The system clock must be synchronized continuously.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22290	GEN000241	SV-26291r2_rule		Medium

Description
A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. Internal system clocks tend to drift and require periodic resynchronization to ensure their accuracy. Software, such as NTPD, can be used to continuously synchronize the system clock with authoritative sources. Alternatively, the system may be synchronized periodically, with a maximum of one day between synchronizations. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

Description

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. Internal system clocks tend to drift and require periodic resynchronization to ensure their accuracy. Software, such as NTPD, can be used to continuously synchronize the system clock with authoritative sources. Alternatively, the system may be synchronized periodically, with a maximum of one day between synchronizations. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

STIG	Date
SOLARIS 10 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2018-04-10

Details

Check Text ( C-27387r2_chk )
NTP must be used and used only in the global zone. Determine the type of zone that you are currently securing. # zonename If the command output is not "global", then NTP must be disabled. Check the system for a running NTP daemon. # svcs -Ho state ntp If NTP is online, this is a finding. If the output from "zonename" is "global", then NTP must be enabled. Check the system for a running NTP daemon. # svcs -Ho state ntp If NTP is not online, this is a finding.

Check Text ( C-27387r2_chk )

NTP must be used and used only in the global zone. Determine the type of zone that you are currently securing.

# zonename

If the command output is not "global", then NTP must be disabled. Check the system for a running NTP daemon.

# svcs -Ho state ntp

If NTP is online, this is a finding.

If the output from "zonename" is "global", then NTP must be enabled. Check the system for a running NTP daemon.

# svcs -Ho state ntp

If NTP is not online, this is a finding.

Fix Text (F-23443r3_fix)
Determine the type of zone that you are currently securing. # zonename If the command output is not "global", then NTP must be disabled. # svcadm disable ntp If the output from "zonename" is "global", then NTP must be enabled. # svcadm enable ntp