Hi,
* During client installation, the installer calls "/usr/bin/timeout ntpd
-qgc <temp conf file>" in order to synchronize the clock with either
a/ one of the servers specified in --ntp-server
b/ a NTP server found in the DNS (_ntp._udp in the domain)
or
c/ the master
This command does not configure the NTP service but rather performs a
one-time synchronization even if the offset is big. Did you check if
chrony offers a similar option?
* In the design doc you mention calling a command line that will perform
the config of chronyd but we have no information on this command line
(which options, what does it do exactly...)
* For the upgrade, the plan is to remove ntpd service configuration. We
should perform this only if ntp was configured by ipa-client-install (if
the config was existing before client install and the client was
installed with -N, then FreeIPA is not managing the time and the upgrade
should not mess with it either).
* For the config of ntp, we were checking if chronyd was already
configured and required --force-ntp to remove chronyd conf and configure
ntpd instead. In the current proposal, the behavior is not identical
because we do not offer --force-chrony. Is it on purpose?
* Test plan:
you can already add a few scenarii, like:
fresh install with -N and ntp already setup
fresh install with -N and chrony already setup
fresh install with -N and without any time conf
fresh install without any time option and ntp already setup
fresh install without any time option and chrony already setup
fresh install without any time option and without any time conf
upgrade on instance installed with -N and ntp already setup
upgrade on instance installed with -N and chrony already setup
upgrade on instance installed with -N and without any time conf
upgrade on instance installed without any time option and ntp already setup
upgrade on instance installed without any time option and chrony already
setup
upgrade on instance installed without any time option and without any
time conf
Flo
On 01/24/2018 04:25 PM, Tibor Dudlák via FreeIPA-devel wrote:
Hello FreeIPA-devel listfellow beings!
I would like to continue the discussion started in [1], and find
itssolution.
While using the Single-Sign-on authentication provided via anMIT
Kerberos KDC there must not be any significant clock skew between
server and clients so a time synchronization service is required.
Red Hat Enterprise Linux is about to deprecate ntpd service and will
support chronyd instead. This will happen in release 8 and by this time
we should agree on some changes in IPA-whether to remove or replace the
already used ntpd service. I would like to sum up thischange in a design
page but there shouldbe an agreementfirst.
IPA,as is,checks the system configuration and if there is anNTP service
configured and running then it forces ntpd, meaning it disablesany other
NTP service. It also altersits configuration, and restartsthe NTP
service instance.
We may now want to consider, as the time sync servicechange is required,
to NOT configureaservice that is not a part oftheidentity management
such as NTP, and leave it to system/IPA administrators.
IPA install script may only check wheterthere is an NTP service running
and if not, it wouldask the administrator to configure it before the IPA
installation.
Upgrade of IPA might be more complicated because there will be thentpd
service entry in LDAP,and the service will be up and running. I would
suggest that we do not remove any working ntpd service already
configured but only disown it from IPA's LDAP tree.
I will be glad for any input from you people and hopefully there will be
an acceptable solution for this soon :)
Thanks!
[1]
https://www.redhat.com/archives/freeipa-devel/2016-November/msg00807.html
--
Tibor Dudlák
Identity management - FreeIPA
Brno, TPB-C, 2C407
Red Hat
_______________________________________________
FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org