On a Linux system, auditing a few system calls we can easily track who makes system time changes. Refer to the solution section to know about related system calls to Audit System Time Changes on Linux|Centos|RHEL|Ubuntu|Debian system.
Topic
-
How to audit system time changes?
-
Audit time changes on a Linux|Centos|RHEL|Ubuntu|Debian system
-
Track who changed system time
-
Linux audit track system time changes
Solution
Following are the details about related system calls to be added in the audit rule.
- adjtimex() – The system call adjtimex() reads and sets adjustment parameters to the system clock.
- settimeofday() – The functions gettimeofday() and settimeofday() can get and set the time as well as a timezone.
- clock_settime() – The functions clock_gettime() and clock_settime() retrieve and set the time of the specified clock clk_id.
Execute the following commands to track time changes run time without restarting auditd
service.
# auditctl -a exit,always -F arch=b32 -S adjtimex -S settimeofday -S clock_settime -k timechange
# auditctl -a exit,always -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k timechange
Make the above rules permanent by adding the following lines in /etc/audit/rules.d/audit.rules
file.
#Track system time changes
-a exit,always -F arch=b32 -S adjtimex -S settimeofday -S clock_settime -k timechange
-a exit,always -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k timechange
Restart auditd
service and validate configuration.
# service auditd restart
# auditctl -l
-a always,exit -F arch=b32 -S settimeofday,adjtimex,clock_settime -F key=timechange
-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -F key=timechange
Test
Wait for time change event to occur and then execute the following command to check system time change.
# ausearch -k timechange
time->Sun Feb 17 00:22:16 2019
type=PROCTITLE msg=audit(1568487136.122:204): proctitle=64617465002D730053756E205365702031352030303A32313A3537204953542032303139
type=SYSCALL msg=audit(1568487136.122:204): arch=c000003e syscall=227 success=yes exit=0 a0=0 a1=7ffecae98680 a2=1 a3=7ffecae98060 items=0 ppid=1591 pid=1844 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="date" exe="/usr/bin/date" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="timechange"
The above event notifies that root user executed date command to change system time.