STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.

DISA Rule

SV-260520r1044776_rule

Vulnerability Number

V-260520

Group Title

SRG-OS-000356-GPOS-00144

Rule Version

UBTU-22-252015

Severity

CAT III

CCI(s)

• CCI-004926 - Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.

Weight

10

Fix Recommendation

Configure chrony to synchronize the internal system clocks to the authoritative source when the time difference is greater than one second by doing the following:

Edit the "/etc/chrony/chrony.conf" file and add:

makestep 1 -1

Restart the chrony service:

$ sudo systemctl restart chrony.service

Check Contents

Verify Ubuntu 22.04 LTS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second.

Note: If the system is not networked, this requirement is not applicable.

Check the value of "makestep" by using the following command:

$ grep -ir makestep /etc/chrony*
makestep 1 -1

If "makestep" is not set to "1 -1", is commented out, or is missing, this is a finding.

Verify the NTP service is active and the system clock is synchronized with the authoritative time source:

$ timedatectl | grep -Ei '(synchronized|service)'
System clock synchronized: yes
NTP service: active

If the NTP service is not active, this is a finding.

If the system clock is not synchronized, this is a finding.

Vulnerability Number

V-260520

Documentable

False

Rule Version

UBTU-22-252015

Severity Override Guidance

Verify Ubuntu 22.04 LTS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second.

Note: If the system is not networked, this requirement is not applicable.

Check the value of "makestep" by using the following command:

$ grep -ir makestep /etc/chrony*
makestep 1 -1

If "makestep" is not set to "1 -1", is commented out, or is missing, this is a finding.

Verify the NTP service is active and the system clock is synchronized with the authoritative time source:

$ timedatectl | grep -Ei '(synchronized|service)'
System clock synchronized: yes
NTP service: active

If the NTP service is not active, this is a finding.

If the system clock is not synchronized, this is a finding.

Check Content Reference

M

Target Key

5594