On 2026-02-04 16:57, Bernd Brandstetter wrote:
Hello,
I'm supposed to implement a couple of NTP security requirements as
suggested by RFC8633.
Specifically, the NTP daemon shall be prevented from accepting dates
that set the clock to a time earlier than the build date of the
system or a last-known-good time, which will be saved to a file once
a day.
I'm wondering how this could best be achieved with Chrony. My main
problem is that I can see no way to reliably detect if the time is
acceptable before Chrony has already synchronized. Moreover, since we
would also like to use rtcsync, this would mean that then also the
RTC could be set to the wrong time and we'd therefore have no means
to recover, and activating rtcsync only afterwards is unfortunately
not supported.
It's not clear to me whether you want to do this only at startup or
continously at runtime. For the former you will have to write your own
pre-start script where you can check for "the current offset" without
setting the clock with:
chronyd -x -Q 2>&1 | grep "System clock" | cut -d ' ' -f 6
which will give you something like:
-0.000211
You can then compare this with the checkpoint time and do whatever is
necessary. Does that help?
cheers
Holger
--
To unsubscribe email [email protected]
with "unsubscribe" in the subject.
For help email [email protected]
with "help" in the subject.
Trouble? Email [email protected].
