STIGQter: STIG Summary: Red Hat Ansible Automation Controller Application Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 05 Jan 2026:

Automation Controller must compare internal application server clocks at least every 24 hours with an authoritative time source.

DISA Rule

SV-256909r1015791_rule

Vulnerability Number

V-256909

Group Title

SRG-APP-000371-AS-000077

Rule Version

APAS-AT-000093

Severity

CAT II

CCI(s)

• CCI-004923 - Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.
• CCI-004926 - Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.

Weight

10

Fix Recommendation

As a system administrator, for each Automation Controller host, configure the NTP client to synchronize to an organizationally defined NTP server:

vi /etc/chrony.conf

Restart the Automation Controller host:

$ shutdown -r

Check Contents

As a system administrator for each Automation Controller host, ensure the NTP client is configured to synchronize to an organizationally defined NTP server:

chronyc sources

If the Automation Controller host is not configured to use an organizationally defined NTP server, this is a finding.

Ensure the NTP time synchronization is operational:

chronyc activity | head -n 1 | grep "200 OK" >/dev/null || echo "FAILED"
sudo systemctl is-active chrony > /dev/null|| echo "FAILED"

If "FAILED" is displayed, this is a finding.

Vulnerability Number

V-256909

Documentable

False

Rule Version

APAS-AT-000093

Severity Override Guidance

As a system administrator for each Automation Controller host, ensure the NTP client is configured to synchronize to an organizationally defined NTP server:

chronyc sources

If the Automation Controller host is not configured to use an organizationally defined NTP server, this is a finding.

Ensure the NTP time synchronization is operational:

chronyc activity | head -n 1 | grep "200 OK" >/dev/null || echo "FAILED"
sudo systemctl is-active chrony > /dev/null|| echo "FAILED"

If "FAILED" is displayed, this is a finding.

Check Content Reference

M

Target Key

5534