Re: Chrony and NTP hardening

On 2026-02-04 16:57, Bernd Brandstetter wrote:
>
> Specifically, the NTP daemon shall be prevented from accepting dates that set the clock to a time earlier than the build date of the system 
Ok that seems reasonable...
> or a last-known-good time, which will be saved to a file once a day. 
But that would be disaster waiting to happen!
What when your system syncs to an invalid time in the future?

>
> My main problem is that I can see no way to reliably detect if the time is acceptable before Chrony has already synchronized.
Yeah, such simplistic checks are most applicable to systems using SNTP, i.e. query a single server and jam the received time into the clock.

With a more advanced system using NTP (like ntpd or chrony) with several servers and with limited time step, there isn't much risk that things go wrong.

Rob

-- 
To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "unsubscribe" in the subject.
For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "help" in the subject.
Trouble?  Email [email protected]