Bug 2192617

Summary:	When applying DISA STIG Profile it either automatically change the pool or recommend the person implementing the stig policy to use it.
Product:	Red Hat Enterprise Linux 8	Reporter:	jfaison
Component:	scap-security-guide	Assignee:	Vojtech Polasek <vpolasek>
Status:	NEW ---	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.0	CC:	ggasparb, gregory.l.king36.ctr, mhaicman, mlysonek, wsato
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 1 Greg King 2023-05-03 22:32:46 UTC

The title is misleading.

When applying the DISA stig profile, the default pool for /etc/chrony.conf should be us.pool.ntp.org instead of the global pool.  NTP requests to hostile countries are happening on the first boot of the newly installed OS before the admin can change the pool.  It is causing a lot of grief for DOD admin and security personnel.