| Re: [chrony-users] NTS: Limiting |
[ Thread Index |
Date Index
| More chrony.tuxfamily.org/chrony-users Archives
]
- To: chrony-users@xxxxxxxxxxxxxxxxxxxx
- Subject: Re: [chrony-users] NTS: Limiting
- From: Miroslav Lichvar <mlichvar@xxxxxxxxxx>
- Date: Wed, 20 Jan 2021 11:32:28 +0100
- Authentication-results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=mlichvar@xxxxxxxxxx
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1611138754; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ASKUR+VX4bQh1RBbBM5Md3xmi4ZdZj+N5lI4npU7szg=; b=VoGVzH94ieI3P+oFDhbpIhC5RTbnGT+z1Wk6O43Q3edq3v/YGJMDrQfV6FfxnNp7wYN+sV wouPGbPTA6bKdrpVrZKTPd+KzSiutjTLt11TvozOK4xLy+oSOXCNHafVKJVyr0ul2xOLJ+ DDr5MTjn8j85bHjADBsfDw2mdFbjav8=
On Wed, Jan 20, 2021 at 09:25:59AM +0000, FUSTE Emmanuel wrote:
> Le 20/01/2021 à 10:15, Miroslav Lichvar a écrit :
> > Yes, NTS can work with pools. The servers need to have the same name
> > in their certificates, one that matches the name specified in the
> > chrony config.
> Ok very specific case, but perfectly usable for "private" pool.
Yes, easy to implement if you control all the servers, but it could work
even in a big pool like pool.ntp.org if some automation around
certificates was implemented.
The main problem with the pool.ntp.org pool is different. How much
sense does it make to enable NTS if an attacker can simply join the
pool and get the certificate (or get its name in a signed SRV record
if the pool was relying on SRV protected by DNSSEC)?
BTW, this is a good example why the clients need to check the validity
of certificates and DNS records properly. If the attacker was removed
from the pool (and didn't bother to join again under different
account), he could still perform a MITM attack on clients that don't
know the current time to be able to reject the old data.
--
Miroslav Lichvar
--
To unsubscribe email chrony-users-request@xxxxxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject.
For help email chrony-users-request@xxxxxxxxxxxxxxxxxxxx
with "help" in the subject.
Trouble? Email listmaster@xxxxxxxxxxxxxxxxxxxx.