V-269333

Discussion

Being able to determine the system time of a server can be useful information for various attacks from timebomb attacks to location discovery based on time zone. Minimizing the exposure of the server functionality of the chrony daemon reduces the attack surface.

Check Content

Verify AlmaLinux OS 9 disables the chrony daemon from acting as a server with the following command:

$ chronyd -p | grep -w port

port 0

If the "port" option is not set to "0" or is missing, this is a finding.