Subject: Re: [ntpwg] [dhcwg] Fwd: New Version Notification for draft-ogud-dhc-udp-time-option-01.txt

From: TGLASSEY <[email-masked]>
Date: Mon, 13 Jan 2014 22:31:01 -0800

On 12/1/2013 8:47 PM, Hal Murray wrote:
> Does DNS using DNSSEC return a specific error code for time-invalid?  Or just
> a generic didn't-work?
It will depend on the implementation.
>
> How close does the time have to be for DNSSEC to work?

Again it will depend on the implementation. Kerberos tickets for cross 
mounting a microsoft file system can be made to expire in a short enough 
time frame that this could cause issues.
>
> Could this problem be solved by setting up a bank of NTP servers at well
> known IP Addresses?  Say, one next to each root DNS server.
This is why a NTP proxy would be a good tool.
> If you tried to
> do that, I'd expect a serious problem would be overload because idiots would
> try to use them for normal NTP use rather than just getting off the ground.
You guys host one right? So you know... We see insane levels of use. 
Most all of us in the ITS program do.
> It might be possible to discourage that by making them return crappy time.
No - that's not really an acceptable trust thing.
>
>
> [email-masked] said:
>> As for the home router use model, it may be that what you really want is for
>> the home router to query for an FQDN-only DHCP option from the ISP DHCP
>> server, and then resolve that FQDN and respond to DHCP clients on the
>> homenet with an IP address.   Since the FQDN is not hard-coded, and the IP
>> address is (one hopes) resolved either at query time or when its TTL
>> expires, this ought to prevent a repeat of the firmware burn-in incident.
> Most ISPs already provide DNS servers for their customers.  How do their IP
> address get setup in home routers?

DHCP in most instances.
>   Could NTP servers piggyback on that
> mechanism if ISPs also provided NTP servers?
>
Sure and from the perspective of the Cable or provider who does control 
the last mile they just run their own perimeter or edge based services 
and configure them in with DHCP. Again the client never sees it.

-- 
-------------

Personal Email - Disclaimers Apply

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg