Gentoo Archives: gentoo-dev

From: Andrew Savchenko <bircoph@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] Signed push & clock drift rejection
Date: Tue, 19 Jul 2016 08:09:50
Message-Id: 20160719110927.bd141e8fe9ddc8a791b496a7@gentoo.org
In Reply to: Re: [gentoo-dev] Signed push & clock drift rejection by james
1 On Mon, 18 Jul 2016 16:25:34 -0500 james wrote:
2 > On 07/18/2016 03:03 PM, Marc Schiffbauer wrote:
3 > > * Rafael Goncalves Martins schrieb am 18.07.16 um 03:12 Uhr:
4 > >> On Sat, Jul 16, 2016 at 11:33 AM, Andrew Savchenko <bircoph@g.o> wrote:
5 > >>> Set it for a minute or two. This will protect from commits from
6 > >>> really out-of-sync systems (like 14 days mentioned above) and will
7 > >>> keep usablity hight for others.
8 > >>
9 > >> I second this "request" :)
10 > >>
11 > >> remote: Your system clock is off by 6 seconds (limit 5)
12 > >
13 > > Why not fix your system clock? No ntpd running?
14 > >
15 > > Check 'ntpq -pn'
16 > >
17 > > -Marc
18 > >
19 >
20 > net-misc/openntpd is simple and might do the job well enough, or is
21 > net-misc/ntp a hard requirement ?
22 >
23 > I just use the default (gentoo) time servers, for now, but perhaps
24 > using specified servers in different regions might work too?
25
26 Any ntp sync daemon will be fine.
27
28 I prefer net-misc/chrony: it is simpler and more secure than ntpd
29 (e.g. look at CVE counts) and handles well situations when upstream
30 servers go offline (e.g. continues to apply calculated drift to rtc
31 clock). Though it doesn't support all features of ntpd (e.g. ssl),
32 it has all subset of them sufficient IRL.
33
34 Best regards,
35 Andrew Savchenko