Mikaela/shell-things
1
0
Fork 0
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git synced 2024-11-25 20:59:23 +01:00
Code Issues Projects Releases Wiki Activity
48976cacce
shell-things/etc/chrony
History
Aminda Suomalainen 48976cacce
chrony/sources.d: prefer ISP and CF 
The ISP should be closest server to sync to and Cloudflare is anycast with
potentially lower stratum than the other nts servers. 'nts' implies 'require'
and 'trust' already and other servers get picked over lower stratum although
higher distance.
2024-01-24 10:57:52 +02:00
..
conf.d chrony/conf.d: add .FIXME suffix to ca-certificates.conf, clarifying comments 2023-11-16 20:19:39 +02:00
sources.d chrony/sources.d: prefer ISP and CF 2024-01-24 10:57:52 +02:00
chrony.conf chrony: cut chrony.d/ into conf.d/ and sources.d/ 2021-01-29 12:56:38 +02:00
README.md run prettier 2023-02-21 17:54:39 +02:00

README.md

Chrony config files

For some reason Debian package for Chrony doesn’t include other config files so that has to be done by hand like

confdir /etc/chrony/chrony.d

Windows

Refer to ../../Windows/time/README.md

Other random notes

On pools, the default maxsources is 4 and pools would be resolved until there would be 4 names while the documentation for Telia and Snopyta says they have only 3. Cloudflare again resolves to two per IP version, so I assume that means 2.

Commands of interest:

Chrony itself

Note: -N uses names specified in config instead of reverse name lookupping then.

  • chrony -N activity - what sources are doing
  • chrony -N authdata - can show that server uses NTS
  • chrony -N ntpdata - a lot of data on the servers
  • chronyc offline - offline mode
  • chronyc online - reconnects servers
  • chrony -N sources - used timeservers and their statuses
  • chrony -N tracking - local status (stratum and own clock etc.)

nmap

Checking that something is an NTP server? Needs root:

nmap -sU -p 123 --script=ntp-info 192.168.0.1

Checking that something has NTS?

nmap -p 4460 -Pn ntp.example.net

In GitHub user jauderho’s curated NTS list user cadusilva suggests this command instead:

chronyd -Q -t 3 'server NTP_SERVER_HERE iburst nts maxsamples 1'

Firewall configuration

In case local clients or peers are wanted,

ufw allow from 192.168.0.0/16 to any port 123 proto udp
ufw allow from fe80::/10 to any port 123 proto udp

A bit wide 192.168.x.x, but so is conf.d/local-servers,conf and fe80://10 isn’t ULA either.