timekeeping in a domU

Hi,

I usually use my KDC to validate my password or forwarded
ticket on my domU, I don't control this dom0. Occasionally
this doesn't work.  And after I get with a SSH key,
I get a error from kinit:

kinit: krb5_get_init_creds: time skew (541) larger than max
(300)

Is it the dom0's responsibility to provide the domUs
with an accurate clock?
And, can I run a ntpd in the domU to keep it in sync?

	Jonathan Kollasch

On Wed, Oct 04, 2006 at 01:28:13PM -0500, Jonathan A.
Kollasch wrote:
> Hi,
> 
> I usually use my KDC to validate my password or
forwarded
> ticket on my domU, I don't control this dom0.
Occasionally
> this doesn't work.  And after I get with a SSH key,
> I get a error from kinit:
> 
> kinit: krb5_get_init_creds: time skew (541) larger than
max (300)
> 
> Is it the dom0's responsibility to provide the domUs
> with an accurate clock?

It is, but the TOD is read at boot time only; after that the
kernel relies on
clock interrupts and CPU counters. There can be drift

> And, can I run a ntpd in the domU to keep it in sync?

Yes.

-- 
Manuel Bouyer <bouyerantioche.eu.org>
     NetBSD: 26 ans d'experience feront toujours la
difference
--

On Wed, Oct 04, 2006 at 01:28:13PM -0500, Jonathan A.
Kollasch wrote:
> Hi,
> 
> I usually use my KDC to validate my password or
forwarded
> ticket on my domU, I don't control this dom0.
Occasionally
> this doesn't work.  And after I get with a SSH key,
> I get a error from kinit:
> 
> kinit: krb5_get_init_creds: time skew (541) larger than
max (300)
> 
> Is it the dom0's responsibility to provide the domUs
> with an accurate clock?

It is, but the TOD is read at boot time only; after that the
kernel relies on
clock interrupts and CPU counters. There can be drift

> And, can I run a ntpd in the domU to keep it in sync?

Yes.

-- 
Manuel Bouyer <bouyerantioche.eu.org>
     NetBSD: 26 ans d'experience feront toujours la
difference
--