[Ntp] Antw: [EXT] Circular dependencies

>>> Watson Ladd <watsonbladd@gmail.com> schrieb am 11.11.2020 um 18:21 in Nachricht
<CACsn0c=Xu31KyHu8+uq+fKBMVRt+YaJGZCfSn2ph1WXfm2atHw@mail.gmail.com>:
> Dear NTP WG,
> 
> I just realized there is a mailing list bug report that's a lot more
> interesting than it seems. They have a DNSSEC validating resolver and
> were using an NTP daemon to set the clock (and the RTC was busted) But
> the time is needed to verify liveness of the signatures for DNSSEC to
> validate, and without the names don't resolve, including the NTP
> server names.
> 
> This is probably a bigger issue with NTS, as certs with IP addresses
> are harder to get. Roughtime can use its own keys, but does still rely
> on the DNS often, so it won't necessarily be a solution. Any ideas?

Hi!

We have similar problems with network/LDAP/user resolution, and I wondered what the "best" solution would be. When eventually deciding it would be best to have local copies of the LDAP users involved, I noticed that the tools (useradd, usermod) would not allow to create identical local users if a user with the same name exists in LDAP...

I guess  the situation should be better with the host name scenario, but unlike (system) users, DNS records change more frequently. Maybe some type of local cache ("boot persistant") would be best.

Interestingly autokey had the same problem: If the system has no time, it cannot get the time via autokey...

Regards,
Ulrich

> 
> Sincerely,
> Watson Ladd
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 