From owner-freebsd-security Thu Aug 19 15:20:40 1999 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id 2C9ED151BD for ; Thu, 19 Aug 1999 15:20:35 -0700 (PDT) (envelope-from brett@lariat.org) Received: from mustang (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id QAA22977; Thu, 19 Aug 1999 16:20:25 -0600 (MDT) Message-Id: <4.2.0.58.19990819161554.04790800@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Thu, 19 Aug 1999 16:17:20 -0600 To: Archie Cobbs , Goran.Lowkrantz@infologigruppen.se (Lowkrantz Goran) From: Brett Glass Subject: Re: Securelevel 3 ant setting time Cc: freebsd-security@FreeBSD.ORG ('freebsd-security@FreeBSD.ORG') In-Reply-To: <199908191819.LAA94866@bubba.whistle.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org My server uses a cron job and ntpupdate to grab tne time from the best of several accurate government servers. Would securelevel 3 allow this? --Brett Glass At 11:19 AM 8/19/99 -0700, Archie Cobbs wrote: >Lowkrantz, Goran writes: > > Just found that I can't correct the time on my firewall, running at security > > level 3. When I try I get the following: > > > > date: settimeofday (timeval): Operation not permitted > > > > Is this by design? If so, why? > >Yes, this is to prevent attacks that use wrong time settings. >You are allowed to change the time a little bit, just not a lot. > >The solution would be to do somthing like this.. > > - At boot time, before setting the securelevel, run ntpdate > - Run xntpd normally > >-Archie > >___________________________________________________________________________ >Archie Cobbs * Whistle Communications, Inc. * http://www.whistle.com > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message