Re: [ntp:questions] Secure NTP

2011-03-28 Thread Uwe Klein
j...@specsol.spam.sux.com wrote: Richard B. Gilbert wrote: Didn't I just see an announcement that GPS was going to be jammed in order to test something or other? Yeah, it happens quite often on a scheduled basis in limited areas. Hmm, it should not be all that difficult to set up a limit

Re: [ntp:questions] new driver development

2011-03-28 Thread Uwe Klein
Bruce Lilly wrote: On Fri, 18 Mar 2011 03:16:38 +, Dave Hart wrote: On Fri, Mar 18, 2011 at 01:44 UTC, Bruce Lilly wrote: 4. Assuming specific sizes for an integer is a really bad idea... "(64 bits making up the) clockTimeStamp* and receiveTimeStamp* fields" Actually nailing down the

Re: [ntp:questions] new driver development

2011-03-28 Thread Rob
Bruce Lilly wrote: > On Fri, 18 Mar 2011 03:16:38 +, Dave Hart wrote: > >> On Fri, Mar 18, 2011 at 01:44 UTC, Bruce Lilly >> wrote: >>> 4. Assuming specific sizes for an integer is a really bad idea... "(64 >>> bits making up the) clockTimeStamp* and receiveTimeStamp* fields" >> >> Actually

Re: [ntp:questions] new driver development

2011-03-28 Thread Uwe Klein
Rob wrote: Bruce Lilly wrote: Endianness (and more generally byte order) are of concern for precisely the same reasons. This is not relevant in the case of shared memory, as long as the memory is not shared between processors of different endianess. For the scope of this driver, we can safe

Re: [ntp:questions] new driver development

2011-03-28 Thread David L. Mills
Bruce & Co., You may not be aware that all Spectracom devices are supported with one driver, all TrueTime devices are supported with one driver, all telephone modem services are supported with one driver, all Austron devices are supported with one driver, all Heath devices are supported with

Re: [ntp:questions] Secure NTP

2011-03-28 Thread jimp
Uwe Klein wrote: > j...@specsol.spam.sux.com wrote: >> Richard B. Gilbert wrote: > >>>Didn't I just see an announcement that GPS was going to be jammed in >>>order to test something or other? >> >> >> Yeah, it happens quite often on a scheduled basis in limited areas. >> > Hmm, it should not

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Florin Andrei
On 03/26/2011 08:46 AM, Dave Hart wrote: You probably want iburst on each of those server lines, to sync the clock in under 15 seconds instead of a few minutes. I thought that was frowned upon, to use iburst with public servers? (I do use iburst, from all the other machines to the internal NT

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Florin Andrei
On 03/26/2011 03:36 AM, Rob wrote: Florin Andrei wrote: restrict 0.us.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict 1.us.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict 2.us.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict 3.us.pool.ntp

Re: [ntp:questions] new driver development

2011-03-28 Thread Rob
David L. Mills wrote: > Bruce & Co., > > You may not be aware that all Spectracom devices are supported with one > driver, all TrueTime devices are supported with one driver, all > telephone modem services are supported with one driver, all Austron > devices are supported with one driver, all H

Re: [ntp:questions] Secure NTP

2011-03-28 Thread Uwe Klein
j...@specsol.spam.sux.com wrote: At that point they start slowly changing the time to something else. Meanwhile, inside the building where NTP was set up by someone with a clue if you go by the questions placed here on occasion that assumption is not a given ;-) that bothered to read the doc

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Florin Andrei
Let's assume I upgrade to a newer version that accepts the "source" keyword. Then how about this config? Is there are risk of too many internal servers picking other internal servers to sync their time - and not enough servers using external sources? Should I skew the selection using "prefer"

Re: [ntp:questions] Secure NTP

2011-03-28 Thread jimp
Uwe Klein wrote: > j...@specsol.spam.sux.com wrote: >> At that point they start slowly changing the time to something else. >> >> Meanwhile, inside the building where NTP was set up by someone with a clue > if you go by the questions placed here on occasion that assumption is not a > given ;-) >

Re: [ntp:questions] Secure NTP

2011-03-28 Thread Chris Albertson
On Mon, Mar 28, 2011 at 8:56 AM, wrote: > > OK, so the bad guy sets up the stuff for a GPS spoofer and parks it next > to the targeted building where high dollar value stuff goes on in hopes > of tweeking their system clocks and stealing a fortune. The best application of GPS signal spoofing wo

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Dave Hart
On Mon, Mar 28, 2011 at 6:47 PM, Florin Andrei wrote: > > Let's assume I upgrade to a newer version that accepts the > "source" keyword. Then how about this config? > > Is there are risk of too many internal servers picking other > internal servers to sync their time - and not enough servers > usi

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Terje Mathisen
Florin Andrei wrote: On 03/26/2011 08:46 AM, Dave Hart wrote: You probably want iburst on each of those server lines, to sync the clock in under 15 seconds instead of a few minutes. I thought that was frowned upon, to use iburst with public servers? (I do use iburst, from all the other machi

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Steve Kostecke
On 2011-03-28, Florin Andrei wrote: > On 03/26/2011 08:46 AM, Dave Hart wrote: > >> You probably want iburst on each of those server lines, to sync the >> clock in under 15 seconds instead of a few minutes. > > I thought that was frowned upon, to use iburst with public servers? > > (I do use ibur

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Steve Kostecke
On 2011-03-25, Florin Andrei wrote: > Two groups of machines in two datacenters, VPN line in between. A VPN will introduce jitter into any associations between your two data centers. An unencrypted UDP connection would be better. > Two NTP servers in each datacenter, sync'ing to public servers.

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread Richard B. Gilbert
On 3/28/2011 1:16 PM, Florin Andrei wrote: On 03/26/2011 08:46 AM, Dave Hart wrote: You probably want iburst on each of those server lines, to sync the clock in under 15 seconds instead of a few minutes. I thought that was frowned upon, to use iburst with public servers? (I do use iburst, fr

Re: [ntp:questions] peer command and clusters

2011-03-28 Thread David Lord
Florin Andrei wrote: On 03/26/2011 08:46 AM, Dave Hart wrote: You probably want iburst on each of those server lines, to sync the clock in under 15 seconds instead of a few minutes. I thought that was frowned upon, to use iburst with public servers? (I do use iburst, from all the other machi

Re: [ntp:questions] Secure NTP

2011-03-28 Thread jimp
Chris Albertson wrote: > On Mon, Mar 28, 2011 at 8:56 AM, wrote: > >> >> OK, so the bad guy sets up the stuff for a GPS spoofer and parks it next >> to the targeted building where high dollar value stuff goes on in hopes >> of tweeking their system clocks and stealing a fortune. > > The best a

[ntp:questions] Venting steam: Autokey in 4.2.6/4.2.7

2011-03-28 Thread Dave Hart
http://support.ntp.org/bin/view/Support/ConfiguringAutokey For ntpd 4.2.4 and earlier, Steve Kostecke patiently worked out step-by-step instructions, and refined them over time heping people to use them, as seen on the page referenced above. For 4.2.6 ntp-keygen and autokey got an overhaul which

Re: [ntp:questions] Venting steam: Autokey in 4.2.6/4.2.7

2011-03-28 Thread David L. Mills
Dave, When all else fails, read the documentation. There were good reasons to change the configuration in minor ways. 1. There was a huge vulnerability if the identity file was specified by the server, but the correct file was not specified by the client. The scheme devolved to TC with no wa

Re: [ntp:questions] Venting steam: Autokey in 4.2.6/4.2.7

2011-03-28 Thread Dave Hart
On Tue, Mar 29, 2011 at 12:53 AM, David L. Mills wrote: > I sent you a message requesting to test this before deployment. > > I was referring to docs galore as I thrashed about earlier. I don't doubt each of your changes was an improvement, but each one also made Steve's 4.2.4 step-by-step guide