[BlueOnyx:17905] Re: Time 1 Hour Out

[Tigerwolf]

On Sat, 27 Jun 2015, Richard Sidlin wrote:

> 5208R - I have set the Time to GMT +0.00 (London) and added a UK NTP Server
> but it keeps reverting to GMT despite us being in British Summer Time +1.00.
> How can I remedy this please?

I presume you've used tzselect to pick the proper time zone.

I've found at least one problem with the fact that /etc/tz is just a 
symlink regarding ssh and  /var/empty/sshd/etc/localtime  (according to a 
note I made there) which won't deal with a time zone change:

The local time zone must be here to prevent sshd from logging *some*
(failed) logins to the syslog using UTC rather than local time.

Because log parsers such as fail2ban are sensitive to what time things
occur when they decide if there's been 'too many' of an event in some time
interval tend to get very confused by entries with jumps backward and
forward in time between entries.

See <https://bugzilla.redhat.com/show_bug.cgi?id=435472> where developers
debate the subject, but also provide a 'cure' having the local time info
located here.  Later releases of software may have a different need.

Note also that the 'solution' was to use a command in the /etc/rc.d/sshd
service file that performed the zone information copy upon startup.  That
command was shown as
        cp -af /etc/localtime /var/empty/sshd/etc/

The problem is that at least on some systems, the /etc/localtime entry is
just a symlink elsewhere, and it is the *symlink* that gets copied, not
the actual data needed.  And the symlink looks like

         localtime -> ../usr/share/zoneinfo/US/Eastern

The ../ implies go up one directory and look for the file under that, so 
when it now resides in /var/empty/sshd/etc/ the ../ expects the data to
appear in /var/empty/sshd/usr/share/zoneinfo/US/Eastern, and the entire
path just isn't there!

Anyway, that's why this one bit of data is in this directory.