Mailinglist Archive: opensuse (807 mails)

[Hans Witvliet <hwit@xxxxxxxxxxx>]

On Fri, 2010-04-16 at 23:02 +0200, Carlos E. R. wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 2010-04-16 11:29, Hans Witvliet wrote:
> > On Fri, 2010-04-16 at 11:21 +0200, Per Jessen wrote:
> > > Hans Witvliet wrote:
> > >
> > > > To explain the sitiation a bit better:
> > > > I'm drawing up a list of steps to take for installing a CA.
> > > > One of the aspects is that i want to be sure that my time is correct.
> > > > This is, because the certificate defines explicitly an begin/ending
> > > > date of the validity.
> > >
> > > Hmm, you don't need NTP-style accuracy for that.  A couple of seconds to
> > > one side or the other makes no difference. 
> >
> > No, but if someone manage to shift it a year, makes a crt, shift it
> > again, another crt,....
> >
> > (perhaps i'm getting paranoid)
>
> Changing the time needs to be root. If the attacker has already root access, 
> it does not matter if
> you use ntp auth or not >:-)
>
>
> On the practical side, if your ntp daemon is configured to interrogate, say, 
> a dozen of presumably
> safe ntp servers, in order to get your server to shift the time they have to 
> hack the majority of
> your ntp peers.
>
> I fail to see the need of authentication for ntp, but I can easily be 
> misinformed O:-)

How about spoofing the ntp-source and doing a reboot?
Logging in as ca-admin and signing a CSR...

No need for root privilege... afaics, just the knowledge of the ip of
the ntp-server and some iron doing an ntp-impersonation!

-- 
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx