Run exactly one time synchronization daemon

Description

Ubuntu ships several NTP clients: systemd-timesyncd (the default up to 24.04), chrony (the default from 26.04, with chronyd-restricted as an alternative unit from 24.04), ntp (20.04 and 22.04), ntpsec (from 22.04) and openntpd. Exactly one of them must be active.

The check counts units by their real name, so an alias (chronyd.service, ntp.service provided by ntpsec) is not counted twice. The packages conflict with each other, so two daemons rarely coexist; the usual failure is no daemon at all, for example in a container where systemd-timesyncd does not start (the host keeps the time). Containers can exclude this control in their tailoring file. The daemon's own settings are checked by CB-UBU-SVC-015 (timesyncd) and CB-UBU-SVC-016 (chrony).

Rationale

Logs, audit trails and authentication protocols rely on accurate time. With no daemon the clock drifts; with two, each corrects the other and the clock jumps, which corrupts timelines during an investigation.

Impact

None known when one daemon is already active, which is the Ubuntu default.

Audit

Run systemctl is-active chrony chronyd-restricted systemd-timesyncd ntp ntpsec openntpd. Exactly one line must print active (an alias of an active unit prints active too: check systemctl show -p Id <unit>).

Automated: every check must pass. Scanners report each check by its id.

single-daemon

Number of active time synchronization daemons.

script: |
  act=
  for u in chrony chronyd-restricted systemd-timesyncd ntp ntpsec openntpd; do
    systemctl is-active --quiet "$u.service" 2>/dev/null || continue
    id=$(systemctl show -p Id --value "$u.service" 2>/dev/null)
    case " $act " in *" ${id:-$u.service} "*) ;; *) act="$act ${id:-$u.service}" ;; esac
  done
  echo "active:${act:- none}"
  [ "$(echo $act | wc -w)" -eq 1 ]

Remediation

• No daemon: run systemctl enable --now systemd-timesyncd (20.04 to 24.04) or systemctl enable --now chrony (26.04), or apt install chrony.
• Several daemons: keep one, then systemctl mask --now <unit> for the others or purge their packages.

References

• Ubuntu Server documentation - About time synchronisation Canonical, vendor-doc, accessed 2026-10-19
• systemd-timesyncd.service(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• chronyd(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-SVC-015 Configure systemd-timesyncd with approved time servers and keep it running
• related CB-UBU-SVC-016 Configure chrony with time sources, run it unprivileged and keep it running

People and lifecycle