Check: OL6-00-000169
Oracle Linux 6 STIG:
OL6-00-000169
(in versions v2 r7 through v1 r16)
Title
The audit system must be configured to audit all attempts to alter system time through stime. (Cat III impact)
Discussion
Arbitrary changes to the system time can be used to obfuscate nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Check Content
If the system is 64-bit only, this is not applicable. To determine if the system is configured to audit calls to the "stime" system call, run the following command: $ sudo grep -w "stime" /etc/audit/audit.rules -a always,exit -F arch=b32 -S stime -k audit_time_rules If the system is not configured to audit the "stime" system call, this is a finding.
Fix Text
On a 32-bit system, add the following to "/etc/audit/audit.rules": # audit_time_rules -a always,exit -F arch=b32 -S stime -k audit_time_rules Note: On a 64-bit system, it is not necessary to define a rule for "stime".
Additional Identifiers
Rule ID: SV-208884r793669_rule
Vulnerability ID: V-208884
Group Title: SRG-OS-000062
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000169 |
The information system provides audit record generation capability for the auditable events defined in AU-2 a. at organization-defined information system components. |
Controls
Number | Title |
---|---|
AU-12 |
Audit Generation |