Re: [gpsd-dev] Moving ntpd to an open VCS

[Sanjeev Gupta]

On Tue, Oct 29, 2013 at 2:14 AM, Gary E. Miller <address@hidden> wrote:

I musta missed something, when did ntpd servers start using certificates??

My understanding:

1. My embedded system, without an battery-backed clock boots
2. I wish to avoid my ISP tampering with my DNS resolution (or other MitM attacks)
3. I start ntpd
4. ntpd looks for us.pool.ntp.org , or tick.navy.mil , etc
5. The local resolver gets an IP address for the hostnames above
6. It needs to do DNSSEC checking, before it passes the IP address to ntpd
   
7. Because the local clock is still 1 Jan 1970, or similar, the DNSSEC certs fail
8. ntpd gets no answer to its request to resolve the names in ntp.conf
9. So time stays stuck in 1970, etc

One could periodically check for working, reachable, ntp servers, and place their IP addresses in ntp.conf, but it is to avoid such hard-coding that the Pool is trying to prevent.

--
Sanjeev Gupta
+65 98551208     http://www.linkedin.com/in/ghane