| Re: [chrony-users] NTS: Limiting |
[ Thread Index |
Date Index
| More chrony.tuxfamily.org/chrony-users Archives
]
- To: "chrony-users@xxxxxxxxxxxxxxxxxxxx" <chrony-users@xxxxxxxxxxxxxxxxxxxx>
- Subject: Re: [chrony-users] NTS: Limiting
- From: FUSTE Emmanuel <emmanuel.fuste@xxxxxxxxxxxxxxx>
- Date: Wed, 20 Jan 2021 09:12:15 +0000
- Accept-language: fr-FR, en-US
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thalesgroup.com; s=xrt20181201; t=1611133936; bh=CNYLizpeyrnztPQtIPvWgWLqJnFJRkxwpJp5Xyq2iz4=; h=From:To:Subject:Date:Message-ID:References:In-Reply-To: Content-Transfer-Encoding:MIME-Version:From; b=Osc80UWYwD62z72h9sx0M+Y2m7/YmJCoGuSwIqNApcrBzbLsMvWqMwb5We3wKd++u T8jRMWcjfHh3xYaDc5Ww2yJ0vCwGCy6dQiBqCJHD73LJnxnTSFeAzbO3JWYxz1pYqy 0MTV0nd0AqHLdbgc9smCKW1d56tBcLHyL/Ec7IbTCPzPST4mlmbshQ4yPZnjQbayDy YlAXOz61+es2kPbklV1P1itp+cJYD5E6IuIUOgFT0t9X2Zsd3CTwUj1O0lWhWSdxzd ICQRF73FTpDQVc/tDyzZLVnhjiop7DNpMrMfZlp4ABE7Qd3RpiVK5A9L/3NJzgWtKP so2Z8+HyBGnrA==
- Thread-index: AQHW7nsWScwpqBHI40SCUYjUS5BgnaovIHuAgAAI4ICAAAOMAIAA+72AgAACUIA=
- Thread-topic: [chrony-users] NTS: Limiting
Le 20/01/2021 à 10:03, Karol Babioch a écrit :
> Hi,
>
> Am 19.01.21 um 19:02 schrieb Kurt Roeckx:
>> In your config file
>> you need to say something like "server ntp.example.org nts". This
>> means you will only accept certificates that have ntp.example.org
>> in the certificate. If you only trust Let's encrypt, you will only
>> trust certificates issued by Let's encrypt for ntp.example.org.
> Yes, that is correct when you specify servers explicitly.
>
>> I have no idea what kind of attack surface you have in mind.
> I'm wondering how this behaves in case of pools, i.e. when I run a
> private pool of NTP servers, i.e. "pool.example.com".
>
> When I have something like this in my chrony.conf:
>
>> pool pool.example.com iburst maxsources 3
> Is NTS even possible in such a context? AFAIK only A records with IP
> addresses are resolved, so I'm not sure if and how certificates can be
> validated.
There is no NTS for the pool for now. Some technical pieces are missing
and need to be defined/specified.
There is some propositions for a SRV record usage for NTP/NTS, but any
projection is premature.
So the problem you try to solve does not exist now: you always specify
server explicitly in a NTS context.
Emmanuel.N������y隊W!���������n���\�� "������z)�.n7��Z+��f����|�������'��}���*+�����)�.n7��:蹹^f��X��f����'��}���*+