documentation_complete: true

title: 'Record Attempts to Alter the localtime File'

description: "Add the following to <tt>/etc/audit/audit.rules</tt>:\n<pre>-w /etc/localtime -p wa -k audit_time_rules</pre>\nThe -k option allows for the specification of a key in string form that can \nbe used for better reporting capability through ausearch and aureport and\nshould always be used."

rationale: "Arbitrary changes to the system time can be used to obfuscate \nnefarious activities in log files, as well as to confuse network services that \nare highly dependent upon an accurate system time (such as sshd). All changes \nto the system time should be audited."

severity: unknown

identifiers:
    cce: 27172-6

references:
    disa: 1487,169
    nist: AC-3(10),AU-1(b),AU-2(a),AU-2(c),AU-2(d),AU-12(a),AU-12(c),IR-5
    pcidss: Req-10.4.2.b
    srg: SRG-OS-000062
    stigid: RHEL-06-000173

ocil_clause: 'the system is not configured to audit time changes'

ocil: |-
    To determine if the system is configured to audit attempts to
    alter time via the /etc/localtime file, run the following
    command:
    <pre>$ sudo auditctl -l | grep "watch=/etc/localtime"</pre>
    If the system is configured to audit this activity, it will return a line.
