[chrony-users] Chrony permissions question.

["Kohr, Alexander" <Alexander.Kohr@xxxxxxxxxxxxxxx>]

 

My IT security group is using a new tool and as part of the security scan results for a new RHEL 7.7 box, the tool is complaining that a few home directories including chrony’s (/var/lib/chrony) have permissions that are too permissive at 755 instead of 750 or more secure. In reality this may just be an issue with the tool not knowing that chrony’s permissions are that way by default, as there are other user accounts like the ntp users on the box with home directories permissions of 755 and it is not complaining about them. (I am going to follow up on this as well.) Though there are other application specific user account with permissions of 700, so I wonder if chrony could be the same.

 

I know in RHEL 7 the default location of the drift file sis the home directory of /var/lib/chrony. (I also know it is the recommended location for some other files if they are enabled in the chrony configuration.)

Is there a reasons that the chrony home directory is /var/lib/chrony instead of something else, that does not contain the drift file?   

If so is there a reason that the chrony home directory permission are 755 instead of 750 or 700?

 

 

 

 

 

_________________________

Alexander Kohr

Unix Systems Administrator

Temple University Health System

2450 W. Hunting Park Ave

Philadelphia PA 19129

Alexander.Kohr@xxxxxxxxxxxxxxx

267-666-8341 (Corporate Cell)

 

---

This electronic message is intended to be for the use of the named recipient, and may contain information that is confidential or privileged. This communication may contain protected health information (PHI) that is legally protected from inappropriate disclosure by the Privacy Standards of the Health Insurance Portability and Accountability Act (HIPAA) and relevant Pennsylvania Laws. You can direct questions concerning PHI or HIPAA to the Corporate Compliance and Privacy Officer at (215) 707-5605. If you are not the intended recipient, please note that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this message in error, you should notify the sender immediately by telephone or by return e-mail and delete and destroy all copies of this message.