talexander
/
freebsd_amp_hwpstate
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
freebsd_amp_hwpstate/contrib/ntp/html/authopt.html

97 lines
7.7 KiB
HTML
Raw Normal View History

Virgin import of ntpd 4.2.0
2004-07-20 15:01:56 +00:00
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
<head>
<meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
<meta name="generator" content="HTML Tidy, see www.w3.org">
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<title>Authentication Commands and Options</title>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<!-- Changed by: stenn, 25-May-2018 -->
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
<link href="scripts/style.css" type="text/css" rel="stylesheet">
<style type="text/css">
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
.style1 {
color: #FF0000;
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
font-weight: bold;
}
</style>
</head>
<body>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<h3>Authentication Commands and Options</h3>
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
<img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a>
<p>Our resident cryptographer; now you see him, now you don't.</p>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<p>Last update:
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<!-- #BeginDate format:En2m -->24-Jul-2018 07:27<!-- #EndDate -->
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
UTC</p>
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
<br clear="left">
<h4>Related Links</h4>
<script type="text/javascript" language="javascript" src="scripts/command.txt"></script>
<script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script>
<hr>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<h4>Commands and Options</h4>
<p>Unless noted otherwise, further information about these commands is on the <a href="authentic.html">Authentication Support</a> page.</p>
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
<dl>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt id=automax><tt>automax [<i>logsec</i>]</tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specifies the interval between regenerations of the session key list used with the Autokey protocol, as a power of 2 in seconds. Note that the size of the key list for each association depends on this interval and the current poll interval. The default interval is 12 (about 1.1 hr). For poll intervals above the specified interval, a session key list with a single entry will be regenerated for every message sent. See the <a href="autokey.html">Autokey Public Key Authentication</a> page for further information.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt id="controlkey"><tt>controlkey <i>keyid</i></tt></dt>
<dd>Specifies the key ID for the <a
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
href="ntpq.html"><tt>ntpq</tt></a> utility, which uses the
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
standard protocol defined in RFC-1305. The <tt><i>keyid</i></tt> argument is the key ID for a <a href="#trustedkey">trusted
key</a>, where the value can be in the range 1 to 65535,
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
inclusive.</dd>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dt id="crypto"><tt>crypto [digest <i>digest</i>] [host <i>name</i>] [ident <i>name</i>] [pw <i>password</i>] [randfile <i>file</i>]</tt></dt>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dd>This command activates the Autokey public key cryptography
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
and loads the required host keys and certificate. If one or more files
are unspecified, the default names are used. Unless
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
the complete path and name of the file are specified, the location of a file
is relative to the keys directory specified in the <tt>keysdir</tt> configuration
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
command with default <tt>/usr/local/etc</tt>. See the <a href="autokey.html">Autokey Public Key Authentication</a> page for further information. Following are the options.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dd>
<dl>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dt><tt>digest</tt> <i>digest</i></dt>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dd>&nbsp;</dd>
<dd>Specify the message digest algorithm, with default MD5. If the OpenSSL library
is installed, <tt><i>digest</i></tt> can be be any message digest algorithm supported
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
by the library. The current selections are: <tt>MD2</tt>, <tt>MD4</tt>, <tt>MD5,</tt> <tt>MDC2</tt>, <tt>RIPEMD160</tt>, <tt>SHA</tt> and <tt>SHA1</tt>. All
participants in an Autokey subnet must use the same algorithm. The Autokey message digest algorithm is separate and distinct from the symmetric
key message digest algorithm. Note: If compliance with FIPS 140-2 is required,
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
the algorithm must be ether <tt>SHA</tt> or <tt>SHA1</tt>.</dd>
<dt><tt>host <i>name</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specify the cryptographic media names for the host, sign and certificate files. If this option is not specified, the default name is the string returned by the Unix <tt>gethostname()</tt> routine.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dd><span class="style1">Note: In the latest Autokey version, this option has no effect other than to change the cryptographic media file names.</span></dd>
<dt><tt>ident <i>group</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specify the cryptographic media names for the identity scheme files. If this option is not specified, the default name is the string returned by the Unix <tt>gethostname()</tt> routine.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dd><span class="style1">Note: In the latest Autokey version, this option has no effect other than to change the cryptographic media file names.</span></dd>
<dt><tt>pw <i>password</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specifies the password to decrypt files previously encrypted by the <tt>ntp-keygen</tt> program with the <tt>-p</tt> option. If this option is not specified, the default password is the string returned by the Unix <tt>gethostname()</tt> routine.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt><tt>randfile <i>file</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specifies the location of the random seed file used by the OpenSSL library. The defaults are described on the <a href="keygen.html"><tt>ntp-keygen</tt> page</a>.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
</dl>
</dd>
<dt id="ident"><tt>ident <i>group</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specifies the group name for ephemeral associations mobilized by broadcast and symmetric passive modes. See the <a href="autokey.html">Autokey Public-Key Authentication</a> page for further information.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt id="keys"><tt>keys <i>path</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specifies the complete directory path for the key file containing the key IDs, key types and keys used by <tt>ntpd</tt>, <tt>ntpq</tt> and <tt>ntpdc</tt> when operating with symmetric key cryptography. The format of the keyfile is described on the <a href="keygen.html"><tt>ntp-keygen</tt> page</a>. This is the same operation as the <tt>-k</tt> command line option. Note that the directory path for Autokey cryptographic media is specified by the <tt>keysdir</tt> command.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt id="keysdir"><tt>keysdir <i>path</i></tt></dt>
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
<dd>Specifies the complete directory path for the Autokey cryptographic keys, parameters and certificates. The default is <tt>/usr/local/etc/</tt>. Note that the path for the symmetric keys file is specified by the <tt>keys</tt> command.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt id="requestkey"><tt>requestkey <i>keyid</i></tt></dt>
<dd>Specifies the key ID for the <a href="ntpdc.html"><tt>ntpdc</tt></a> utility program, which
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
uses a proprietary protocol specific to this implementation of <tt>ntpd</tt>. The <tt><i>keyid</i></tt> argument is a key ID
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
for a <a href="#trustedkey">trusted key</a>, in the range 1 to
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
65535, inclusive.</dd>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
<dt id="revoke"><tt>revoke [<i>logsec</i>]</tt></dt>
<dd>Specifies the interval between re-randomization of certain cryptographic values used by the Autokey scheme, as a power of 2 in seconds, with default 17 (36 hr). See the <a href="autokey.html">Autokey Public-Key Authentication</a> page for further information.</dd>
<dt id="trustedkey"><tt>trustedkey [<i>keyid</i> | (<i>lowid</i> ... <i>highid</i>)] [...]</tt></dt>
<dd>Specifies the key ID(s) which are trusted for the purposes of
authenticating peers with symmetric key cryptography. Key IDs
used to authenticate <tt>ntpq</tt> and <tt>ntpdc</tt> operations
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
must be listed here and additionally be enabled with <a href="#controlkey">controlkey</a> and/or <a href="#requestkey">requestkey</a>. The authentication
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
procedure for time transfer requires that both the local and
remote NTP servers employ the same key ID and secret for this
purpose, although different keys IDs may be used with different
Vendor import of ntp-4.2.8p12.
2018-08-20 06:07:33 +00:00
servers. Ranges of trusted key IDs may be specified: <tt>trustedkey (1 ... 19) 1000 (100 ... 199)</tt> enables the
lowest 120 key IDs which start with the digit 1. The spaces
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
surrounding the ellipsis are required when specifying a range.</dd>
Virgin import of ntpd 4.2.6p5. When the series of commits is complete, things like https://cert.litnet.lt/en/docs/ntp-distributed-reflection-dos-attacks should be fixed. PR: bin/148836 (except that we import a newer version) Asked by: Too many MFC after: 2 weeks
2013-12-04 21:33:17 +00:00
</dl>
<hr>
<script type="text/javascript" language="javascript" src="scripts/footer.txt"></script>
</body>
Vendor import ntp 4.2.8. Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
2014-12-20 22:52:39 +00:00
</html>