NTP charm causes non DISA-STIG compliance

[Jeff Hillman]

ubuntu 20.04.5
juju 2.9.37
charm latest/stable rev CH:50
ntp 3.5

When running `sudo usg fix disa_stig` against an ubuntu 20.04.5 machine, it becomes DISA-STIG compliant.

running `juju add-machine <user>@<ip>` and then `juju deploy ubuntu --to 0; juju deploy nfp; juju add-relation ntp ubuntu'` causes DISA-STIG to no longer be compliant

Specifically, running a diff against the compliant results `sudo usg audit disa_stig` and then against the newly deployed ntp charm causes the following diff:

```- <rule-result idref="chronyd_sync_clock" time="2022-11-18T17:02:54" severity="medium" weight="1.000000">
- <result>pass</result>
+ <rule-result idref="chronyd_sync_clock" time="2022-11-18T17:04:38" severity="medium" weight="1.000000">
+ <result>fail</result>
       <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
         <check-content-ref name="oval:ssg-chronyd_sync_clock:def:1" href="ssg-ubuntu2004-oval.xml"/>
       </check>
     </rule-result>
```

ntp charm is breaking the chronyd_sync_clock DISA-STIG compliance.

[Junien F (axino)]

Hi Jeff,

Would you have more details as to what's going on here ? What does the "chronyd_sync_clock" check do exactly ?

Is it possible that installing the charm changes the NTP sources, and so it takes chronyd some time to get in sync again ? (if these new sources are reachable at all)

Thanks

[Jeff Hillman (jhillman)]

Actually, you are correct. it is not setting it to a DoD approved source, which is charm configurable. Please disregard

https://www.stigviewer.com/stig/windows_server_20122012_r2_member_server/2018-10-30/finding/V-3472

[Junien F (axino)]

Sure - thanks !