On 10/25/2012 03:46 PM, Jeffrey Blank wrote:
Yes, yes.
But I'm trying to determine whether we're asserting that there should be
a compliance check (which would fail) in the STIG profile for systems
running RHEL in a variety of network roles (which may quite reasonably
only have one time server). I am not keen on failing a majority of
systems, in order to hold them to best practice for a specific use case.
If the practice of using a single, accurate, reliable NTP server is
common, then a compliance check for clients (without special needs)
requiring NTP active with 1+ servers is appropriate.
Use of a driftfile is recommended.
It's certainly true that a system acting as an NTP server should have
multiple time sources. And we can have an NTP server profile which
insists on precisely that.
Though a stratum 1 server needs only a single, accurate (and reliable)
time source.