Title

The system clock must be synchronized continuously. (Cat II impact)

Discussion

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. Internal system clocks tend to drift and require periodic resynchronization to ensure their accuracy. Software, such as NTPD, can be used to continuously synchronize the system clock with authoritative sources. Alternatively, the system may be synchronized periodically, with a maximum of one day between synchronizations. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

Check Content

NTP must be used and used only in the global zone. Determine the type of zone currently being secured. # zonename If the command output is not "global", then NTP must be disabled. Check the system for a running NTP daemon. # svcs \*ntp\* | grep online If NTP or NTP4 is online, this is a finding. If the output from "zonename" is "global", then NTP must be enabled. Check the system for a running NTP daemon. # svcs \*ntp\* | grep online If NTP or NTP 4 is not online, this is a finding.

Fix Text

Determine the type of zone currently being secured. # zonename If the command output is not "global", then NTP and NTP4 must be disabled. # svcadm disable ntp # svcadm disable ntp4 If the output from "zonename" is "global", then NTP or NTP4 must be enabled. # svcadm enable ntp or # svcadm enable ntp4

Additional Identifiers

Rule ID: SV-226435r877405_rule

Vulnerability ID: V-226435

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.