| name | cis-ubuntu1804-v220-5-2-3-4 |
| version | 2.2.0 |
| date_published | "2024-01-01T00:00:00.000Z" |
| category | cis-logging |
| description | Ensure events that modify date and time information are collected |
| author | CIS Benchmarks |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","auditing","auditd"] |
| target | {"platform":"linux","version":"18.04"} |
| severity_boost | {} |
5.2.3.4 Ensure events that modify date and time information are collected
Profile Applicability
- Level 2 - Server
- Level 2 - Workstation
Description
Capture events where the system date and/or time has been modified. The parameters in this section are set to determine if the:
adjtimex - tune kernel clocksettimeofday - set time using timeval and timezone structuresstime - using seconds since 1/1/1970clock_settime - allows for the setting of several internal clocks and timers
system calls have been executed. Further, ensure to write an audit record to the configured audit log file upon exit, tagging the records with a unique identifier such as "time-change".
Rationale
Unexpected changes in system date and/or time could be a sign of malicious activity on the system.
Audit
64 Bit systems
On disk configuration
Run the following command to check the on disk rules:
awk '/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&/ -S/ \
&&(/adjtimex/ \
||/settimeofday/ \
||/clock_settime/ ) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/' /etc/audit/rules.d/*.rules
awk '/^ *-w/ \
&&/\/etc\/localtime/ \
&&/ +-p *wa/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/' /etc/audit/rules.d/*.rules
Verify the output matches:
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
-a always,exit -F arch=b32 -S adjtimex,settimeofday,clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
Running configuration
Run the following command to check loaded rules:
auditctl -l | awk '/^ *-a *always,exit/ \
&&/ -F *arch=b(32|64)/ \
&&/ -S/ \
&&(/adjtimex/ \
||/settimeofday/ \
||/clock_settime/ ) \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/'
auditctl -l | awk '/^ *-w/ \
&&/\/etc\/localtime/ \
&&/ +-p *wa/ \
&&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)/'
Verify the output includes:
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -F key=time-change
-a always,exit -F arch=b32 -S adjtimex,settimeofday,clock_settime -F key=time-change
-w /etc/localtime -p wa -k time-change
32 Bit systems
Follow the same procedures as for 64 bit systems and ignore any entries with . In addition, also audit for the system call rule. For example:
