Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-239132 | PHTN-67-000061 | SV-239132r675204_rule | Medium |
Description |
---|
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). Satisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144 |
STIG | Date |
---|---|
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide | 2022-01-03 |
Check Text ( C-42343r675202_chk ) |
---|
At the command line, execute the following command: # grep -E '^\s*(server|peer|multicastclient)' /etc/ntp.conf Confirm the servers and peers or multicastclient (as applicable) are local or an authoritative U.S. DoD source. If no lines are returned or a non-local/non-authoritative time server is used, this is a finding. OR Navigate to https:// Authenticate and navigate to "Time". If no appropriate time server is specified, this is a finding. |
Fix Text (F-42302r675203_fix) |
---|
Open /etc/ntp.conf with a text editor and set its contents to the following: tinker panic 0 restrict default kod nomodify notrap nopeer restrict 127.0.0.1 restrict -6 ::1 driftfile /var/lib/ntp/drift/ntp.drift server At the command line, execute the following commands: # chkconfig ntpd on # systemctl start ntp OR Navigate to https:// Authenticate and navigate to "Time". Click "Edit" in the top right and configure at least one appropriate NTP server. Click "OK". |