DST Time change

[Sam Hartman]

>>>>> "Danny" == Danny Mayer <mayer at ntp.isc.org> writes:

    Danny> Well, yes, in a way. But the biggest affect, as long as you
    Danny> don't do anything during the changeover is that your syslog
    Danny> or eventlog will be off by an hour along with the display
    Danny> of your clock, files and anything else that displays a
    Danny> timestamp. My point was that Kerberos uses UTC.  Anything
    Danny> else would prevent Kerberos from working in the first
    Danny> place.

    >> This will break Kerberos.  My recommendation is to find out how
    >> to set the clockskew for your implementation to some value
    >> greater than an hour and do that.
    >> 

    Danny> Well that's what we keep telling people. Contact the O/S
    Danny> vendor and get whatever fixes are necessary for your
    Danny> version of the O/S. 
No, I'm not talking about an OS patch.  Kerberos has a parameter
called clockskew which is the maximum difference between the clock of
the client and the server.  You can tune this parameter yourself.