# Ensure events that modify date and time information are collected

Necessity: Auditing events that modify system date and time is crucial for maintaining the integrity of logs and security systems. Attackers may alter the system clock to obscure their activities, bypass time-based security controls (like Kerberos), or disrupt services. A compromised system clock makes forensic analysis unreliable, as timestamps on logs and files can no longer be trusted. Collecting these events provides a clear audit trail of any attempts to tamper with the system's time, which is a critical indicator of compromise.

Auditing and Remediation: The audit script inspects the running configuration of the audit daemon to verify that specific rules are in place to monitor system calls responsible for time modification (e.g., `settimeofday`, `clock_settime`). The remediation script adds these rules to the audit daemon's persistent configuration files (within `/etc/audit/rules.d/`) and reloads the service. This ensures that any process, regardless of privilege, that attempts to change the system clock will have its action logged.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is 'enabled' because this is a foundational security control. There is no acceptable level of hardening that permits unmonitored changes to the system clock. The integrity of timekeeping is fundamental to virtually all other security logging and monitoring. Therefore, this control is considered mandatory across all security postures, as recommended by security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the auditd rules for time-change events (`stime`, `settimeofday`, `adjtimex`, `clock_settime`) are correctly configured in `/etc/audit/rules.d/` or the live configuration. The script should output a single string: 'enabled' if all required rules are present and active, and 'disabled' otherwise. The output must not contain any extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must add the necessary auditd rules to a file in `/etc/audit/rules.d/` to log system calls that modify date and time (`adjtimex`, `settimeofday`, `stime`, `clock_settime`) for both 32-bit and 64-bit architectures, and a watch rule for `/etc/localtime`. If the argument is 'disabled', it should remove these specific rules. The script must then reload the auditd service rules. It must return 'true' on successful application of the state or 'false' on failure.

