diff options
| author | Reyk Floeter <reyk@cvs.openbsd.org> | 2015-02-10 06:40:09 +0000 |
|---|---|---|
| committer | Reyk Floeter <reyk@cvs.openbsd.org> | 2015-02-10 06:40:09 +0000 |
| commit | 30d20b716e66b1f85838cb182cf559a5dbb74f8d (patch) | |
| tree | 7f5ff89475eaf36c7543b26cd2df180930ed47cc /etc | |
| parent | f1fa0ce413d09843226a5aecc06902194ce48d33 (diff) | |
Add support for "constraints": when configured, ntpd(8) will query the
time from HTTPS servers, by parsing the Date: header, and use the
median constraint time as a boundary to verify NTP responses. This
adds some level of authentication and protection against MITM attacks
while preserving the accuracy of the NTP protocol; without relying on
authentication options for NTP that are basically unavailable at
present. This is an initial implementation and the semantics will be
improved once it is in the tree.
Discussed with deraadt@ and henning@
OK henning@
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/examples/ntpd.conf | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/etc/examples/ntpd.conf b/etc/examples/ntpd.conf index 7fcbbed08cd..2446fc755fb 100644 --- a/etc/examples/ntpd.conf +++ b/etc/examples/ntpd.conf @@ -1,4 +1,4 @@ -# $OpenBSD: ntpd.conf,v 1.1 2014/07/13 13:53:36 rpe Exp $ +# $OpenBSD: ntpd.conf,v 1.2 2015/02/10 06:40:08 reyk Exp $ # sample ntpd configuration file, see ntpd.conf(5) # Addresses to listen on (ntpd does not listen by default) @@ -16,3 +16,6 @@ servers pool.ntp.org # use all detected timedelta sensors #sensor * + +# get the time constraint from a well-known HTTPS site +#constraints from "https://www.google.com/search?q=openntpd" |