Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-38525 | RHEL-06-000169 | SV-50326r5_rule | Low |
Description |
---|
Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 6 Security Technical Implementation Guide | 2020-05-19 |
Check Text ( C-46083r4_chk ) |
---|
If the system is 64-bit only, this is not applicable. To determine if the system is configured to audit calls to the "stime" system call, run the following command: $ sudo grep -w "stime" /etc/audit/audit.rules -a always,exit -F arch=b32 -S stime -k audit_time_rules If the system is not configured to audit the "stime" syscall, this is a finding. |
Fix Text (F-43473r5_fix) |
---|
Add the following to "/etc/audit/audit.rules": # audit_time_rules -a always,exit -F arch=b32 -S stime -k audit_time_rules |