AOS must authenticate Network Time Protocol (NTP) sources using authentication that is cryptographically based.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-266976 | SRG-APP-000395-NDM-000347 | ARBA-ND-000347 | SV-266976r1039949_rule | 2024-10-29 | 1 |
| Description |
|---|
| If NTP is not authenticated, an attacker can introduce a rogue NTP server. This rogue server can then be used to send incorrect time information to network devices, which will make log timestamps inaccurate and affect scheduled actions. NTP authentication is used to prevent this tampering by authenticating the time source. |
| ℹ️ Check |
|---|
| 1. Verify the AOS configuration with the following command: show ntp status If "Authentication" shows "disabled", this is a finding. 2. show running-config | include ntp If at least one trusted NTP authentication-key is not configured and at least one NTP server configured to use the key, this is a finding. |
| ✔️ Fix |
|---|
| Configure AOS with the following commands: configure terminal ntp authentication-key (keyid #> sha1 <plaintext key> ntp trusted-key <keyid #> ntp server <first fqdn, ipv4, or ipv6 address> key <keyid #> ntp server <second fqdn, ipv4, or ipv6 address> key <keyid #> ntp authenticate write memory |