The system must use at least two time sources for clock synchronization.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22291	GEN000242	SV-28717r1_rule	ECSC-1	Medium

Description
A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. For redundancy, two time sources are required so that synchronization continues to function if one source fails. If the system is completely isolated (that is, it has no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable. NOTE: For the network time protocol (NTP), the requirement is two servers, but it is recommended to configure at least four distinct time servers which allow NTP to effectively exclude a time source that is not consistent with the others. The system's local clock must be excluded from the count of time sources.

Description

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. For redundancy, two time sources are required so that synchronization continues to function if one source fails. If the system is completely isolated (that is, it has no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable. NOTE: For the network time protocol (NTP), the requirement is two servers, but it is recommended to configure at least four distinct time servers which allow NTP to effectively exclude a time source that is not consistent with the others. The system's local clock must be excluded from the count of time sources.

STIG	Date
UNIX SRG	2013-03-26

Details

Check Text ( C-29012r1_chk )
Check the root crontab for ntpdate entries. # crontab -l \| grep ntpdate If the ntpdate command is not invoked with at least two external NTP servers listed, this is a finding. Check the NTP daemon configuration for at least two external servers. # grep ^server ntp.conf \| egrep -v '(127.127.1.1\|127.127.1.0)' If less than two servers or external reference clocks (127.127.x.x other than 127.127.1.0 or 127.127.1.1) are listed, this is a finding.

Check Text ( C-29012r1_chk )

Check the root crontab for ntpdate entries.
# crontab -l | grep ntpdate
If the ntpdate command is not invoked with at least two external NTP servers listed, this is a finding.

Check the NTP daemon configuration for at least two external servers.
# grep ^server ntp.conf | egrep -v '(127.127.1.1|127.127.1.0)'
If less than two servers or external reference clocks (127.127.x.x other than 127.127.1.0 or 127.127.1.1) are listed, this is a finding.

Fix Text (F-26022r1_fix)
If using ntpdate, add additional NTP servers to the cron job running ntpdate. If using the NTP daemon, add an additional "server" line to ntp.conf for each additional NTP server.