Rule ID
SV-269794r1051767_rule
Version
V1R1
CCIs
CCI-001967
If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source.
Review the OS10 Switch configuration to determine if the network device authenticates NTP endpoints before establishing a local, remote, or network connection using authentication that is cryptographically based. Review the configuration to verify that NTP authentication is configured when communicating with the NTP servers with the following commands: OS10# show running-configuration ntp ! ntp authenticate ntp authentication-key 345 sha2-256 9 **** ntp server 192.0.2.1 key 345 prefer ntp server 192.0.2.5 key 345 ntp trusted-key 345 If the OS10 Switch not authenticate NTP sources using authentication that is cryptographically based, this is a finding.
Configure the OS10 Switch to authenticate NTP sources using authentication that is cryptographically based: OS10(config)# ntp authenticate OS10(config)# ntp trusted-key 345 OS10(config)# ntp authentication-key 345 sha2-256 0 <key> OS10(config)# ntp server 192.0.2.1 key 345 preferred OS10(config)# ntp server 192.0.2.5 key 345