# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-SVC-014
title: Run exactly one time synchronization daemon
finding:
  title: The system clock is not synchronized, or several daemons fight over it
  description: Wrong timestamps break log correlation, certificate checks and Kerberos; two daemons make the clock jump.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [time, ntp, chrony, timesyncd]

description: |
  Ubuntu ships several NTP clients: `systemd-timesyncd` (the default up to 24.04), `chrony` (the
  default from 26.04, with `chronyd-restricted` as an alternative unit from 24.04), `ntp` (20.04
  and 22.04), `ntpsec` (from 22.04) and `openntpd`. Exactly one of them must be active.
rationale: |
  Logs, audit trails and authentication protocols rely on accurate time. With no daemon the
  clock drifts; with two, each corrects the other and the clock jumps, which corrupts timelines
  during an investigation.
impact: |
  None known when one daemon is already active, which is the Ubuntu default.
notes: |
  The check counts units by their real name, so an alias (`chronyd.service`, `ntp.service` provided
  by `ntpsec`) is not counted twice. The packages conflict with each other, so two daemons rarely
  coexist; the usual failure
  is no daemon at all, for example in a container where `systemd-timesyncd` does not start
  (the host keeps the time). Containers can exclude this control in their tailoring file. The
  daemon's own settings are checked by CB-UBU-SVC-015 (timesyncd) and CB-UBU-SVC-016 (chrony).

audit:
  manual: |
    Run `systemctl is-active chrony chronyd-restricted systemd-timesyncd ntp ntpsec openntpd`.
    Exactly one line must print `active` (an alias of an active unit prints `active` too: check
    `systemctl show -p Id <unit>`).
  checks:
    - id: single-daemon
      engine: shell
      description: Number of active time synchronization daemons.
      spec:
        script: |
          act=
          for u in chrony chronyd-restricted systemd-timesyncd ntp ntpsec openntpd; do
            systemctl is-active --quiet "$u.service" 2>/dev/null || continue
            id=$(systemctl show -p Id --value "$u.service" 2>/dev/null)
            case " $act " in *" ${id:-$u.service} "*) ;; *) act="$act ${id:-$u.service}" ;; esac
          done
          echo "active:${act:- none}"
          [ "$(echo $act | wc -w)" -eq 1 ]

remediation:
  manual: |
    - No daemon: run `systemctl enable --now systemd-timesyncd` (20.04 to 24.04) or
      `systemctl enable --now chrony` (26.04), or `apt install chrony`.
    - Several daemons: keep one, then `systemctl mask --now <unit>` for the others or purge their
      packages.

references:
  - title: Ubuntu Server documentation - About time synchronisation
    url: https://documentation.ubuntu.com/server/explanation/networking/about-time-synchronisation/
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: systemd-timesyncd.service(8), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man8/systemd-timesyncd.service.8.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: chronyd(8), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man8/chronyd.8.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
mappings:
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-8
    relation: partial
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SC-45
    relation: related
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "2.3.1.1"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "2.3.1.1"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "2.3.1.1"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "2.3.1.1"
    relation: equivalent
threats:
  - framework: mitre-attack
    id: T1070.006
related_controls:
  - id: CB-UBU-SVC-015
    type: related
  - id: CB-UBU-SVC-016
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic
    notes: "Passes on the stock image (systemd-timesyncd only) and after chrony replaced it."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic
    notes: "Passes on the stock image (systemd-timesyncd only) and after chrony replaced it."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic
    notes: "Passes on the stock image (systemd-timesyncd only) and after chrony replaced it."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic
    notes: "Passes on the stock image (chrony only)."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19