The system clock must be synchronized continuously, or at least daily.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22290	GEN000241	SV-39091r1_rule	ECSC-1	Medium

Description
A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. Internal system clocks tend to drift and require periodic resynchronization to ensure their accuracy. Software, such as ntpd, can be used to continuously synchronize the system clock with authoritative sources. Alternatively, the system may be synchronized periodically, with a maximum of one day between synchronizations. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

Description

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. Internal system clocks tend to drift and require periodic resynchronization to ensure their accuracy. Software, such as ntpd, can be used to continuously synchronize the system clock with authoritative sources. Alternatively, the system may be synchronized periodically, with a maximum of one day between synchronizations. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-38064r1_chk )
Check the root crontab for ntpdate jobs running at least daily. # crontab -l \| grep ntpdate columns 3, 4, and 5 must be an asterisk (*) for the job to be run daily. If this job exists, this is not a finding. OR Verify the auto-startup of xntpd in /etc/rc.tcpip. # cat /etc/rc.tcpip \| grep –v “^#” Check the system for a running NTP daemon, which is the preferred method. # ps -ef \| grep ntp If an (x)ntpd process exists, this is not a finding. Otherwise, this is a finding.

Check Text ( C-38064r1_chk )

Check the root crontab for ntpdate jobs running at least daily. # crontab -l | grep ntpdate columns 3, 4, and 5 must be an asterisk (*) for the job to be run daily. If this job exists, this is not a finding. OR Verify the auto-startup of xntpd in /etc/rc.tcpip.
# cat /etc/rc.tcpip | grep –v “^#”

Check the system for a running NTP daemon, which is the preferred method. # ps -ef | grep ntp If an (x)ntpd process exists, this is not a finding. Otherwise, this is a finding.

Fix Text (F-33324r1_fix)
Enable the NTP daemon for continuous synchronization. Edit /etc/rc.tcpip and enable xntpd daemon. Edit /etc/ntp.conf and add the ntp server entry. Then: # startsrc -s xntpd OR Add a daily or more frequent cronjob to perform synchronization using ntpdate. NOTE: While it is possible to run ntpdate from a cron script, it is important to mention that ntpdate with contrived cron scripts is no substitute for the NTP daemon, which uses sophisticated algorithms to maximize accuracy and reliability while minimizing resource use. Finally, since ntpdate polling does not discipline the host clock frequency as does xntpd, the accuracy using ntpdate is limited. The process of passively listening for NTP broadcasts (i.e., placing the line broadcastclient yes in the /etc/ntp.conf file) is preferred over any procedural form of direct server polling for a large network with many nodes needing to be time-synchronized. This method is preferred because it significantly reduces the network traffic load related to NTP.

Fix Text (F-33324r1_fix)

Enable the NTP daemon for continuous synchronization. Edit /etc/rc.tcpip and enable xntpd daemon. Edit /etc/ntp.conf and add the ntp server entry. Then: # startsrc -s xntpd OR Add a daily or more frequent cronjob to perform synchronization using ntpdate. NOTE: While it is possible to run ntpdate from a cron script, it is important to mention that ntpdate with contrived cron scripts is no substitute for the NTP daemon, which uses sophisticated algorithms to maximize accuracy and reliability while minimizing resource use. Finally, since ntpdate polling does not discipline the host clock frequency as does xntpd, the accuracy using ntpdate is limited. The process of passively listening for NTP broadcasts (i.e., placing the line broadcastclient yes in the /etc/ntp.conf file) is preferred over any procedural form of direct server polling for a large network with many nodes needing to be time-synchronized. This method is preferred because it significantly reduces the network traffic load related to NTP.