openstack/ansible-hardening
Code Issues Proposed changes

Switch to rtcsync for chrony

Browse Source 
when setting security_ntp_sync_rtc to true, chrony will sync rtc every
11 minutes.

using rtcfile + rtcautotrim locks access to rtc clock for other tools,
like hwclock or timedatectl so it's hard to validate that the clock is
really synced.

Change-Id: I72fd18d36ab139d7140281374b5c2b89f7cb460a
This commit is contained in:
Marc Gariepy
2019-01-15 09:35:09 -05:00
parent ebb0f3ed83
commit ef1b417032
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
templates/chrony.conf.j2
View File

@@ -83,14 +83,12 @@ makestep 1 3
# mailonchange root@localhost 0.5 # mailonchange root@localhost 0.5
{% if security_ntp_sync_rtc | bool %} {% if security_ntp_sync_rtc | bool %}
# This directive tells chrony to regulate the real-time clock and tells it # The rtcsync directive enables a mode where the system time is periodically
# Where to store related data. It may not work on some newer motherboards # copied to the real time clock (RTC).
# that use the HPET real-time clock. It requires enhanced real-time # On Linux the RTC copy is performed by the kernel every 11 minutes. This
# support in the kernel. It is disabled by default because with certain # directive cannot be used when the normal RTC tracking is enabled, i.e. when
# combinations of motherboard and kernel it is reported to cause lockups. # the rtcfile directive is used.
rtcsync
rtcfile /var/lib/chrony/chrony.rtc
rtcautotrim 10
{% endif %} {% endif %}
# If the last line of this file reads 'rtconutc' chrony will assume that # If the last line of this file reads 'rtconutc' chrony will assume that