[31000] in Kerberos
Re: kerberos and time zone
daemon@ATHENA.MIT.EDU (Andrea Cirulli)
Fri Apr 17 04:52:21 2009
MIME-Version: 1.0
In-Reply-To: <D8C9BC7FFCF8154FB7141EB8DB609C172905FB4C60@SGPAPHQ-EXSCC01.dc01.fujixerox.net>
Date: Fri, 17 Apr 2009 10:51:59 +0200
Message-ID: <191a80d00904170151o44e7239cub279589dafcf998f@mail.gmail.com>
From: Andrea Cirulli <acirulli@gmail.com>
To: "Xu, Qiang (FXSGSC)" <Qiang.Xu@fujixerox.com>, kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Obviously it is not possible....I cannot make such a decision, because there
are sensible data that needs that time is synch with the country in which
are located.
So there is no solution?
On Fri, Apr 17, 2009 at 10:43 AM, Xu, Qiang (FXSGSC) <Qiang.Xu@fujixerox.com
> wrote:
> Why not let your server sync with American NTP server?
>
> > -----Original Message-----
> > From: kerberos-bounces@mit.edu
> > [mailto:kerberos-bounces@mit.edu] On Behalf Of Andrea Cirulli
> > Sent: Friday, April 17, 2009 4:37 PM
> > To: kerberos@mit.edu
> > Subject: kerberos and time zone
> >
> > Hi all,
> >
> > I have the following problem:
> >
> > We are managing the authentication of several servers with
> > Kerberos. The issue lies in the fact that the servers are in
> > different time-zone, so we have problem with clock skew
> > errors. Are there any solution or workaround that accomplish
> > this requirement using different ntp in different time zone
> > in a way that the KDC server knows which is the real clock
> > skew between two different time zone?
> >
> > Let's say i have a server located in Rome and its time is
> > synch with an italian ntp and we have a server located in New
> > York with time synch with an American NTP. Considering the
> > time zone the two times are synch, however for kerberos are desynch.
> >
> > Is there any workaround or solution to this issue?
> >
> > We are planning to use a bigger clock skew which will cover
> > the difference between the two time zones ( this is the worst
> > solution).
> >
> > Any hint would be helpful.
> >
> > Thanks in advance.
> >
> > --
> > Andrea Cirulli
> > ________________________________________________
> > Kerberos mailing list Kerberos@mit.edu
> > https://mailman.mit.edu/mailman/listinfo/kerberos
> >
--
Andrea Cirulli
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
