What changed in Solaris 10 X86 STIG V2R4V2R4 changes

Check text

Note: This STIG has been moved to sunset and will no longer be maintained. # uname -a Oracle has committed to indefinite "sustaining support" for recent Solaris operating system releases. Verify proof of purchase of support from Oracle. If the release is not supported, this is a finding. Severity Override Guidance: If an extended support agreement provides security patches for the unsupported product is procured from the vendor, this finding may be downgraded to a CAT III.

Discussion

An operating system release is considered supported if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.

V-227556 in V2R4

Check text

NTP must be used and used only in the global zone. Determine the zone that you are currently securingbeing secured. # zonename If the command output is not "global", NTP must be disabled. Check the system for a running NTP daemon. # svcs ntp1*ntp1* | grep online If NTP or NTP4 is online, this is a finding. If the output from "zonename" is "global", NTP must be enabled. Check the system for a running NTP daemon. # svcs ntp1*ntp1* | grep online If NTP or NTP4 is not online, this is a finding. If NTP is running, confirm the servers and peers or multicast client (as applicable) are local or an authoritative U.S. DoD source. # more /etc/inet/ntp.conf If a non-localnonlocal/non-authoritativenonauthoritative (U.S. DoD source) time-server is used, this is a finding.

Fix text

Use a local authoritative time server synchronizing to an authorized DoD time source. Ensure all systems in the facility feed from one or more local time servers that feed from the authoritative time server.

Discussion

To assureensure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD. Many system functions, including time-based login and activity restrictions, automated reports, system logs, and audit records depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value. Authoritative time sources include authorized time servers within the enclave that synchronize with upstream authoritative sources. Specific requirements for the upstream synchronization of Network Time Protocol (NTP) servers are covered in the Network Other Devices STIG. For systems located on isolated or closed networks, it is not necessary to synchronize with a global authoritative time source. If a global authoritative time source is not available to systems on an isolated network, a local authoritative time source must be established on this network and used by the systems connected to this network. This is necessary to provide the ability to correlate events and allow for the correct operation of time-dependent protocols between systems on the isolated network. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

V-227560 in V2R4

Check text

NTP must be used and used only in the global zone. Determine the type of zone that you are currently securingbeing secured. # zonename If the command output is not "global", then NTP must be disabled. Check the system for a running NTP daemon. # svcs 1*ntp1* -Ho| stategrep ntponline If NTP or NTP4 is online, this is a finding. If the output from "zonename" is "global", then NTP must be enabled. Check the system for a running NTP daemon. # svcs -Ho1*ntp1* state| ntpgrep online If NTP or NTP 4 is not online, this is a finding.

Fix text

Determine the type of zone that you are currently securingbeing secured. # zonename If the command output is not "global", then NTP and NTP4 must be disabled. # svcadm disable ntp # svcadm disable ntp4 If the output from "zonename" is "global", then NTP or NTP4 must be enabled. # svcadm enable ntp or # svcadm enable ntp4

Discussion

A synchronized system clock is critical for the enforcement of time-based policies and the correlation of logs and audit records with other systems. Internal system clocks tend to drift and require periodic resynchronization to ensure their accuracy. Software, such as NTPD, can be used to continuously synchronize the system clock with authoritative sources. Alternatively, the system may be synchronized periodically, with a maximum of one day between synchronizations. If the system is completely isolated (no connections to networks or other systems), time synchronization is not required as no correlation of events or operation of time-dependent protocols between systems will be necessary. If the system is completely isolated, this requirement is not applicable.

V-227561 in V2R4