Run exactly one time synchronization daemon

Description

Debian ships several NTP clients: systemd-timesyncd (the default on most installs), chrony, chronyd-restricted (Debian 13), ntpsec and openntpd. Exactly one of them must be active.

The Debian packages conflict with each other, so two daemons rarely coexist; the usual failure is no daemon at all, for example in a container where systemd-timesyncd does not start (the host keeps the time). Containers can exclude this control in their tailoring file. The daemon's own settings are checked by CB-DEB-SVC-015 (timesyncd) and CB-DEB-SVC-016 (chrony).

Rationale

Logs, audit trails and authentication protocols rely on accurate time. With no daemon the clock drifts; with two, each corrects the other and the clock jumps, which corrupts timelines during an investigation.

Impact

None known when one daemon is already active, which is the Debian default.

Audit

Run systemctl is-active chrony chronyd-restricted systemd-timesyncd ntpsec openntpd. Exactly one line must print active.

Automated: every check must pass. Scanners report each check by its id.

single-daemon

Number of active time synchronization daemons.

script: |
  n=0 act=
  for u in chrony chronyd-restricted systemd-timesyncd ntpsec openntpd; do
    if systemctl is-active --quiet "$u.service" 2>/dev/null; then
      n=$((n + 1)) act="$act $u"
    fi
  done
  echo "active:${act:- none}"
  [ "$n" -eq 1 ]

Remediation

• No daemon: run systemctl enable --now systemd-timesyncd, or apt install chrony.
• Several daemons: keep one, then systemctl mask --now <unit> for the others or purge their packages.

References

• Debian Wiki - NTP Debian, vendor-doc, accessed 2026-10-18
• systemd-timesyncd.service(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• chronyd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-SVC-015 Configure systemd-timesyncd with approved time servers and keep it running
• related CB-DEB-SVC-016 Configure chrony with time sources, run it unprivileged and keep it running

People and lifecycle