Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd)
-
Opened #10404 a year or so ago for this topic - migration from ntpd to chronyd.
In an uninspired moment I set it to "Private" and can't change it to "Public", maybe @Netgate can help. -
Ha, I wondered why that was set private. Fixed.
-
@q54e3w said in Chrony, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
I'd rather have PTP personally.
How You to comment this sentence from official Chrony Docs:
2.12. Does chrony support PTP?
No, the Precision Time Protocol (PTP) is not supported as a protocol for synchronisation of clocks and there are no plans to support it.
It is a complex protocol, which shares some issues with the NTP broadcast mode.
One of the main differences between NTP and PTP is that PTP was designed to be easily supported in hardware (e.g. network switches and routers) in order to make more stable and accurate measurements. PTP relies on the hardware support. NTP does not rely on any support in the hardware, but if it had the same support as PTP, it could perform equally well.On Linux, chrony supports hardware clocks that some NICs have for PTP. They are called PTP hardware clocks (PHC). They can be used as reference clocks (specified by the refclock directive) and for hardware timestamping of NTP packets (enabled by the hwtimestamp directive) if the NIC can timestamp other packets than PTP, which is usually the case at least for transmitted packets. The ethtool -T command can be used to verify the timestamping support.
-
@sergei_shablovsky said in Chrony, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
Sentence from official Chrony Docs:
On Linux, chrony supports hardware clocks that some NICs have for PTP. They are called PTP hardware clocks (PHC). They can be used as reference clocks (specified by the refclock directive) and for hardware timestamping of NTP packets (enabled by the hwtimestamp directive) if the NIC can timestamp other packets than PTP, which is usually the case at least for transmitted packets. The ethtool -T command can be used to verify the timestamping support.
I need to add some note about hardware timestamping: no possible to detect correct time correction delta in constantly asymmetrical link.
(For better understanding I will doing that on an example)Server A make a timestamp (t) and sending packet to Server B
Packet on the road within 30ms
Server B receive packet at time (t+30), make a timestamp and sending reply to Server A
Packet on the road within 70ms (because another route)
Server A receive reply packet with a totally delay (t+30ms+70ms = t+100ms) and Server A make decision that his time need to be corrected on 20ms (100ms / 2 ways - 30ms)But this is wrong decision (because as You see above one route are 30ms, other route are 70ms).
And no possible at all detecting this by statistics. So, in constantly asymmetrical link, the hardware NIC timestamp also not help to make great correction.
I am not sure is PTP v2 (IEEE-1588-2008) solving this problem?
-
S Sergei_Shablovsky referenced this topic on
-
S Sergei_Shablovsky referenced this topic on
-
@johnpoz said in Chrony, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
@sergei_shablovsky said in Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
**really outdated and vulnerable NTP”” need to be replaced.
What specific vulnerability are you talking about.. Just because NTP has been around long time - does not mean its not been kept up to date for security issues.
One of technics of NTP hacking is described here https://habr.com/ru/companies/ruvds/articles/505938/
(Please use translate.Google.com for reading.)
Only 25mins on Intel Core i5 ;) -
@sergei_shablovsky
Quite a thread resurrection you have there. Regrettably I have become unwilling to click on Russian links.That said, NTP is easily overlooked as it is a dull topic despite everyone relying on encryption these days.
In my view they called it Network Time Protocol for a reason - primarily it should be on your network, with only redundancy and sanity checks provided by the wider internet.
For years I have had one of these on my LAN:
Dedicated NTP time sources don't have to be expensive or be a hacky DIY job on a RPi.
️ -
@robbiett said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
Dedicated NTP time sources don't have to be expensive or be a hacky DIY job on a RPi.
And they're only $639.95!
I'll rely on NTP over the Internet.
PfSense running on Qotom mini PC
i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
UniFi AC-Lite access pointI haven't lost my mind. It's around here...somewhere...
-
@robbiett said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
hacky DIY job on a RPi.
But that's the fun part!
-
@jknott said
And they're only $639.95!
I'll rely on NTP over the Internet.
Ouch! Mine was 'only' £109 on eBay. When did they become so expensive??
Edit: The last one I purchased was 'just' £100 including expedited delivery, back in 2021:
I guess I should have purchased a boatload of them.
️ -
@stephenw10 We are all tinkerers at heart.
-
@jknott said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
@robbiett said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
Dedicated NTP time sources don't have to be expensive or be a hacky DIY job on a RPi.
And they're only $639.95!
I'll rely on NTP over the Internet.
For the price like this You able to buy now well-reputable Trimble civil model (see this huge loaded pack for example https://www.ebay.com/itm/155434190550) OR even used MILITARY-grade Trimble set w/ antennas.
Of courses if You need STABILITY.
-
@robbiett said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
@sergei_shablovsky
Quite a thread resurrection you have there. Regrettably I have become unwilling to click on Russian links.When a write about DANGEROUS of ALL that linked to russia around 3 years ago, here on forum, no one care about this… ;)
But now all see what is russia exactly…But in case of Habr web resource - this is safe. This is a well reputable forum for Russian-speaking tech geeks with a lot of interesting articles from 2008 prior 2017…
-
For anyone who “love to play with TIME-server”:
Do You use ntpperf utility to test Your server?
Write back Your appliances and a result in numbers!
Thx!
-
And again one time: when Netgate implementing modern time-protocols???!
-
@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
And again one time: when Netgate implementing modern time-protocols???!
NTP is a modern time protocol. The version in pfSense is ntpd 4.2.8, which implements NTP version 4 and is the current version of the standard.
Is ntpd my favorite NTP implementation? No, it isn't. I would strongly prefer Chrony or even NTPsec, but ntpd is certainly adequate for what is needed.
Unfortunately, Chrony is not considered viable due to license incompatibilities. This has been discussed previously. It's a shame really, because Chrony really is very good in all aspects.
NTPsec is viable on a license basis and is in FreeBSD ports. However, to replace ntpd with NTPsec (or Chrony for that matter), you would also require gpsd as well. Moving to NTPsec and gpsd would require significant effort to integrate and then test. If someone wants to put that effort in, I'm sure that the devs would consider a PR if submitted.
PTP would be a complete waste of time for pfSense.
-
@dennypage said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
@Sergei_Shablovsky said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
And again one time: when Netgate implementing modern time-protocols???!
NTP is a modern time protocol. The version in pfSense is ntpd 4.2.8, which implements NTP version 4 and is the current version of the standard.
Is ntpd my favorite NTP implementation? No, it isn't. I would strongly prefer Chrony or even NTPsec, but ntpd is certainly adequate for what is needed.
Unfortunately, Chrony is not considered viable due to license incompatibilities. This has been discussed previously. It's a shame really, because Chrony really is very good in all aspects.
NTPsec is viable on a license basis and is in FreeBSD ports. However, to replace ntpd with NTPsec (or Chrony for that matter), you would also require gpsd as well. Moving to NTPsec and gpsd would require significant effort to integrate and then test. If someone wants to put that effort in, I'm sure that the devs would consider a PR if submitted.
PTP would be a complete waste of time for pfSense.
Ummm what?! License incompatibilities? So all GPLv2 packages are having their license broken by being already present in pfSense? Doesn't make sense to me. Not to mention chrony is already available in FreeBSD.
-
@e-1-1 said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
Ummm what?! License incompatibilities? So all GPLv2 packages are having their license broken by being already present in pfSense? Doesn't make sense to me. Not to mention chrony is already available in FreeBSD.
I believe that Chrony is in FreeBSD ports rather than in FreeBSD release (core).
This was a hotly debated topic 10 years ago. The BSD and pfSense folk took the position that GPL components cannot be safely included in a distribution that is issued under the FreeBSD license. Ditto for the Linux folk when looking at ZFS and CDDL. You may or may not agree with their conclusions, but it is theirs to make. Who knows? Maybe you can get them to change their minds. Give it a go.
I've done a bit of work with Chrony on Linux. Some time back I considered making Chrony available as an add-on replacement package for pfSense, but the barriers to entry were large. And I was only looking at chronyd--I wasn't thinking of including gpsd with its associated headaches.
https://forum.netgate.com/topic/106105/chrony
FWIW, ntimed is truly dead at this point.
-
I use Chrony on my Proxmox host as the local time reference with pfsense accessing that only as a client.
I agree it would be much better if pfsense ran chrony as it could then be used as the server for local devices.
Sad to hear licensing issues prevent this. -
@Patch said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
if pfsense ran chrony as it could then be used as the server for local devices.
huh? Why can ntp that running on pfsense not be used for clients? chrony can query just normal ntp server.. If you want to use chrony on them. Chrony would be pretty useless if it couldn't query your standard ntp server
-
@johnpoz said in Chrony, PTP, Network Time Security (NTS, NTPsec) to replace unsecure/old NTP (ntpd):
Why can ntp that running on pfsense not be used for clients?
In can but it is an inferior time server.
Chrony is a better time server so I use it.
