The audit system must be configured to audit all attempts to alter system time through /etc/localtime.

Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The audit system must be configured to audit all attempts to alter system time through /etc/localtime.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
RHEL-06-000173	RHEL-06-000173	RHEL-06-000173_rule		Low

Description
Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.

STIG	Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide	2013-02-05

Details

Check Text ( C-RHEL-06-000173_chk )
To determine if the system is configured to audit attempts to alter time via the /etc/localtime file, run the following command: # auditctl -l \| grep "watch=/etc/localtime" If the system is configured to audit this activity, it will return a line. If the system is not configured to audit time changes, this is a finding.

Fix Text (F-RHEL-06-000173_fix)
Add the following to "/etc/audit/audit.rules": -w /etc/localtime -p wa -k audit_time_rules The -k option allows for the specification of a key in string form that can be used for better reporting capability through ausearch and aureport and should always be used.