peer directive: restore support for symmetric active associations by requiring the use of keys
From testing yesterday, I learned that the peer
directive and symmetric active associations are not supported - current docs say that peer
is synonymous with server
.
And since the ntpd.log
entries currently say peer deprecated, treated as server
, this appears to not be a temporary issue - that ntpsec's plans are to simply not support peer
at all?
If so, this significantly hampers the use of ntpsec in a multi-tiered NTP environment. Most of Mills' reference architecture discussion revolves around the use of symmetric active peering among the top tiers of NTP subnets of any scale.
Mills also states that peering (symmetric active associations) should always be protected with authentication ("Since an intruder can impersonate a symmetric active peer and inject false time values, symmetric mode should always be cryptographically validated.").
Would it be possible to restore peer
functionality ... by requiring the use of keys?
If this isn't feasible, I'd like to request that more information about the security issues be added to docs, so that other contributors might be able to propose a suitable remediation in the future.