Rule ID
SV-286595r1291695_rule
Version
V1R1
CCIs
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Synchronization of system clocks is needed to correctly correlate the timing of events that occur across multiple systems. To meet this requirement, the organization must define authoritative time sources and configure each UAG system to use the authoritative time sources. The UAG provides an option to synchronize the time with the ESXi host, only if running on a VMware ESXi host. This option must be disabled, and NTP time servers configured, to ensure all components (servers, hosts, network devices, etc.) are using the same NTP time sources.
Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to Advanced Settings >> System Configuration. Click the gear icon to verify the settings. If the "Time Sync With Host" toggle is enabled, this is a finding. If the "NTP Servers" does not contain a list of valid authoritative NTP time sources, this is a finding.
Log in to the UAG administrative interface as an administrator. Select "Configure Manually". Navigate to Advanced Settings >> System Configuration. Click the gear icon to verify the settings. Ensure the "Time Sync With Host" toggle is disabled. Ensure the "NTP Servers" section contains a list of valid authoritative NTP time sources. Click "Save".