documentation_complete: true

prodtype: rhel7,fedora

title: 'Specify a Remote NTP Server'

description: |-
    Depending on specific functional requirements of a concrete
    production environment, the Red Hat Enterprise Linux 7 Server system can be
    configured to utilize the services of the <tt>chronyd</tt> NTP daemon (the
    default), or services of the <tt>ntpd</tt> NTP daemon. Refer to
    <weblink-macro link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html" />
    for more detailed comparison of the features of both of the choices, and for
    further guidance how to choose between the two NTP daemons.
    <br />
    To specify a remote NTP server for time synchronization, perform the following:
    <ul>
    <li> if the system is configured to use the <tt>chronyd</tt> as the NTP daemon (the
    default), edit the file <tt>/etc/chrony.conf</tt> as follows,</li>
    <li> if the system is configured to use the <tt>ntpd</tt> as the NTP daemon,
    edit the file <tt>/etc/ntp.conf</tt> as documented below.</li>
    </ul>
    Add or correct the following lines, substituting the IP or hostname of a remote
    NTP server for <em>ntpserver</em>:
    <pre>server <i>ntpserver</i></pre>
    This instructs the NTP software to contact that remote server to obtain time
    data.

rationale: |-
    Synchronizing with an NTP server makes it possible to collate system
    logs from multiple sources or correlate computer events with real time events.

severity: medium

identifiers:
    cce@rhel7: 27278-1

references:
    cis: 3.6
    cui: 3.3.7
    disa: 160
    nist: AU-8(1)
    pcidss: Req-10.4.1,Req-10.4.3

ocil_clause: 'this is not the case'

ocil: |-
    To verify that a remote NTP service is configured for time synchronization,
    open the following file:
    <ul>
    <li><pre>/etc/chrony.conf</pre> in the case the system in question is
    configured to use the <tt>chronyd</tt> as the NTP daemon (default setting)</li>
    <li><pre>/etc/ntp.conf</pre> in the case the system in question is configured
    to use the <tt>ntpd</tt> as the NTP daemon</li>
    </ul>
    In the file, there should be a section similar to the following:
    <pre>server <i>ntpserver</i></pre>
