can't set clock?

[carpman]

Hello, ok my server went down after the power switch in rack it was in at hoster was tripped.

I find that on reboot the system time is wrong:

# date
Tue 14 Oct 2003 10:30:10 BST

if try and reset date it says

date 0807041933
date: can't reach time daemon, time set locally
Fri 4 Jul 2008 19:33:00 BST

but on checking date again it appears not to have changed?

# date
Tue 14 Oct 2003 10:31:11 BST

any ideas?

cheers

[phoenix]

Are you running date as root? From a normal (-1 or 0) securelevel?

[carpman]

Thanks for reply, running as root, not sure what you mean by:

From a normal (-1 or 0) securelevel?

[richardpl]

Did you enabled timed(8) ?

[carpman]

Not sure as server was setup for me, but will check.

Should add never had this problem before after reboot?

[carpman]

Ok appears that it is not installed, thing is i cannot compile as clock is out of sync.

I know this as tried to setup ntpd and the error i related to clock/time being incorrect?

[carpman]

Update, although pkg_info does not show 'timed' i found this is logs:

Oct 15 03:09:20 cp timed[68110]: /usr/src/usr.sbin/timed/timed/acksend.c 110: sendto 85.234.157.255: Operation not permitted
Oct 15 03:09:20 cp last message repeated 8 times

Bear in mind date on server is incorrect.

cheers

[Carpetsmoker]

Originally Posted by carpman

Thanks for reply, running as root, not sure what you mean by:

What is the output of:
% sysctl kern.securelevel

See init(8)

[BSDfan666]

Am I the only one who thinks this user might be running inside of a jail? not a truly dedicated FreeBSD box?

[carpman]

Hello, and thanks for replies.

This true freebsd box running 6.2 with hsphere CP

output is:

# sysctl kern.securelevel
kern.securelevel: 2

[Carpetsmoker]

You can't set the clock with a securelevel of 2 or higher, from init(8):

     The kernel runs with five different levels of security.  Any super-user
     process can raise the security level, but no process can lower it.  The
     security levels are:
[...]
     2     Highly secure mode - same as secure mode, plus disks may not be
           opened for writing (except by mount(2)) whether mounted or not.
           This level precludes tampering with file systems by unmounting
           them, but also inhibits running newfs(8) while the system is multi-
           user.

           In addition, kernel time changes are restricted to less than or
           equal to one second.  Attempts to change the time by more than this
           will log the message ``Time adjustment clamped to +1 second''.

You will need to boot in single-user mode and set the clock, or use a rc startup script and reboot.

[carpman]

Ok cheers, trouble is i can't reboot into single mode as it is remote server, can't compile as time is wrong, i could try adding pkg instead of compiling but still letf with issue of why time is wrong?

will try installing pkg ntpd

[Carpetsmoker]

No, that won't help, unless you manage to find a bug/security issue, there is no way to set the time with securelevel at 2.

[carpman]

Ok i got openntpd installed and added following to rc.conf

ntpdate_enable="YES"
ntpdate_flags="-b 1.uk.pool.ntp.org chronos.csr.net audaxsystems.co.uk "

The i rebooted but still the same old date ?

From what read in Freebsd handbook ntpdate is best option for big change in time even when using ntpd.

cheers

[carpman]

Originally Posted by Carpetsmoker

No, that won't help, unless you manage to find a bug/security issue, there is no way to set the time with securelevel at 2.

so how am going to change the time?

Does this mean i am going to have to go into data center and change it?

cheers

[carpman]

Note running ntpdate from console gives:

ntpdate
15 Oct 14:50:22 ntpdate[1799]: no servers can be used, exiting

[J65nko]

You are having the same problem as me some time ago: reading the wrong man pages
See http://www.bsdforums.org/forums/showthread.php?t=47395 for a tip of Phoenix to locate the man pages of OpenNTPD.

Or see http://www.freebsd.org/cgi/man.cgi?q...SE&format=html which says

ntpd is usually started at boot time, and can be enabled by setting the
following in /etc/rc.conf:

openntpd_enable="YES"

You can set the time with the following in "/etc/rc.conf

openntpd_flags="-s"

[robbak]

Basically, work out where securelevels have been set, adjust that setting, and reboot. Provided your security-paranoic predecessor hasn't also locked that down.....

The general way is using rc.conf. there are two securelevel settings there:

 kern_securelevel_enable
                 (bool) Set to ``YES'' to set the kernel security level at
                 system startup.

     kern_securelevel
                 (int) The kernel security level to set at startup.  The
                 allowed range of value ranges from -1 (the compile time
                 default) to 3 (the most secure).  See init(8) for the list of
                 possible security levels and their effect on system opera-
                 tion.

Best of luck......

[carpman]

Thanks for replies, ok i tried adding following to rc.conf but no joy

openntpd_enable="YES"
openntpd_flags="-s"

Looks like i am going to have to look at secure levels, which not something i wanted to play with.


cheers

[BSDfan666]

All of those programs change the time using the same API, and if you *read* the advice offered to you by Carpetsmoker you would have fixed this much sooner.

Clearly the previous maintainer ran the system at a higher level for some reason, consider lowering it, setting the time, and then returning to the higher value.

This will require modifying configuration files.