BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

RHEL-10-800040 RHEL 10 must securely compare internal information system clocks at least every 24 hours.

DISA STIG library V1R3
All changes in this version
first version loaded CAT II

Maps to AU-8, SC-45, SC-45(1) via CCI-004923, CCI-004926, CCI-001890, CCI-004922

Title

RHEL 10 must securely compare internal information system clocks at least every 24 hours.

Control

Verify RHEL 10 is securely comparing internal information system clocks at least every 24 hours with an NTP server with the following commands: $ sudo grep maxpoll /etc/chrony.conf server 0.us.pool.ntp.mil iburst maxpoll 16 If the "maxpoll" option is set to a number greater than 16, or the line is missing or commented out, this is a finding. Verify the "chrony.conf" file is configured to an authoritative DoW time source by running the following command: $ sudo grep -i server /etc/chrony.conf server 0.us.pool.ntp.mil If the parameter "server" is not set or is not set to an authoritative DoW time source, this is a finding.

Discussion

Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Depending on the infrastructure being used, the "pool" directive may not be supported. Authoritative time sources include the United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoW network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). Satisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144, SRG-OS-000359-GPOS-00146, SRG-OS-000785-GPOS-00250

Related controls

CCI-001890, CCI-004922, CCI-004923, CCI-004926

Fix

Configure RHEL 10 to securely compare internal information system clocks at least every 24 hours with an NTP server by adding/modifying the following line in the "/etc/chrony.conf" file: server [ntp.server.name] iburst maxpoll 16