ansible-lockdown / UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
https://ansible-lockdown.readthedocs.io/en/latest/
MIT License
181 stars 80 forks source link

systemd-timesyncd NTP configuration error #161

Closed Jeroen0494 closed 11 months ago

Jeroen0494 commented 11 months ago

Describe the Issue Using the following variables:

## Control 2.1.1.1
# This variable choses the tool used for time synchronization
# The three options are `chrony`, `ntp`, and `systemd-timesyncd`.
ubtu22cis_time_sync_tool: "systemd-timesyncd"

## Controls 2.1.2.1 2.1.3.1, 2.1.4.1 - Configure time pools & servers for chrony, timesyncd, and ntp
# The following variable represents a list of of time server pools used
# for configuring chrony, timesyncd, and ntp.
# Each list item contains two settings, `name` (the domain name of the pool) and synchronization `options`.
# The default setting for the `options` is `iburst maxsources 4` -- please refer to the documentation
# of the time synchronization mechanism you are using.
ubtu22cis_time_pool:
    - name: 0.nl.pool.ntp.org
    - name: 1.nl.pool.ntp.org
    - name: 2.nl.pool.ntp.org
    - name: 3.nl.pool.ntp.org"

# The following variable represents a list of of time servers used
# for configuring chrony, timesyncd, and ntp.
# Each list item contains two settings, `name` (the domain name of the server) and synchronization `options`.
# The default setting for the `options` is `iburst` -- please refer to the documentation
# of the time synchronization mechanism you are using.
ubtu22cis_time_servers:
    - name: 0.pool.ntp.org
    - name: 1.pool.ntp.org
    - name: 2.pool.ntp.org
    - name: 3.pool.ntp.org

The following configuration is generated:

$ cat /etc/systemd/timesyncd.conf.d/50-timesyncd.conf 
## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC

NTP=[{'name': '0.nl.pool.ntp.org'}, {'name': '1.nl.pool.ntp.org'}, {'name': '2.nl.pool.ntp.org'}, {'name': '3.nl.pool.ntp.org"'}]

FallbackNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org

Expected Behavior NTP should be a string, much like FallbackNTP.

Actual Behavior A JSON list is generated and pasted in the file

Control(s) Affected What controls are being affected by the issue

Environment (please complete the following information):

Possible Solution Change the template from this:

## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC

NTP={{ ubtu22cis_time_pool }}

FallbackNTP={% for servers in ubtu22cis_time_servers %}{{ servers.name }} {% endfor %}

To this:

## Ansible controlled file
# Added as part of ansible-lockdown CIS baseline
# provided by MindPointGroup LLC

NTP={% for servers in ubtu22cis_time_pool %}{{ servers.name }} {% endfor %}

FallbackNTP={% for servers in ubtu22cis_time_servers %}{{ servers.name }} {% endfor %}