Re: Chrony and NTP hardening

On 2026-02-04 16:57, Bernd Brandstetter wrote:
> Hello,
> 
> I'm supposed to implement a couple of NTP security requirements as
> suggested by RFC8633.
> 
> Specifically, the NTP daemon shall be prevented from accepting dates
> that set the clock to a time earlier than the build date of the
> system or a last-known-good time, which will be saved to a file once
> a day.
> 
> I'm wondering how this could best be achieved with Chrony. My main
> problem is that I can see no way to reliably detect if the time is
> acceptable before Chrony has already synchronized. Moreover, since we
> would also like to use rtcsync, this would mean that then also the
> RTC could be set to the wrong time and we'd therefore have no means
> to recover, and activating rtcsync only afterwards is unfortunately
> not supported.

It's not clear to me whether you want to do this only at startup or
continously at runtime. For the former you will have to write your own
pre-start script where you can check for "the current offset" without
setting the clock with:

   chronyd -x -Q 2>&1 | grep "System clock" | cut -d ' ' -f 6

which will give you something like:

   -0.000211

You can then compare this with the checkpoint time and do whatever is
necessary. Does that help?

cheers
Holger

-- 
To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "unsubscribe" in the subject.
For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "help" in the subject.
Trouble?  Email [email protected]