Re: [chrony-dev] cmdmon authentication is gone

[Bryan Christianson <bryan@xxxxxxxxxxxxx>]

> On 22/08/2015, at 12:22 am, Miroslav Lichvar <mlichvar@xxxxxxxxxx> wrote:
> 
> As per the discussion we had on this list couple months ago, the
> cmdmon authentication has been replaced by communication over Unix
> domain sockets and configuration commands are now allowed by the
> permissions on the file system.
> 
> If you would like to test it, please make sure that:
> 
> - when /var/run/chrony doesn't exist, it's created with root or chrony
>  (when dropping privileges) owner and it's not accessible by others
> - when /var/run/chrony does exists and doesn't have correct
>  permissions or owner, chronyd will refuse to create the Unix socket
> - chronyd doesn't allow any remote configuration commands
> - attempts to authenticate with an older chronyc result in a failure
> - chronyc selects the Unix/IPv4/IPv6 socket correctly depending on
>  what permissions it has and chronyd created (e.g. with -4/-6 option)

It looks good on MacOS - user permissions choose local host and root permissions choose unix socket. I also saw expected failure with older client.


number9:~ bryan$ chronyc -d tracking
Resolved 127.0.0.1 to 127.0.0.1
Resolved ::1 to ::1
Opening connection to /var/run/chrony/chronyd.sock
Could not connect socket : Permission denied
Opening connection to 127.0.0.1:323
Sent 104 bytes
Received 104 bytes
Reply cmd=33 reply=5 stat=0 seq=0
Reference ID    : 10.64.1.25 (fleur.lan.seaviewsound.co.nz)
Stratum         : 2
Ref time (UTC)  : Fri Aug 21 13:45:59 2015
System time     : 0.000001598 seconds slow of NTP time
Last offset     : +0.000001509 seconds
RMS offset      : 0.000007692 seconds
Frequency       : 17.337 ppm fast
Residual freq   : +0.002 ppm
Skew            : 0.303 ppm
Root delay      : 0.000362 seconds
Root dispersion : 0.000093 seconds
Update interval : 8.1 seconds
Leap status     : Normal
number9:~ bryan$ sudo chronyc -d tracking
Password:
Resolved 127.0.0.1 to 127.0.0.1
Resolved ::1 to ::1
Opening connection to /var/run/chrony/chronyd.sock
Sent 104 bytes
Received 104 bytes
Reply cmd=33 reply=5 stat=0 seq=0
Reference ID    : 10.64.1.25 (fleur.lan.seaviewsound.co.nz)
Stratum         : 2
Ref time (UTC)  : Fri Aug 21 13:46:15 2015
System time     : 0.000005477 seconds fast of NTP time
Last offset     : -0.000000342 seconds
RMS offset      : 0.000007694 seconds
Frequency       : 17.203 ppm fast
Residual freq   : -0.004 ppm
Skew            : 0.277 ppm
Root delay      : 0.000308 seconds
Root dispersion : 0.000091 seconds
Update interval : 8.2 seconds
Leap status     : Normal


-- 
Bryan Christianson


--
To unsubscribe email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "unsubscribe" in the subject.
For help email chrony-dev-request@xxxxxxxxxxxxxxxxxxxx with "help" in the subject.
Trouble?  Email listmaster@xxxxxxxxxxxxxxxxxxxx.