STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Ubuntu OS must compare internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS) to synchronize clocks between NetIM components.

DISA Rule

SV-275613r1149439_rule

Vulnerability Number

V-275613

Group Title

SRG-OS-000355-GPOS-00143

Rule Version

RIIM-OS-252010

Severity

CAT II

CCI(s)

• CCI-004923 - Compare the internal system clocks on an organization-defined frequency with organization-defined authoritative time source.

Weight

10

Fix Recommendation

Configure Ubuntu OS to compare the system clock at least every 24 hours to the authoritative time source.

Add or modify the following line in the "/etc/chrony/chrony.conf" file:

server [source] iburst maxpoll = 16

Restart "chrony.service" for the changes to take effect by using the following command:

$ sudo systemctl restart chrony.service

Check Contents

Verify Ubuntu OS is configured to compare the system clock at least every 24 hours to the authoritative time source by using the following command:

Note: If the system is not networked, this requirement is not applicable.

$ sudo grep maxpoll -ir /etc/chrony*
server tick.usno.navy.mil iburst maxpoll 16

If the "maxpoll" option is set to a number greater than 16, the line is commented out, or is missing, this is a finding.

Verify that the "chrony.conf" file is configured to an authoritative DOD time source by using the following command:

$ sudo grep -ir server /etc/chrony*
server tick.usno.navy.mil iburst maxpoll 16
server tock.usno.navy.mil iburst maxpoll 16
server ntp2.usno.navy.mil iburst maxpoll 16

If "server" is not defined, is not set to an authoritative DOD time source, is commented out, or missing, this is a finding.

Vulnerability Number

V-275613

Documentable

False

Rule Version

RIIM-OS-252010

Severity Override Guidance

Verify Ubuntu OS is configured to compare the system clock at least every 24 hours to the authoritative time source by using the following command:

Note: If the system is not networked, this requirement is not applicable.

$ sudo grep maxpoll -ir /etc/chrony*
server tick.usno.navy.mil iburst maxpoll 16

If the "maxpoll" option is set to a number greater than 16, the line is commented out, or is missing, this is a finding.

Verify that the "chrony.conf" file is configured to an authoritative DOD time source by using the following command:

$ sudo grep -ir server /etc/chrony*
server tick.usno.navy.mil iburst maxpoll 16
server tock.usno.navy.mil iburst maxpoll 16
server ntp2.usno.navy.mil iburst maxpoll 16

If "server" is not defined, is not set to an authoritative DOD time source, is commented out, or missing, this is a finding.

Check Content Reference

M

Target Key

5706