The Photon operating system must be configured to synchronize with an approved DoD time source.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239132	PHTN-67-000061	SV-239132r675204_rule		Medium

Description
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). Satisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144

Description

Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). Satisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144

STIG	Date
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide	2021-04-15

Details

Check Text ( C-42343r675202_chk )
At the command line, execute the following command: # grep -E '^\s*(server\|peer\|multicastclient)' /etc/ntp.conf Confirm the servers and peers or multicastclient (as applicable) are local or an authoritative U.S. DoD source. If no lines are returned or a non-local/non-authoritative time server is used, this is a finding. OR Navigate to https://:5480 to access the Virtual Appliance Management Interface (VAMI). Authenticate and navigate to "Time". If no appropriate time server is specified, this is a finding.

Check Text ( C-42343r675202_chk )

At the command line, execute the following command:

# grep -E '^\s*(server|peer|multicastclient)' /etc/ntp.conf

Confirm the servers and peers or multicastclient (as applicable) are local or an authoritative U.S. DoD source.

If no lines are returned or a non-local/non-authoritative time server is used, this is a finding.

OR

Navigate to https://:5480 to access the Virtual Appliance Management Interface (VAMI).

Authenticate and navigate to "Time".

If no appropriate time server is specified, this is a finding.

Fix Text (F-42302r675203_fix)
Open /etc/ntp.conf with a text editor and set its contents to the following: tinker panic 0 restrict default kod nomodify notrap nopeer restrict 127.0.0.1 restrict -6 ::1 driftfile /var/lib/ntp/drift/ntp.drift server At the command line, execute the following commands: # chkconfig ntpd on # systemctl start ntp OR Navigate to https://:5480 to access the VAMI. Authenticate and navigate to "Time". Click "Edit" in the top right and configure at least one appropriate NTP server. Click "OK".

Fix Text (F-42302r675203_fix)

Open /etc/ntp.conf with a text editor and set its contents to the following:

tinker panic 0
restrict default kod nomodify notrap nopeer
restrict 127.0.0.1
restrict -6 ::1
driftfile /var/lib/ntp/drift/ntp.drift
server

At the command line, execute the following commands:

# chkconfig ntpd on
# systemctl start ntp

OR

Navigate to https://:5480 to access the VAMI.

Authenticate and navigate to "Time".

Click "Edit" in the top right and configure at least one appropriate NTP server.

Click "OK".