Wrong results with OpenNTPD

[Varbin]

I'm using OpenNTPD instead of the default ntp on my FreeBSD server - when lynis analyses the ntp settings it tries to query information with ntpq which is (to my knowledge) is not possible with OpenNTPD.

Lynis will slow down as ntpq takes a while fail.

OS: FreeBSD 10.4
Lynis: 2.6.1 (768446e)

[ Lynis 2.6.1 ]

################################################################################
  Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
  welcome to redistribute it under the terms of the GNU General Public License.
  See the LICENSE file for details about using this software.

  2007-2018, CISOfy - https://cisofy.com/lynis/
  Enterprise support available (compliance, plugins, interface and tools)
################################################################################


[+] Initializing program
------------------------------------
  - Detecting OS...                                           [ DONE ]
  - Checking profiles...                                      [ DONE ]
  - Detecting language and localization                       [ de ]

  ---------------------------------------------------
  Program version:           2.6.1
  Operating system:          FreeBSD
  Operating system name:     FreeBSD
  Operating system version:  10.4-RELEASE-p3
  Kernel version:            GENERIC
  Hardware platform:         amd64
  Hostname:                  v16439
  ---------------------------------------------------
  Profiles:                  /root/lynis-master/default.prf
  Log file:                  /var/log/lynis.log
  Report file:               /var/log/lynis-report.dat
  Report version:            1.0
  Plugin directory:          ./plugins
  ---------------------------------------------------
  Auditor:                   [Not Specified]
  Language:                  de
  Test category:             all
  Test group:                all
  ---------------------------------------------------
  - Program update status...                                  [ NO UPDATE ]

(snip)

[+] Time and Synchronization
------------------------------------
  - NTP daemon found: ntpd                                    [ GEFUNDEN ]
  - Checking for a running NTP daemon or client               [ OK ]
localhost: timed out, nothing received
***Request timed out
  - Checking valid association ID's                           [ GEFUNDEN ]
localhost: timed out, nothing received
***Request timed out
  - Checking high stratum ntp peers                           [ OK ]
localhost: timed out, nothing received
***Request timed out
  - Checking unreliable ntp peers                             [ NICHTS ]
localhost: timed out, nothing received
***Request timed out
localhost: timed out, nothing received
***Request timed out
  - Checking selected time source                             [ WARNUNG ]
localhost: timed out, nothing received
***Request timed out
  - Checking time source candidates                           [ NICHTS ]
localhost: timed out, nothing received
***Request timed out
  - Checking falsetickers                                     [ OK ]

(snip)

  -[ Lynis 2.6.1 Results ]-

(snip)

  Suggestions (8):
  ----------------------------

(snip)

  * Check ntpq peers output for selected time source [TIME-3124] 
      https://cisofy.com/controls/TIME-3124/

  * Check ntpq peers output for time source candidates [TIME-3128] 
      https://cisofy.com/controls/TIME-3128/

[mboelen]

Do you have a particular suggestion for the detection? Or possibly a pull request to improve detection and what it runs?

[Varbin]

My idea would be to query the Openntpd servIce status (service openntpd (one)status. Also it should be detected that ntpq does time out.

[Varbin]

Another idea to distinguish OpenNTPD and ntpd: OpenNTPD is compiled with libre/openssl so the string "openssl" should be in the executable.

[abbapat]

Hi,
I am a budding cyber-security enthusiast. I am very new to open source and I want to take this up if nobody else is. Can I take this up?
Thanks.

[mboelen]

Hi @abbapat - Sure, you can definitely become part of this and make a contribution. If you decide to pick it up, please ensure it is POSIX compatible shell script (not bash). Detection of the service should be OS independent as much as possible. Typically searching in strings is not preferred, but possibly it can be done by looking at something that both NTP daemons share (e.g. -V for version information, or --help that might give a good indication)

[abbapat]

Hey, thanks for the tips! Let me have a look.

[mboelen]

Hi @abbapat - Do you have time to pick this up?

[Varbin]

OpenNTPD always has the sub processes named ntpd: ntp engine and ntpd: dns engine (both on FreeBSD and Debian).

"Classic" ntpd does only have a subprocess ntpd -p $path_to_pid -g -u $uid:$gid

Additionally any installation comes with ntpctl which is comparable to ntpq.

I'll prepare a pull request today.

[Varbin]

@mboelen Do you have some time to lookup at the pull request?

[mboelen]

Thanks @Varbin for your work on this. It has been merged.