Detections
Analytics
6.2.3.4 Ensure events that modify date and time information are collected
Information
Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the;- adjtimex - tune kernel clock
- settimeofday - set time using timeval and timezone structures
- clock_settime - allows for the setting of several internal clocks and timers
system calls have been executed. Further, ensure to write an audit record to the configured audit log file upon exit, tagging the records with a unique identifier such as "time-change".
Unexpected changes in system date and/or time could be a sign of malicious activity on the system.
Solution
- Add the audit rule(s) for the adjtimex, settimeofday, and clock_settime system calls and changes to /etc/localtime . The procedure adds a rule for each audit ABI (b64/b32) the running kernel supports, skips any unsupported ABI or system call, and adds the watch only when its target exists, so augenrules --load does not error. Run:for ARCH in b64 b32; do
CALLS=""; for C in adjtimex settimeofday; do ausyscall "$ARCH" "$C" >/dev/null 2>&1 && CALLS="${CALLS:+$CALLS,}$C"; done
[ -n "$CALLS" ] && printf '%s\n' "-a always,exit -F arch=$ARCH -S $CALLS -k time-change"
CALLS=""; for C in clock_settime; do ausyscall "$ARCH" "$C" >/dev/null 2>&1 && CALLS="${CALLS:+$CALLS,}$C"; done
[ -n "$CALLS" ] && printf '%s\n' "-a always,exit -F arch=$ARCH -S $CALLS -F a0=0x0 -k time-change"
done >> /etc/audit/rules.d/50-time-change.rules
[ -e /etc/localtime ] && printf '%s\n' "-a always,exit -S all -F path=/etc/localtime -F perm=wa -F key=time-change" >> /etc/audit/rules.d/50-time-change.rules
- Merge and load the rules into active configuration:
# augenrules --load
- Check if reboot is required:
# if [[ $(auditctl -s | grep "enabled") =~ "2" ]]; then printf "Reboot required to load rules\n"; fi
See Also
Item Details
Audit Name: CIS Oracle Linux 9 v3.0.0 L2 Server
Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT
References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, CSCv7|5.5
Plugin: Unix
Control ID: 5690cd943a91ca6339007122f8bd5bd25d2028e7280b825196fb2b88868395bf