Problem setting up NTS

David Venhoek <[email protected]> Wed, 28 Sep 2022 17:13:21 +0200

Newsgroups	gmane.comp.time.chrony.user
Message-ID	<CAPz_-SWQMN2h9mwPGZOcJoWv0+nDX-i0UC59uWBdFiwfB_pAnw@mail.gmail.com>

Dear All,

I'm trying to setup a local NTS server for testing, but I am having
some issues getting it configured correctly. I have added an allow
statement for the localhost subnet, as well as ntsservercert and
ntsserverkey statements to the configuration, but for some reason it
does not seem to open a port for the NTSKE server. Does anybody know
what I could be doing wrong? Running chronyd from the commandline with
chronyd -d -f /etc/chrony/chrony.conf -L 0 seems to show no errors,
only giving:
2022-09-28T14:47:04Z chronyd version DEVELOPMENT starting (+CMDMON
+NTP +REFCLOCK +RTC -PRIVDROP -SCFILTER -SIGND +ASYNCDNS -NTS -SECHASH
+IPV6 -DEBUG)
2022-09-28T14:47:04Z Running with root privileges
2022-09-28T14:47:04Z Frequency -11.572 +/- 0.191 ppm read from
/var/lib/chrony/chrony.drift
2022-09-28T14:47:10Z Selected source 185.125.190.56 (ntp.ubuntu.com)

For reference my configuration files are attached. I am running the
latest master branch of chrony on ubuntu 20.04

Kind regards,
David Venhoek

PS: Yes I know I have attached key material to this mail. These are
keys I intend to use for debugging and will never use on the open
internet.

chrony.conf (application/octet-stream, 1.8 KB)

# Welcome to the chrony configuration file. See chrony.conf(5) for more
# information about usuable directives.

# This will use (up to):
# - 4 sources from ntp.ubuntu.com which some are ipv6 enabled
# - 2 sources from 2.ubuntu.pool.ntp.org which is ipv6 enabled as well
# - 1 source from [01].ubuntu.pool.ntp.org each (ipv4 only atm)
# This means by default, up to 6 dual-stack and up to 2 additional IPv4-only
# sources will be used.
# At the same time it retains some protection against one of the entries being
# down (compare to just using one of the lines). See (LP: #1754358) for the
# discussion.
#
# About using servers from the NTP Pool Project in general see (LP: #104525).
# Approved by Ubuntu Technical Board on 2011-02-08.
# See http://www.pool.ntp.org/join.html for more information.
pool ntp.ubuntu.com        iburst maxsources 4
pool 0.ubuntu.pool.ntp.org iburst maxsources 1
pool 1.ubuntu.pool.ntp.org iburst maxsources 1
pool 2.ubuntu.pool.ntp.org iburst maxsources 2

# This directive specify the location of the file containing ID/key pairs for
# NTP authentication.
keyfile /etc/chrony/chrony.keys

# This directive specify the file into which chronyd will store the rate
# information.
driftfile /var/lib/chrony/chrony.drift

# Uncomment the following line to turn logging on.
#log tracking measurements statistics

# Log files location.
logdir /var/log/chrony

# Stop bad estimates upsetting machine clock.
maxupdateskew 100.0

# This directive enables kernel synchronisation (every 11 minutes) of the
# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
rtcsync

# Step the system clock instead of slewing it if the adjustment is larger than
# one second, but only in the first three clock updates.
makestep 1 3

allow 127.0.0.0/8
ntsservercert /etc/chrony/example.crt
ntsserverkey /etc/chrony/example.key

example.crt (application/x-x509-ca-cert, 1.9 KB) - not displayed

example.key (application/x-iwork-keynote-sffkey, 3.2 KB) - not displayed

chrony.keys (application/octet-stream, 481 B) - not displayed