Re: [logs] Due Diligence for Admission in Court - Time

From: Kyle R. Hofmann (krhat_private)
Date: Tue Dec 04 2001 - 17:54:10 PST

Next message: Tina Bird: "[logs] Linux Event Logging"

Previous message: Tina Bird: "Re: [logs] Due Diligence for Admission in Court"
In reply to: todd glassey: "Re: [logs] Due Diligence for Admission in Court - Time"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Tue, 04 Dec 2001 17:24:44 -0800, "todd glassey" wrote:
> > Just a comment here.
> > I don't think (IANAL) that the court is going to care about accuracy past
> > about a minute.
> 
> the problem is that you cannot prove that you got the time from an NTP
> Server, unless ou keep copious records of data transit throughout your
> network. That is the problem with NTP.

Wouldn't a line like:

Dec  4 HH:MM:SS hostname ntpd[1234]: time reset x.yyyyyy s

in your syslog count?  At the least it shows that you're running a time
service daemon, and if you have a demonstrably authentic backup of your
ntpd configuration, you should be able to prove that you were synchronizing
yourself to UTC.

That suggests something--we should sign backups of our configuration
files after every change so that we can prove everything was correctly
configured.

-- 
Kyle R. Hofmann <krhat_private>

---------------------------------------------------------------------
To unsubscribe, e-mail: loganalysis-unsubscribeat_private
For additional commands, e-mail: loganalysis-helpat_private

Next message: Tina Bird: "[logs] Linux Event Logging"
Previous message: Tina Bird: "Re: [logs] Due Diligence for Admission in Court"
In reply to: todd glassey: "Re: [logs] Due Diligence for Admission in Court - Time"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Dec 04 2001 - 17:57:15 PST