# Ensure events that modify date and time information are collected

Necessity: Monitoring for unauthorized changes to system time is critical for maintaining the integrity of logs and time-sensitive security mechanisms like Kerberos. An attacker could alter the system clock to obscure their activities, making forensic investigations difficult or impossible. Collecting these events provides an audit trail for all time modifications, which is essential for security monitoring and incident response.

Auditing and Remediation: The audit script inspects the currently active `auditd` rules to verify that the specific rules for time-change events are loaded. The remediation script automates the process of adding or removing a dedicated rules file (e.g., `/etc/audit/rules.d/time.rules`) containing the required audit rules and then triggers a reload of the audit daemon to apply the changes, ensuring the configuration is persistent across reboots.

Recommended State Rationale: 
Basic, Moderate, and Strict: All levels recommend the 'Enabled' state. This is a foundational security setting with no recognized intermediate levels. The configuration is binary; either the system's integrity is being monitored for time changes, or it is not. The performance impact is negligible, and the security benefit is significant. Therefore, this control should be enabled in any secure environment, regardless of the overall hardening level.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to audit the system's `auditd` configuration. The script must check if rules are in place to collect events related to date and time modification, typically identified by the key 'time-change'. The script should first check if the `auditd` package is installed. If not, it must return 'Not Installed'. If installed, it should check the active rules using `auditctl -l`. If rules containing '-k time-change' exist, it must return 'Enabled'. Otherwise, it must return 'Disabled'. The script's output must be limited to one of these three exact strings.

## Remediation Script Working

Bash script that takes a single positional command-line argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must create or update a rules file in `/etc/audit/rules.d/` containing the standard CIS-recommended rules for logging time changes (covering syscalls like `adjtimex`, `settimeofday`, `clock_settime`, and a watch on `/etc/localtime` with the key 'time-change'), then reload the `auditd` service rules. If the argument is 'Disabled', the script must remove the corresponding rules file and reload the service. The script must return the string 'true' on successful application of the state and 'false' on failure.

