STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must use internal system clocks to generate audit record time stamps.

DISA Rule

SV-257525r960927_rule

Vulnerability Number

V-257525

Group Title

SRG-APP-000116-CTR-000235

Rule Version

CNTR-OS-000230

Severity

CAT II

CCI(s)

• CCI-000159 - Use internal system clocks to generate time stamps for audit records.

Weight

10

Fix Recommendation

Apply the machine config to use internal system clocks for audit records by executing the following:

for mcpool in $(oc get mcp -oname | sed "s:.*/::" ); do
echo "apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
name: 80-chronyd-service-enable-$mcpool
labels:
machineconfiguration.openshift.io/role: $mcpool
spec:
config:
ignition:
version: 3.1.0
systemd:
units:
- name: chronyd.service
enabled: true
" | oc apply -f -
done

Check Contents

Verify the chronyd service is enabled and active by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; systemctl is-enabled chronyd.service; systemctl is-active chronyd.service' 2>/dev/null; done

If the auditd service is not "enabled" and "active", this is a finding.

Vulnerability Number

V-257525

Documentable

False

Rule Version

CNTR-OS-000230

Severity Override Guidance

Verify the chronyd service is enabled and active by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; systemctl is-enabled chronyd.service; systemctl is-active chronyd.service' 2>/dev/null; done

If the auditd service is not "enabled" and "active", this is a finding.

Check Content Reference

M

Target Key

5547