUE);
actual_value += '3. ' + step_res_check_3 + '\n';
check_result_3 = FALSE;

if(step_res_check_3){
  check_result_3 = TRUE;
}

# ------------------------------------------------------------------
# FINAL RESULT
# ------------------------------------------------------------------

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the some audit check. Please try again.";
}
else if(check_result_1 && check_result_2 && check_result_3){
  compliant = "yes";
  comment = "All checks passed";
}else{
  compliant = "no";
  comment = "One or more checks failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);