{
  "id": "CB-UBU-SVC-014",
  "standard": "ubuntu",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-SVC-014",
  "json": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-SVC-014.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/CB-UBU-SVC-014.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-SVC-014",
    "title": "Run exactly one time synchronization daemon",
    "finding": {
      "title": "The system clock is not synchronized, or several daemons fight over it",
      "description": "Wrong timestamps break log correlation, certificate checks and Kerberos; two daemons make the clock jump."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "time",
      "ntp",
      "chrony",
      "timesyncd"
    ],
    "description": "Ubuntu ships several NTP clients: `systemd-timesyncd` (the default up to 24.04), `chrony` (the\ndefault from 26.04, with `chronyd-restricted` as an alternative unit from 24.04), `ntp` (20.04\nand 22.04), `ntpsec` (from 22.04) and `openntpd`. Exactly one of them must be active.\n",
    "rationale": "Logs, audit trails and authentication protocols rely on accurate time. With no daemon the\nclock drifts; with two, each corrects the other and the clock jumps, which corrupts timelines\nduring an investigation.\n",
    "impact": "None known when one daemon is already active, which is the Ubuntu default.\n",
    "notes": "The check counts units by their real name, so an alias (`chronyd.service`, `ntp.service` provided\nby `ntpsec`) is not counted twice. The packages conflict with each other, so two daemons rarely\ncoexist; the usual failure\nis no daemon at all, for example in a container where `systemd-timesyncd` does not start\n(the host keeps the time). Containers can exclude this control in their tailoring file. The\ndaemon's own settings are checked by CB-UBU-SVC-015 (timesyncd) and CB-UBU-SVC-016 (chrony).\n",
    "audit": {
      "manual": "Run `systemctl is-active chrony chronyd-restricted systemd-timesyncd ntp ntpsec openntpd`.\nExactly one line must print `active` (an alias of an active unit prints `active` too: check\n`systemctl show -p Id <unit>`).\n",
      "checks": [
        {
          "id": "single-daemon",
          "engine": "shell",
          "description": "Number of active time synchronization daemons.",
          "spec": {
            "script": "act=\nfor u in chrony chronyd-restricted systemd-timesyncd ntp ntpsec openntpd; do\n  systemctl is-active --quiet \"$u.service\" 2>/dev/null || continue\n  id=$(systemctl show -p Id --value \"$u.service\" 2>/dev/null)\n  case \" $act \" in *\" ${id:-$u.service} \"*) ;; *) act=\"$act ${id:-$u.service}\" ;; esac\ndone\necho \"active:${act:- none}\"\n[ \"$(echo $act | wc -w)\" -eq 1 ]\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "- No daemon: run `systemctl enable --now systemd-timesyncd` (20.04 to 24.04) or\n  `systemctl enable --now chrony` (26.04), or `apt install chrony`.\n- Several daemons: keep one, then `systemctl mask --now <unit>` for the others or purge their\n  packages.\n"
    },
    "references": [
      {
        "title": "Ubuntu Server documentation - About time synchronisation",
        "url": "https://documentation.ubuntu.com/server/explanation/networking/about-time-synchronisation/",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "systemd-timesyncd.service(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/systemd-timesyncd.service.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "chronyd(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/chronyd.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-8",
        "relation": "partial"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-45",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1070.006"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-SVC-015",
        "type": "related"
      },
      {
        "id": "CB-UBU-SVC-016",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on the stock image (systemd-timesyncd only) and after chrony replaced it."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on the stock image (systemd-timesyncd only) and after chrony replaced it."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on the stock image (systemd-timesyncd only) and after chrony replaced it."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on the stock image (chrony only)."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}