UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The audit system must be configured to audit all attempts to alter system time through settimeofday.


Overview

Finding ID Version Rule ID IA Controls Severity
V-217952 RHEL-06-000167 SV-217952r505923_rule Low
Description
Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
STIG Date
Red Hat Enterprise Linux 6 Security Technical Implementation Guide 2020-09-03

Details

Check Text ( C-19433r376871_chk )
To determine if the system is configured to audit calls to the "settimeofday" system call, run the following command:

$ sudo grep -w "settimeofday" /etc/audit/audit.rules

-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules

If the system is 64-bit and does not return a rule for both "b32" and "b64" architectures, this is a finding.

If the system is not configured to the "settimeofday" syscall, this is a finding.
Fix Text (F-19431r376872_fix)
Add the following to "/etc/audit/audit.rules":

# audit_time_rules
-a always,exit -F arch=b32 -S settimeofday -k audit_time_rules

If the system is 64-bit, then also add the following:

# audit_time_rules
-a always,exit -F arch=b64 -S settimeofday -k audit_time_rules