Chrony - Revision history

Mic92: drop 24.05 from article

2024-12-03T08:45:47Z

drop 24.05 from article

← Older revision		Revision as of 08:45, 3 December 2024
Line 99:		Line 99:
	If you want to enable NTS, you need to also add <code>networking.firewall.allowedTCPPorts = [ 4460 ];</code> as this port is used for the NTS key-exchange before the encrypted connection via port 123.		If you want to enable NTS, you need to also add <code>networking.firewall.allowedTCPPorts = [ 4460 ];</code> as this port is used for the NTS key-exchange before the encrypted connection via port 123.

	Currently ~~(as of NixOS 24.05)~~, <code>enableNTS</code> is an all-or-nothing setting; it will require all servers to support NTS as well as all clients. If you need more granularity, use <code>extraConfig</code>and refer to [https://chrony-project.org/documentation.html the chrony documentation].		Currently, <code>enableNTS</code> is an all-or-nothing setting; it will require all servers to support NTS as well as all clients. If you need more granularity, use <code>extraConfig</code>and refer to [https://chrony-project.org/documentation.html the chrony documentation].
	[[Category:Applications]]		[[Category:Applications]]
	[[Category:Server]]		[[Category:Server]]

IFreilicht: Add instructions to configure chrony as an NTP server

2024-08-30T09:25:16Z

Add instructions to configure chrony as an NTP server

@@ Line 1: / Line 1: @@
 Chrony is an NTP and NTS client and server implementation. This means it can synchronize the time of your local machine, as well as provide services to clients on the attached network segments.
 == NTP ==
-This protocol is slowly being phased out due it security concerns, using a more secure method like NTS is recommended. To enable NTP, enable the chrony service and add whichever NTP servers you wish to use
+This protocol is slowly being phased out due it security concerns, using a more secure method like NTS is recommended. To enable NTP, enable the chrony service and add whichever NTP servers you wish to use. If you don't set a serverlist here, the value of <code>networking.timeServers</code> will be used.
 <syntaxhighlight lang="nix">
@@ Line 32: / Line 32: @@
 </syntaxhighlight>
 You can verify that NTS is being used via observing the output of <code>sudo chronyc -N authdata</code> and reading the value under mode, it should read NTS.
 === Troubleshooting ===
@@ Line 66: / Line 68: @@
 </syntaxhighlight>
 [[Category:Applications]]
 [[Category:Server]]

Klinger: Category:Applications Category:Server

2024-04-19T20:47:40Z

Category:Applications Category:Server

← Older revision		Revision as of 20:47, 19 April 2024
Line 66:		Line 66:
	</syntaxhighlight>		</syntaxhighlight>

	[[Category:~~NTP~~]]		[[Category:Applications]]
			[[Category:Server]]

imported>Dai: found same formatting issue : to ;

2024-02-26T11:51:43Z

found same formatting issue : to ;

← Older revision		Revision as of 11:51, 26 February 2024
Line 9:		Line 9:
	{		{
	services.chrony = {		services.chrony = {
	enable = true:		enable = true;
	servers = [ "ntp-example.com" ];		servers = [ "ntp-example.com" ];
	};		};

imported>Dai: minor formatting edits, : to ; may cause issues for new users

2024-02-26T11:50:33Z

minor formatting edits, : to ; may cause issues for new users

← Older revision		Revision as of 11:50, 26 February 2024
Line 25:		Line 25:
	{		{
	services.chrony = {		services.chrony = {
	enable = true:		enable = true;
	enableNTS = true:		enableNTS = true;
	servers = [ "nts-example.com" ];		servers = [ "nts-example.com" ];
	};		};
Line 55:		Line 55:

	services.chrony = {		services.chrony = {
	enable = true:		enable = true;
	enableNTS = true:		enableNTS = true;
	extraConfig = ''		extraConfig = ''
	[...]		[...]

imported>Sorag22: Updated for NTP, and for NTS having certificates automatically created

2024-01-28T01:21:39Z

Updated for NTP, and for NTS having certificates automatically created

@@ Line 1: / Line 1: @@
 Chrony is an NTP and NTS client and server implementation. This means it can synchronize the time of your local machine, as well as provide services to clients on the attached network segments.
 == NTS ==
-To enable NTS (Network Time Security), a certificate needs to be provided. You can rely on the ACME service to acquire one, but make sure that the certificate group gets assigned to <code>chrony</code>, or else the service will not be able to read the certificate and key after it drops its privileges.
+To enable NTS (Network Time Security), typically all that needs to be provided is a NTP server capable of NTS.
 <syntaxhighlight lang="nix">
@@ Line 10: / Line 41: @@
 };
 let
-   acmePath = config.security.acme.certs."nts.example.com".directory;
+   acmePath = config.security.acme.certs."foo-example.com".directory;
 in
+{
-   security.acme.certs."nts.example.com" = {
+   security.acme.certs."foo-example.com" = {
      group = "chrony";
    };

imported>Mweinelt at 14:33, 27 August 2023

2023-08-27T14:33:31Z

← Older revision		Revision as of 14:33, 27 August 2023
Line 29:		Line 29:
	</syntaxhighlight>		</syntaxhighlight>

	[[~~Categoriy~~:NTP]]		[[Category:NTP]]

imported>Mweinelt: Add to NTP group

2023-08-27T14:32:46Z

Add to NTP group

← Older revision		Revision as of 14:32, 27 August 2023
Line 28:		Line 28:
	}		}
	</syntaxhighlight>		</syntaxhighlight>

			[[Categoriy:NTP]]

imported>Mweinelt: Explain how to set up chrony with NTS

2023-08-27T14:28:36Z

Explain how to set up chrony with NTS

New page

Chrony is an NTP and NTS client and server implementation. This means it can synchronize the time of your local machine, as well as provide services to clients on the attached network segments.

== NTS ==

To enable NTS (Network Time Security), a certificate needs to be provided. You can rely on the ACME service to acquire one, but make sure that the certificate group gets assigned to <code>chrony</code>, or else the service will not be able to read the certificate and key after it drops its privileges.

<syntaxhighlight lang="nix">
{ config
, ...
};
let
acmePath = config.security.acme.certs."nts.example.com".directory;
in
{
security.acme.certs."nts.example.com" = {
group = "chrony";
};

services.chrony = {
enable = true:
enableNTS = true:
extraConfig = ''
[...]
ntsservercert ${acmePath}/fullchain.pem
ntsserverkey ${acmePath}/key.pem
'';
};
}
</syntaxhighlight>