usg remediation for chrony rule 2.3.3.2: Missing trailing new line
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
NTP Charm |
New
|
Undecided
|
Unassigned |
Bug Description
- Version: Ubuntu 22.04.4 LTS Jammy + usg 22.04.6
- NTP charm: 4.2 latest/stable rev 50
- Context: Applying cis_level1 hardening on units with ntp-charm subordinate
- Problem: NTP unit blocked after reboot `chrony: Not running`
- Debugging: `Fatal error : Too many arguments for include directive at line 45 in file /etc/chrony/
Indeed the line in `/etc/chrony/
```
include /etc/chrony/
```
Whereas the same line look like this on a non-hardened unit:
```
include /etc/chrony/
```
We suspect the CIS rule `2.3.3.2 Ensure chrony is running as user _chrony (Automated)` remediation script is defective. CIS documentation mentioned the following for this rule:
```
Remediation:
Add or edit the user line to /etc/chrony/
/etc/chrony/
user _chrony
```
Configuration should ideally look like this:
```
include /etc/chrony/
user _chrony
```
If we manually fix it, NTP charm becomes active/idle.
We suspect we are missing a trailing new line upon appending `user _chrony` to the `/etc/chrony/
The ntp-charm seems to replace the chrony configuration with a template: https:/