From owner-freebsd-security@FreeBSD.ORG  Tue Dec 23 04:38:57 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 142F7D1B
 for <freebsd-security@freebsd.org>; Tue, 23 Dec 2014 04:38:57 +0000 (UTC)
Received: from dyslexicfish.net (dyslexicfish.net [91.109.5.35])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id A512C1200
 for <freebsd-security@freebsd.org>; Tue, 23 Dec 2014 04:38:56 +0000 (UTC)
Received: from dyslexicfish.net (dyslexicfish.net [91.109.5.35])
 by dyslexicfish.net (8.14.5/8.14.5) with ESMTP id sBN4csrX030742;
 Tue, 23 Dec 2014 04:38:54 GMT (envelope-from jamie@dyslexicfish.net)
Received: (from jamie@localhost)
 by dyslexicfish.net (8.14.5/8.14.5/Submit) id sBN4coM8030741;
 Tue, 23 Dec 2014 04:38:50 GMT (envelope-from jamie)
From: Jamie Landeg-Jones <jamie@dyslexicfish.net>
Message-Id: <201412230438.sBN4coM8030741@dyslexicfish.net>
Date: Tue, 23 Dec 2014 04:38:50 +0000
To: freebsd-security@freebsd.org, cnehren+freebsd-security@pobox.com,
 brett@lariat.org
Subject: Re: ntpd vulnerabilities
References: <252350272.1812596.1419241828431.JavaMail.zimbra@cleverbridge.com>
 <B6AF154A-FE22-4357-9031-91D661FD7E57@localhost.lu>
 <F7FACD2F-3AFE-4717-B4B9-B54A6FC70458@localhost.lu>
 <201412221745.KAA28186@mail.lariat.net>
 <20141222185238.GA3308@behemoth.lan>
 <201412222323.QAA01574@mail.lariat.net>
In-Reply-To: <201412222323.QAA01574@mail.lariat.net>
User-Agent: Heirloom mailx 12.4 7/29/08
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7
 (dyslexicfish.net [91.109.5.35]); Tue, 23 Dec 2014 04:38:54 +0000 (GMT)
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Dec 2014 04:38:57 -0000

Brett Glass <brett@lariat.org> wrote:

> Within my own network, I have used cron and ntpdate (even though it's
> officially deprecated) on most of the clients, querying a couple of

I think ntpdate is only deprecated because it's functionality is provided
by 'ntpd -q'

> on them. But it obviously has some drawbacks; in particular, it doesn't
> continuously correct the clocks but makes them jump at particular
> times of day.

Until recently, I'd been using this too, however, using the '-B' option to
ntpdate ('-x' to nptd) to slew the clock instead. A couple of these a day in
cron causes neglegable drift, unless your clock ain't too good!

Cheers, Jamie