NTP vulnerability

[sean darcy]

On 12/22/2014 08:32 AM, Ed Greshko wrote:
> On 12/22/14 20:50, Patrick O'Callaghan wrote:
>> On Mon, 2014-12-22 at 04:48 +0800, Ed Greshko wrote:
>>> On 12/22/14 02:46, Aaron Gray wrote:
>>>> There are no ntp or ntpd or systemd-timesyncd packages on F20 !
>>> The default time sync package is now chrony.
>>>
>>> ntp is available in the F20 repos.
>>>
>> AFAIK chrony still connects to NTP servers, however the vulnerability in
>> question is not with NTP as such but with ntpd, which as you say is no
>> longer part of Fedora.
>>
>
> Of course I didn't quite say that "ntpd is no longer part of Fedora".
>
> I did say (or meant to say) that for new installs chrony is used by default over ntpd.  But, ntpd is still available in the repos.  And, if you happen to have been using ntpd in earlier versions of Fedora and doing updates instead of a new install you'd still be using ntpd.
>
>
I'm on F20 (by fedup)  with ntp. I just ran yum to install chrony. yum 
didn't remove ntp* as part of the install.

How do you move to chrony?

sean