Configure NTP server with chrony and security hardening for precise time synchronization

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m' # No Color

# Global variables
NETWORK_ALLOW=""
CLEANUP_DONE=false

# Usage message
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  -n, --network CIDR    Network to allow NTP access (default: 192.168.1.0/24)"
    echo "  -h, --help           Show this help message"
    echo ""
    echo "Example: $0 --network 10.0.0.0/8"
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }

# Cleanup function
cleanup() {
    if [ "$CLEANUP_DONE" = false ]; then
        log_warn "Installation failed, performing cleanup..."
        systemctl stop chrony 2>/dev/null || true
        systemctl disable chrony 2>/dev/null || true
        rm -f /etc/chrony/chrony.conf.backup 2>/dev/null || true
        CLEANUP_DONE=true
    fi
}

# Set trap for cleanup on error
trap cleanup ERR

# Parse arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -n|--network)
            NETWORK_ALLOW="$2"
            shift 2
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            log_error "Unknown option: $1"
            usage
            exit 1
            ;;
    esac
done

# Set default network if not provided
NETWORK_ALLOW=${NETWORK_ALLOW:-"192.168.1.0/24"}

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root"
    exit 1
fi

# Detect distribution and set package manager
log_info "[1/10] Detecting distribution..."
if [ ! -f /etc/os-release ]; then
    log_error "Cannot detect distribution: /etc/os-release not found"
    exit 1
fi

. /etc/os-release
case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_UPDATE="apt update && apt upgrade -y"
        PKG_INSTALL="apt install -y"
        PKG_REMOVE="apt remove -y"
        FIREWALL_CMD="ufw"
        CHRONY_USER="chrony"
        ;;
    almalinux|rocky|centos|rhel|ol)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf update -y"
        PKG_INSTALL="dnf install -y"
        PKG_REMOVE="dnf remove -y"
        FIREWALL_CMD="firewalld"
        CHRONY_USER="chrony"
        ;;
    fedora)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf update -y"
        PKG_INSTALL="dnf install -y"
        PKG_REMOVE="dnf remove -y"
        FIREWALL_CMD="firewalld"
        CHRONY_USER="chrony"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_UPDATE="yum update -y"
        PKG_INSTALL="yum install -y"
        PKG_REMOVE="yum remove -y"
        FIREWALL_CMD="firewalld"
        CHRONY_USER="chrony"
        ;;
    *)
        log_error "Unsupported distribution: $ID"
        exit 1
        ;;
esac

log_info "Detected: $PRETTY_NAME"

# Update system packages
log_info "[2/10] Updating system packages..."
$PKG_UPDATE

# Install chrony and required tools
log_info "[3/10] Installing chrony and ntpstat..."
$PKG_INSTALL chrony ntpstat openssl

# Stop and disable conflicting services
log_info "[4/10] Stopping conflicting NTP services..."
for service in ntp ntpd systemd-timesyncd; do
    systemctl stop $service 2>/dev/null || true
    systemctl disable $service 2>/dev/null || true
done

# Remove conflicting packages
if [ "$PKG_MGR" = "apt" ]; then
    $PKG_REMOVE ntp ntpdate 2>/dev/null || true
else
    $PKG_REMOVE ntp ntpdate 2>/dev/null || true
fi

# Backup existing chrony configuration
if [ -f /etc/chrony/chrony.conf ]; then
    cp /etc/chrony/chrony.conf /etc/chrony/chrony.conf.backup
fi

# Configure chrony main settings
log_info "[5/10] Configuring chrony..."
cat > /etc/chrony/chrony.conf << EOF
# Use reliable NTP pool servers
pool 0.pool.ntp.org iburst maxsources 4
pool 1.pool.ntp.org iburst maxsources 3
pool 2.pool.ntp.org iburst maxsources 3
pool 3.pool.ntp.org iburst maxsources 3

# Add public servers for redundancy
server time.cloudflare.com iburst
server time.google.com iburst

# Security settings
port 0
cmdport 323
bindcmdaddress 127.0.0.1
bindcmdaddress ::1

# Serve time to specified networks
allow $NETWORK_ALLOW
allow 10.0.0.0/8
allow 172.16.0.0/12

# Rate limiting
ratelimit interval 1 burst 16
ratelimit ntp interval 1 burst 8

# Logging and monitoring
log tracking measurements statistics
logdir /var/log/chrony

# Drift file and keys
driftfile /var/lib/chrony/chrony.drift
keyfile /etc/chrony/chrony.keys

# System clock settings
makestep 1.0 3
rtcsync

# Leap second handling
leapsectz right/UTC

# Local stratum when disconnected
local stratum 10
EOF

# Set proper permissions on config
chmod 644 /etc/chrony/chrony.conf

# Create chrony keys file
log_info "[6/10] Creating authentication keys..."
mkdir -p /etc/chrony
cat > /etc/chrony/chrony.keys << EOF
1 SHA1 HEX:$(openssl rand -hex 20)
2 SHA256 HEX:$(openssl rand -hex 32)
EOF

chmod 640 /etc/chrony/chrony.keys
chown root:$CHRONY_USER /etc/chrony/chrony.keys

# Create chrony log directory
log_info "[7/10] Setting up log directory..."
mkdir -p /var/log/chrony
chown $CHRONY_USER:$CHRONY_USER /var/log/chrony
chmod 755 /var/log/chrony

# Configure firewall
log_info "[8/10] Configuring firewall..."
if [ "$FIREWALL_CMD" = "ufw" ]; then
    ufw --force enable
    ufw allow from $NETWORK_ALLOW to any port 123 proto udp
    ufw allow from 10.0.0.0/8 to any port 123 proto udp
    ufw allow from 172.16.0.0/12 to any port 123 proto udp
    ufw limit 123/udp
else
    systemctl enable firewalld
    systemctl start firewalld
    firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"${NETWORK_ALLOW}\" port protocol=\"udp\" port=\"123\" accept"
    firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"10.0.0.0/8\" port protocol=\"udp\" port=\"123\" accept"
    firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"172.16.0.0/12\" port protocol=\"udp\" port=\"123\" accept"
    firewall-cmd --reload
fi

# Configure systemd service limits
log_info "[9/10] Hardening systemd service..."
mkdir -p /etc/systemd/system/chrony.service.d
cat > /etc/systemd/system/chrony.service.d/security.conf << EOF
[Service]
# Security hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/chrony /var/log/chrony
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
RestrictNamespaces=true
SystemCallArchitectures=native
EOF

# Start and enable chrony service
systemctl daemon-reload
systemctl enable chrony
systemctl start chrony

# Verification
log_info "[10/10] Verifying installation..."
sleep 3

if systemctl is-active --quiet chrony; then
    log_info "✓ Chrony service is running"
else
    log_error "✗ Chrony service is not running"
    exit 1
fi

if chrony sources &>/dev/null; then
    log_info "✓ Chrony sources are accessible"
else
    log_warn "! Chrony sources command failed (may need time to sync)"
fi

# Final status
log_info "NTP server installation completed successfully!"
log_info "Configuration file: /etc/chrony/chrony.conf"
log_info "Log directory: /var/log/chrony"
log_info "Allowed network: $NETWORK_ALLOW"
log_info ""
log_info "Check status with: chronyc sources -v"
log_info "Check tracking with: chronyc tracking"

CLEANUP_DONE=true