STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Ubuntu OS must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second.

DISA Rule

SV-275614r1147892_rule

Vulnerability Number

V-275614

Group Title

SRG-OS-000356-GPOS-00144

Rule Version

RIIM-OS-252015

Severity

CAT II

CCI(s)

• CCI-004926 - Synchronize the internal system clocks to the authoritative time source when the time difference is greater than organization-defined time period.

Weight

10

Fix Recommendation

Configure chrony to synchronize the internal system clocks to the authoritative source when the time difference is greater than one second by doing the following:

Edit the "/etc/chrony/chrony.conf" file and add:

makestep 1 -1

Restart the chrony service:

$ sudo systemctl restart chrony.service

Check Contents

Verify Ubuntu OS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second.

Note: If the system is not networked, this requirement is not applicable.

Check the value of "makestep" by using the following command:

$ grep -ir makestep /etc/chrony*
makestep 1 -1

If "makestep" is not set to "1 -1", is commented out, or is missing, this is a finding.

Verify the NTP service is active and the system clock is synchronized with the authoritative time source:

$ timedatectl | grep -Ei '(synchronized|service)'
System clock synchronized: yes
NTP service: active

If the NTP service is not active, this is a finding.

If the system clock is not synchronized, this is a finding.

Vulnerability Number

V-275614

Documentable

False

Rule Version

RIIM-OS-252015

Severity Override Guidance

Verify Ubuntu OS synchronizes internal system clocks to the authoritative time source when the time difference is greater than one second.

Note: If the system is not networked, this requirement is not applicable.

Check the value of "makestep" by using the following command:

$ grep -ir makestep /etc/chrony*
makestep 1 -1

If "makestep" is not set to "1 -1", is commented out, or is missing, this is a finding.

Verify the NTP service is active and the system clock is synchronized with the authoritative time source:

$ timedatectl | grep -Ei '(synchronized|service)'
System clock synchronized: yes
NTP service: active

If the NTP service is not active, this is a finding.

If the system clock is not synchronized, this is a finding.

Check Content Reference

M

Target Key

5706