AOSX-13-000330 - The macOS system must, for networked systems, compare internal information system clocks at least every 24 hours with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet) and/or the Global Positioning System (GPS).

Information

Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside of the configured acceptable allowance (drift) may be inaccurate.

Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.

Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).

Satisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144

Solution

To enable the NTP service, run the following command:

/usr/bin/sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.timed.plist

To configure one or more time servers for use, edit '/etc/ntp.conf' and enter each hostname or IP address on a separate line, prefixing each one with the keyword 'server'.

Item Details

Audit Name: DISA STIG Apple Mac OSX 10.13 v2r5

Category: AUDIT AND ACCOUNTABILITY

Plugin: Unix

Control ID: a0062f48748015bd25408c69ff3bcd49e51b3daeed31d1597c0224b98a0c9a9d

Detections

Analytics

Information

Solution

See Also

Item Details