NTP server(s)

Gary Gapinski gapinski at nasa.gov
Fri Oct 26 16:08:30 UTC 2012


On 10/25/2012 03:46 PM, Jeffrey Blank wrote:
> Yes, yes.
> But I'm trying to determine whether we're asserting that there should be
> a compliance check (which would fail) in the STIG profile for systems
> running RHEL in a variety of network roles (which may quite reasonably
> only have one time server).  I am not keen on failing a majority of
> systems, in order to hold them to best practice for a specific use case.

If the practice of using a single, accurate, reliable NTP server is
common, then a compliance check for clients (without special needs)
requiring NTP active with 1+ servers is appropriate.

Use of a driftfile is recommended.

>
> It's certainly true that a system acting as an NTP server should have
> multiple time sources.  And we can have an NTP server profile which
> insists on precisely that.

Though a stratum 1 server needs only a single, accurate (and reliable)
time source.


More information about the scap-security-guide mailing list