Chapter 4. Overview of Network Time Security (NTS) in chrony

1. Specify the server with the nts option in addition to the iburst option.

   Copy to Clipboard Toggle word wrap

   For example:
   server time.example.com iburst nts
   server nts.netnod.se iburst nts
   server ptbtime1.ptb.de iburst nts

2. Add the following setting to avoid repeating the Network Time Security-Key Establishment (NTS-KE) session during system boot:

   Copy to Clipboard Toggle word wrap

   ntsdumpdir /var/lib/chrony

3. If present, comment out or remove the following setting to disable synchronization with Network Time Protocol (NTP) servers provided by DHCP:

   Copy to Clipboard Toggle word wrap

   sourcedir /run/chrony-dhcp

4. Restart the chronyd service:

   Copy to Clipboard Toggle word wrap

   systemctl restart chronyd

Procedure

1. Edit the /etc/chrony.conf file, and make the following changes:

   Copy to Clipboard Toggle word wrap

   ntsserverkey /etc/pki/tls/private/<ntp-server.example.net>.key
   ntsservercert /etc/pki/tls/certs/<ntp-server.example.net>.crt

2. Set permissions on both the private key and the certificate file that allow the chrony user to read the files, for example

   Copy to Clipboard Toggle word wrap

   # chown root:chrony /etc/pki/tls/private/<ntp-server.example.net>.key /etc/pki/tls/certs/<ntp-server.example.net>.crt
   
   # chmod 644 /etc/pki/tls/private/<ntp-server.example.net>.key /etc/pki/tls/certs/<ntp-server.example.net>.crt

3. Ensure that the ntsdumpdir /var/lib/chrony setting is present.

4. Open the required ports in firewalld:

   Copy to Clipboard Toggle word wrap

   # firewall-cmd –permannent --add-port={323/udp,4460/tcp}
   # firewall-cmd --reload

5. Restart the chronyd service:

   Copy to Clipboard Toggle word wrap

   # systemctl restart chronyd

Verification

1. Perform a test from a client machine:

   Copy to Clipboard Toggle word wrap

   $ chronyd -Q -t 3 'server
   
   ntp-server.example.net iburst nts maxsamples 1'
   2021-09-15T13:45:26Z chronyd version 4.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 +DEBUG)
   2021-09-15T13:45:26Z Disabled control of system clock
   2021-09-15T13:45:28Z System clock wrong by 0.002205 seconds (ignored)
   2021-09-15T13:45:28Z chronyd exiting

   The System clock wrong message indicates the NTP server is accepting NTS-KE connections and responding with NTS-protected NTP messages.

2. Verify the NTS-KE connections and authenticated NTP packets observed on the server:

   Copy to Clipboard Toggle word wrap

   # chronyc serverstats
   
   NTP packets received       : 7
   NTP packets dropped        : 0
   Command packets received   : 22
   Command packets dropped    : 0
   Client log records dropped : 0
   NTS-KE connections accepted: 1
   NTS-KE connections dropped : 0
   Authenticated NTP packets: 7

   If the value of the NTS-KE connections accepted and Authenticated NTP packets field is a non-zero value, it means that at least one client was able to connect to the NTS-KE port and send an authenticated NTP request.