CIS 2.3.2.1

[Nat-Spo]

hi,

I am running the mSCP tool against the CIS lvl2 benchmark, and one of the tests isn't returning anything. The test name is 'system_settings_time_server_configure' and the test script is '/usr/bin/osascript -l JavaScript << EOS $.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('timeServer').js EOS'.

by using the graphical method ive confirmed that this test should return with the correct answer to pass the test, and its also worth noting that when running the terminal test supplied with the original CIS benchmark PDF (command is: '/usr/bin/sudo /usr/sbin/systemsetup -getusingnetworktime') it returns with the correct answer and shows the system is correctly configured.

Any ideas?
Thank you.

[robertgendler]

What do you have it set to?
What is the command returning?
How are you setting it?

[Nat-Spo]

it is set to default/automatic (time.apple.com)
the command returns nothing (nothing when the command is run manually, or when run via the script)
if you're asking how I'm setting the time value then it is just set automatically by MacOS

[jmahlman]

if you're asking how I'm setting the time value then it is just set automatically by MacOS

If you're not setting this with a config profile, that's why it's not returning anything. The check is looking for a config profile to set this.

[Nat-Spo]

if you're asking how I'm setting the time value then it is just set automatically by MacOS

If you're not setting this with a config profile, that's why it's not returning anything. The check is looking for a config profile to set this.

do you mean configured via an MDM profile for example? although from research, there is only 1 time server for apple which is time.apple.com, so is there any need for said profile? apologies if I miss understood

[jmahlman]

Yes, set by an MDM. The check is specifically looking for a setting set by a configuration profile with a payload of com.apple.MCX with the preferencekey timeServer set to the ODV (or time.apple.com). This means that you are explicitly setting the time server and restricting the user or any admin from changing it. If you're just using the default setting from macOS, it's not being explicitly set and locked. If you made a config profile to set the timeserver to time.apple.com, this would pass. The MSCP check is not checking what you have set for the timeserver, it's checking the profiles installed.

To answer "...is there any need for said profile?" that is a decision your organization needs to make. Keep in mind that if you do set this with a profile, if a users device ever loses time (because a battery dies) the only way they will be able to fix it is via recovery mode. For that reason, I have made it that my org does not set this one, but we also know that if time is off a device will be unable to get to anything important.

[Nat-Spo]

that makes alot of sense, thank you ever so much for your detailed reply.

I am on a university placement year, so I am just trying to understand and gain as much knowledge as I can with respect to compliance and cyber security. so thank you for your patience and explanation.