[chrony-users] (SCAP-Finding) command port has to be closed

[Nuß Bratling <nussbratling@xxxxxxxxx>]

Hi,

There are these rules: 

RHEL9: https://www.stigviewer.com/stig/red_hat_enterprise_linux_9/2023-09-13/finding/V-257947

RHEL8: https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/2021-06-14/finding/V-230486

We do monitoring, and these, above, rules define that the network monitoring (command) port (with less permissions) has to be closed, so that we have to connect to the unix socket with more permissions to get the monitoring metrics.

I'd argue that those rules make the security of a chrony installation worse instead of better.

I don't know if you know about these rules, and if no, would bringt it to your attention, that this rules perhaps should be changes, or, if you do know about these rules, I would like to ask what the rationale behind those are.

Thank you,

Moritz Molle