From 943f3e29ce265a256f7db845da617c09283d48e6 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sun, 12 Jul 2026 09:25:02 +0000 Subject: [PATCH] =?UTF-8?q?tailoring:=20waive=20chronyd=5Fserver=5Fdirecti?= =?UTF-8?q?ve=20=E2=80=94=20check-only=20companion=20of=20the=20secure=5Fn?= =?UTF-8?q?tp=20NTP-server=20waivers=20(#17)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Its OVAL requires a literal ^server line in the baked chrony.conf, which can never exist under secure_ntp: the fail-closed re-strip removes every static server and the NTS source is derived at runtime into /run/chrony-dhcp. Surfaced as the single REVIEW row on scan poam-hardening-4e9ab45 (the first full scan of the post-secure-ntp merge). --- docs/stig-deviations.md | 17 +++++++++++++---- files/stig/diskless-tailoring.xml | 8 +++++++- 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/docs/stig-deviations.md b/docs/stig-deviations.md index 33664dc..d29ce79 100644 --- a/docs/stig-deviations.md +++ b/docs/stig-deviations.md @@ -298,11 +298,20 @@ boot; (b) no other chrony-log AVC (extend here if one appears); (c) **reproducibility** — `semodule -i` rebuilds the policy store, re-check verity hash stability (same concern as #14/#15). Only shipped when `enable_stig=true`. -## 17. STIG NTP-server rules unselected under `secure_ntp` (added 2026-07-11) +## 17. STIG NTP-server rules unselected under `secure_ntp` (added 2026-07-11; +`chronyd_server_directive` 2026-07-12) -**Rules waived:** `chronyd_specify_remote_server`, `chronyd_or_ntpd_set_maxpoll` -(unselected in `diskless-tailoring.xml`; plus a belt-and-suspenders re-strip in -`2c-STIG-postfix`). +**Rules waived:** `chronyd_specify_remote_server`, `chronyd_or_ntpd_set_maxpoll`, +`chronyd_server_directive` (unselected in `diskless-tailoring.xml`; plus a +belt-and-suspenders re-strip in `2c-STIG-postfix`). + +**Addendum 2026-07-12 (scan `poam-hardening-4e9ab45` — the first full scan of the +post-secure-ntp merge):** `chronyd_server_directive` is the **check-only companion** +of the two rules above — its OVAL requires a literal `^server` line in the baked +`/etc/chrony.conf` (or `/etc/chrony.d/*.conf`). Under `secure_ntp` that can never +exist: the re-strip removes every static server (each would be an unauthenticated +fallback defeating NTS fail-closure), and the real NTS source is derived from the +DHCP domain at runtime into `/run/chrony-dhcp` (a path the OVAL doesn't inspect). +Same rationale as below applies; added to the waiver set. **Why:** these rules remediate by writing a **static, unauthenticated** `server maxpoll 16` into `/etc/chrony.conf`. The fleet instead configures diff --git a/files/stig/diskless-tailoring.xml b/files/stig/diskless-tailoring.xml index 90b8b51..a63c68d 100644 --- a/files/stig/diskless-tailoring.xml +++ b/files/stig/diskless-tailoring.xml @@ -181,10 +181,16 @@ DNS/NTP spoofer could shift the clock through it — the exact F-03 risk). Unselect so remediation adds no plain server; 2c-STIG-postfix also re-strips any server/pool when secure_ntp=true (belt-and-suspenders). - The STIG intent (time IS synchronised, authenticated under NTS) is met. + chronyd_server_directive is the CHECK-ONLY companion (requires a literal + `^server` line in the baked chrony.conf/chrony.d — impossible under + secure_ntp, where the NTS source lands in /run/chrony-dhcp at runtime; + surfaced as the 1 REVIEW on scan poam-hardening-4e9ab45, the first + post-secure-ntp full scan). The STIG intent (time IS synchronised, + authenticated under NTS) is met. Justified in docs/stig-deviations.md #17. --> +