The system must use at least two time sources for clock synchronization.

From SOLARIS 10 SPARC SECURITY TECHNICAL IMPLEMENTATION GUIDE

Part of GEN000242

Associated with: CCI-000160

SV-26303r2_rule The system must use at least two time sources for clock synchronization.

Vulnerability discussion

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. For redundancy, two time sources are required so synchronization continues to function if one source fails. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.NOTE: For the Network Time Protocol (NTP), the requirement is two servers, but it is recommended to configure at least four distinct time servers which allow NTP to effectively exclude a time source not consistent with the others. The system's local clock must be excluded from the count of time sources.

Check content

Determine the zone that you are currently securing. # zonename If the command output is not "global", this is not applicable. Check the NTP daemon configuration for at least two external servers. # grep '^server' /etc/inet/ntp.conf | egrep -v '(127.127.1.1|127.127.1.0)' If less than two servers or external reference clocks (127.127.x.x other than 127.127.1.0 or 127.127.1.1) are listed, this is a finding.

Fix text

Add an additional server line to /etc/inet/ntp.conf for each additional NTP server.

Pro Tips

Powered by sagemincer