Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed chrony configuration options #121

Merged
merged 1 commit into from
Dec 13, 2023

Conversation

dulin
Copy link
Contributor

@dulin dulin commented Nov 22, 2023

Overall Review of Changes:
A general description of the changes made that are being requested for merge

Issue Fixes:
Issue not listed

Enhancements:
Current configuration contain wrong paths and unsupported directives:

Nov 21 12:40:51 lvd-etcd-app-l3 chronyd[681877]: commandkey directive is no longer supported
Nov 21 12:40:51 lvd-etcd-app-l3 chronyd[681877]: commandkey directive is no longer supported
Nov 21 12:40:51 lvd-etcd-app-l3 chronyd[681877]: Could not open keyfile /etc/chrony/chrony.keys
Nov 21 12:40:51 lvd-etcd-app-l3 chronyd[681877]: Could not open keyfile /etc/chrony/chrony.keys

By default on all my RHEL8 and RHEL9 based machines the keyfile is located in /etc/chrony.keys

Added configuration options for:
makestep: rhel9cis_chrony_server_makestep
By default is set default configuration which was on my RHEL9 sandbox it is worth to look for interesting topic regarding virtual machines: https://unix.stackexchange.com/questions/484467/chrony-client-do-not-change-system-and-hardware-date
I had similar issue when the clock was not adjusted which generated problems with one of my clusters.

minsources: rhel9cis_chrony_server_minsources
Worth looking into documentation: https://chrony-project.org/faq.html#_how_can_i_make_the_system_clock_more_secure
By default wanted to set this parameter as: "{{ ((rhel9cis_time_synchronization_servers | length) / 2) | round | int }}" but decided to set static number 2

How has this been tested?:
Not tested

Signed-off-by: Marcin Dulinski <martin@dulin.me.uk>
Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
Please join in the conversation happening on the Discord Server as well.

Copy link
Member

@uk-bolly uk-bolly left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change

@uk-bolly uk-bolly merged commit 998eaf3 into ansible-lockdown:devel Dec 13, 2023
4 checks passed
@uk-bolly uk-bolly mentioned this pull request Apr 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants