[28329] in Kerberos
Re: regarding clock skew difference between client and KDC
daemon@ATHENA.MIT.EDU (Danny Mayer)
Mon Sep 3 14:43:04 2007
Message-ID: <46DC552E.6000908@ntp.isc.org>
Date: Mon, 03 Sep 2007 14:40:46 -0400
From: Danny Mayer <mayer@ntp.isc.org>
MIME-Version: 1.0
To: ESWAR <eswars@huawei.com>
In-Reply-To: <1188820525.472488.175490@k79g2000hse.googlegroups.com>
X-kostecke.net-MailScanner-From: mayer@ntp.isc.org
Cc: kerberos@mit.edu
Reply-To: mayer@ntp.isc.org
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
ESWAR wrote:
> On Aug 24, 7:53 am, Danny Mayer <ma...@ntp.isc.org> wrote:
>
>> That violates the RFC requirements. No server will or should allow you
>> to do that. Why are you not synchronizing your clocks? NTP is available
>> on just about all platforms so there's no reason not to use it.
>>
>>> Please give me some suggestion how I can do this.
>> You can't.
>>
>> Danny
>
> I wanted to use Kerberos authentication from machine which is not
> joined to domain. so Time should effect my authentication process.
> Even Client has different time then KDC time it should authenticate.
Please understand the answer that I gave you above. You cannot
authenticate a client who's UTC time is different by more than 5 minutes
from the KDC's UTC time. Anything else would be a protocol and a
security violation.
> Where can i change in MIT source code.
You can't.
> so i wanted to use KDC System time and use the same all the places
> where it is refering get local system time.
Install NTP everywhere and point them to 3-4 good NTP sources.
>
> what are all problems i will get if do this.
>
You will fail to authenticate. See RFC 1510 Section 3.2.3.
Danny
P.S. All questions should go to the mailing list and not to me personally.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
