sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

tailoring: waive chronyd_server_directive — check-only companion of the secure_ntp NTP-server waivers (#17)

Browse Source 
Its OVAL requires a literal ^server line in the baked chrony.conf, which can
never exist under secure_ntp: the fail-closed re-strip removes every static
server and the NTS source is derived at runtime into /run/chrony-dhcp. Surfaced
as the single REVIEW row on scan poam-hardening-4e9ab45 (the first full scan of
the post-secure-ntp merge).
This commit is contained in:
Audiobuzz
2026-07-12 09:25:02 +00:00
parent 4e9ab45d34
commit 943f3e29ce
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/diskless-tailoring.xml
+7 -1
View File
@@ -181,10 +181,16 @@
DNS/NTP spoofer could shift the clock through it — the exact F-03 risk).
Unselect so remediation adds no plain server; 2c-STIG-postfix also
re-strips any server/pool when secure_ntp=true (belt-and-suspenders).
The STIG intent (time IS synchronised, authenticated under NTS) is met.
chronyd_server_directive is the CHECK-ONLY companion (requires a literal
`^server` line in the baked chrony.conf/chrony.d — impossible under
secure_ntp, where the NTS source lands in /run/chrony-dhcp at runtime;
surfaced as the 1 REVIEW on scan poam-hardening-4e9ab45, the first
post-secure-ntp full scan). The STIG intent (time IS synchronised,
authenticated under NTS) is met.
Justified in docs/stig-deviations.md #17. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_server_directive" selected="false"/>
</xccdf:Profile>
</xccdf:Tailoring>