The "allow" option in chrony.conf is disabled by default

[Andrey Bychkov]

Hello all. I have a problem, the ipa client does not synchronize with 
the ipa server, because ipa server does not listen to the ipa client's 
address. By default the "allow" option is disabled in the chrony.conf. 
Why is it done? And is there an alternative? If "allow" is enable, all ok.

[Alexander Bokovoy]

On Wed, 05 Sep 2018, Andrey Bychkov via FreeIPA-devel wrote:
> Hello all. I have a problem, the ipa client does not synchronize with
>
> the ipa server, because ipa server does not listen to the ipa client's 
> address. By default the "allow" option is disabled in the chrony.conf. 
> Why is it done? And is there an alternative? If "allow" is enable, all 
> ok. 
As it was pointed earlier, before your patches arrived we decided to
discontinue providing NTP server support. Thus, a default setup has no
server configuration enabled.

With the changes you are proposing in
https://github.com/freeipa/freeipa/pull/2169 and
https://www.freeipa.org/page/V4/NTP_Servers_Configuration
does this policy need a change?


-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Andrey Bychkov]

When the IPA server will be installed, the settings for allowing 
listening to client addresses will be automatically changed in ntp confiles.


05.09.2018 11:00, Alexander Bokovoy пишет:
>  On Wed, 05 Sep 2018, Andrey Bychkov via FreeIPA-devel wrote:
> > Hello all. I have a problem, the ipa client does not synchronize with 
> > the ipa server, because ipa server does not listen to the ipa 
> > client's address. By default the "allow" option is disabled in the 
> > chrony.conf. Why is it done? And is there an alternative? If "allow" 
> > is enable, all ok.
>  As it was pointed earlier, before your patches arrived we decided to
>  discontinue providing NTP server support. Thus, a default setup has no
>  server configuration enabled.
>
>  With the changes you are proposing in
>  https://github.com/freeipa/freeipa/pull/2169 and
>  https://www.freeipa.org/page/V4/NTP_Servers_Configuration
>  does this policy need a change?
>
>

[Alexander Bokovoy]

On to, 06 syys 2018, Andrey Bychkov via FreeIPA-devel wrote:
> When the IPA server will be installed, the settings for allowing 
> listening to client addresses will be automatically changed in ntp 
> confiles. 
So, your original problem should be solved then, right?

For the current state of the code, it is expected that 'allow' is
disabled, as I explained already.

> 05.09.2018 11:00, Alexander Bokovoy пишет:
> >On Wed, 05 Sep 2018, Andrey Bychkov via FreeIPA-devel wrote:
> >>Hello all. I have a problem, the ipa client does not synchronize 
> >>with the ipa server, because ipa server does not listen to the ipa 
> >>client's address. By default the "allow" option is disabled in the 
> >>chrony.conf. Why is it done? And is there an alternative? If 
> >>"allow" is enable, all ok.
> >As it was pointed earlier, before your patches arrived we decided to
> >discontinue providing NTP server support. Thus, a default setup has no
> >server configuration enabled.
> >
> >With the changes you are proposing in
> >https://github.com/freeipa/freeipa/pull/2169 and
> >https://www.freeipa.org/page/V4/NTP_Servers_Configuration
> >does this policy need a change?
> >
> >
>  
> _______________________________________________
> FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]... 

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Andrey Bychkov]

Yes, I correcting my code.


06.09.2018 13:36, Alexander Bokovoy via FreeIPA-devel пишет:
>  On to, 06 syys 2018, Andrey Bychkov via FreeIPA-devel wrote:
> > When the IPA server will be installed, the settings for allowing 
> > listening to client addresses will be automatically changed in ntp 
> > confiles.
>  So, your original problem should be solved then, right?
>
>  For the current state of the code, it is expected that 'allow' is
>  disabled, as I explained already.
>
> >
> >
> > 05.09.2018 11:00, Alexander Bokovoy пишет:
> >> On Wed, 05 Sep 2018, Andrey Bychkov via FreeIPA-devel wrote:
> >>> Hello all. I have a problem, the ipa client does not synchronize 
> >>> with the ipa server, because ipa server does not listen to the ipa 
> >>> client's address. By default the "allow" option is disabled in
> the 
> >>> chrony.conf. Why is it done? And is there an alternative? If 
> >>> "allow" is enable, all ok.
> >> As it was pointed earlier, before your patches arrived we decided to
> >> discontinue providing NTP server support. Thus, a default setup has no
> >> server configuration enabled.
> >>
> >> With the changes you are proposing in
> >> https://github.com/freeipa/freeipa/pull/2169 and
> >> https://www.freeipa.org/page/V4/NTP_Servers_Configuration
> >> does this policy need a change?
> >>
> >>
> >
>
> > _______________________________________________
> > FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
> > To unsubscribe send an email to 
> > freeipa-devel-leave(a)lists.fedorahosted.org
> > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: 
> > https://lists.fedorahosted.org/archives/list/[e-mail]...
>
>