Chapter 4. Overview of Network Time Security (NTS) in chrony

1. Specify the server with the nts option in addition to the iburst option.

   For example:
   server time.example.com iburst nts
   server nts.netnod.se iburst nts
   server ptbtime1.ptb.de iburst nts

   Copy to Clipboard Toggle word wrap

2. Add the following setting to avoid repeating the Network Time Security-Key Establishment (NTS-KE) session during system boot:

   ntsdumpdir /var/lib/chrony

   Copy to Clipboard Toggle word wrap

3. If present, comment out or remove the following setting to disable synchronization with Network Time Protocol (NTP) servers provided by DHCP:

   sourcedir /run/chrony-dhcp

   Copy to Clipboard Toggle word wrap

4. Restart the chronyd service:

   systemctl restart chronyd

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the /etc/chrony.conf file, and make the following changes:

   ntsserverkey /etc/pki/tls/private/<ntp-server.example.net>.key
   ntsservercert /etc/pki/tls/certs/<ntp-server.example.net>.crt

   Copy to Clipboard Toggle word wrap

2. Set permissions on both the private key and the certificate file that allow the chrony user to read the files, for example

   # chown root:chrony /etc/pki/tls/private/<ntp-server.example.net>.key /etc/pki/tls/certs/<ntp-server.example.net>.crt
   
   # chmod 644 /etc/pki/tls/private/<ntp-server.example.net>.key /etc/pki/tls/certs/<ntp-server.example.net>.crt

   Copy to Clipboard Toggle word wrap
3. Ensure that the ntsdumpdir /var/lib/chrony setting is present.

4. Open the required ports in firewalld:

   # firewall-cmd --permanent --add-port={323/udp,4460/tcp}
   # firewall-cmd --reload

   Copy to Clipboard Toggle word wrap

5. Restart the chronyd service:

   # systemctl restart chronyd

   Copy to Clipboard Toggle word wrap

Verification

1. Perform a test from a client machine:

   $ chronyd -Q -t 3 'server
   
   ntp-server.example.net iburst nts maxsamples 1'
   2021-09-15T13:45:26Z chronyd version 4.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 +DEBUG)
   2021-09-15T13:45:26Z Disabled control of system clock
   2021-09-15T13:45:28Z System clock wrong by 0.002205 seconds (ignored)
   2021-09-15T13:45:28Z chronyd exiting

   Copy to Clipboard Toggle word wrap

   The System clock wrong message indicates the NTP server is accepting NTS-KE connections and responding with NTS-protected NTP messages.

2. Verify the NTS-KE connections and authenticated NTP packets observed on the server:

   # chronyc serverstats
   
   NTP packets received       : 7
   NTP packets dropped        : 0
   Command packets received   : 22
   Command packets dropped    : 0
   Client log records dropped : 0
   NTS-KE connections accepted: 1
   NTS-KE connections dropped : 0
   Authenticated NTP packets: 7

   Copy to Clipboard Toggle word wrap

   If the value of the NTS-KE connections accepted and Authenticated NTP packets field is a non-zero value, it means that at least one client was able to connect to the NTS-KE port and send an authenticated NTP request.