2.2.2 Ensure time set is within appropriate limits

Information

Correct date and time settings are required for authentication protocols, file creation, modification dates and log entries. Ensure that time on the computer is within acceptable limits. Truly accurate time is measured within milliseconds, for this audit a drift under four and a half minutes passes the control check. Since Kerberos is one of the important features of macOS integration into Directory systems the guidance here is to warn you before there could be an impact to operations. From the perspective of accurate time this check is not strict, it may be too great for your organization, adjust to a smaller offset value as needed.

Rationale:

Kerberos may not operate correctly if the time on the Mac is off by more than 5 minutes. This in turn can affect Apple's single sign-on feature, Active Directory logons, and other features. Audit check is for more than 4 minutes and 30 seconds ahead or behind.

Impact:

Accurate time is required for many computer functions.

Solution

Perform the following to implement the prescribed state:

In Terminal, run the following command:

sudo systemsetup -getnetworktimeserver



Use 'Network Time Server:' <your.time.server> to capture drift

sudo ntpdate -sv <your.time.server>

Additional Information:

The associated check will fail if no network connection is available.

See Also

https://workbench.cisecurity.org/files/3092

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Unix

Control ID: 8e6a90834b2902ddc53f9c0c3be5865f446f389b62c28203e6e0daffa919564e