Rule ID
SV-286239r1292011_rule
Version
V1R1
CCIs
Time synchronization of system clocks is essential for the correct execution of many system services, including identification and authentication processes that involve certificates and time-of-day restrictions as part of access control. Denial of service or failure to deny expired credentials may result without properly synchronized clocks within and between systems and system components. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. The granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks, such as clocks synchronizing within hundreds of milliseconds or tens of milliseconds. Organizations may define different time granularities for system components. Time service can be critical to other security capabilities such as access control and identification and authentication depending on the nature of the mechanisms used to support the capabilities.
Verify the system time synchronization service is active. On systems using systemd, run: timedatectl status Verify the following: - NTP service: active or - System clock synchronized: yes If the system clock is not synchronized, this is a finding. If the system uses chrony, verify the service is running: systemctl status chronyd Verify the service status is active (running). Verify the system is synchronizing with a time source: chronyc tracking If the system is not synchronized with an external time source, this is a finding. If the system uses ntpd, verify the service is running: systemctl status ntpd Verify synchronization peers: ntpq -p If no valid synchronization peers are configured, this is a finding. Verify MariaDB is using the host system time by running: SELECT NOW(); Confirm the database time aligns with the host system time. If MariaDB system time differs significantly from the host system clock, this is a finding.
Configure MariaDB to synchronize system clocks within and between systems or system components. MariaDB does not directly synchronize system clocks. It relies on the underlying operating system for time synchronization. Therefore, verification focuses on ensuring the operating system clock is synchronized with a trusted Network Time Protocol (NTP) source. Check system time synchronization status: timedatectl status Verify that the output includes: - System clock synchronized: yes - NTP service: active Verify synchronization for systems using ntpd with: ntpstat A return code of "0" indicates the system clock is synchronized. Verify synchronization for systems using chrony with: chronyc tracking Confirm the output indicates synchronization with a reference time source. Values such as "System time" and "Last offset" should be close to zero, and "Leap status" should be "Normal". MariaDB uses the system clock for timestamps, logs, and internal processes. If the operating system clock is synchronized, MariaDB will automatically use the synchronized time. Enable NTP synchronization if it is not already enabled: sudo timedatectl set-ntp true Verify the configuration again: timedatectl status Ensure the system clock is synchronized and the NTP service is active. Alternatively, configure NTP services such as ntpd or chrony. Example installation: sudo apt install ntp sudo systemctl enable --now ntp Ensure the service is configured with appropriate NTP servers in configuration files such as "/etc/chrony/chrony.conf" or "/etc/ntp.conf". Verify the system time zone configuration: sudo timedatectl set-timezone Region/City MariaDB normally uses the system time zone. Verify the MariaDB time zone configuration: SELECT @@global.time_zone, @@session.time_zone; If the value is "SYSTEM", MariaDB is using the system time zone. If required, configure MariaDB to use the system time zone in the configuration file: [mariadb] default-time-zone='SYSTEM' Restart MariaDB after making configuration changes: sudo systemctl restart mariadb