Chrony: Comparison of NTP implementations
chrony.tuxfamily.org
chrony.tuxfamily.org
...latest on it appears to be that Poul-Henning Kamp is building a house and that's taken up the time that was devoted to it, for now https://twitter.com/bsdphk/status/886166233783119873
(the Network Time Foundation were funding 1 day a week of his time, but that was just weekend work, he's a busy guy)
> the Network Time Foundation were funding 1 day a week of
> his time, but that was just weekend work, he's a busy guy
Just saying "Yes" here is highly misleading. NTP supports dozens of reference clocks, including the protocols of may precision timing receivers. Last I looked chrony supported only a single kind of reference clock.
FWIW, the page also compares the number of reference clock drivers. chrony does not have any HW-specific drivers, but there is an interface which other programs can use to provide the timing data. The most commonly used reference clocks these days are GPS receivers, which are well supported by gpsd.
That means it's more suitable for following a reference clock, not keeping a number of machines in sync with each other and the rest of the world. Unless they have implemented more of the protocol now. This has security implications of its own.
I've heard other people claiming that OpenNTPD is not accurate enough and what not, but my anecdata says it performs well enough. Do you happen to have any specific gripes with it ? Is it the timekeeping algorithm that is lacking ?
Sibling comment mentioned leap seconds, and that's unlikely to change. AFAIK, for 'proper' leap second support, the daemon must support it (to parse the announcement from the upstream NTP) as well as the OS. Gathering from I've read on OpenBSD's mailing lists, leap second support in the kernel is not a priority -- to say the least. Seeing the fallout on other OSes, I'd say it's a sound decision. On a similar note, Google introduced leap smearing to not deal with introducing leap seconds across all of its' servers[1]. Several other actors, such as Amazon[2] and Akamai followed suite.
[1] https://googleblog.blogspot.fr/2011/09/time-technology-and-l... [2] https://aws.amazon.com/blogs/aws/look-before-you-leap-the-co... [3] https://blogs.akamai.com/2016/11/planning-for-the-end-of-201...
> In contrast to NTP implementations such as chrony or the NTP reference server [systemd-timesyncd] only implements a client side, and does not bother with the full NTP complexity, focusing only on querying time from one remote server and synchronizing the local clock to it.
It just sounds like running a more complicated (meaning, more attack vectors) software for no reason.
systemd has a horrible security track record and should not be allowed on any server that is connected to the internet.
The last remote-root exploit from 2 months ago: https://www.theregister.co.uk/2017/06/29/systemd_pwned_by_dn...
The major distros urgently need to get rid of systemd and return to proven, modular init systems.
systemd was the biggest single mistake in UNIX history.
I don't want to return to a pile bash scripts with `sleep n` to get the system to boot, even if it's a proven method.
One of them should be adopted and fleshed out before systemd causes even more damage.
Simple, sane bash-like scripts, logging like you're used to and so easy to debug, and when you need to do your own custom stuff, simple and just works.
Gentoo showed me this tool a few years ago. So happy.
For years now I've heard loud stories about systemd +1 or -1. Same arguments over and over.
Meanwhile, dozens of my servers and desktops and laptops keep humming along, I've like just never had to fuck with it.
I should buy the OpenRC team some pizza. Thank you!
Or that they cling to "standard on paper" rather than "standard in use", and thus end up rolling back decades of real life usage in the process.
With systemd, perfect very much is the enemy of good. And both unix and Linux go where it is not by being perfect but by being good.
I didn't mean "standard" as in "POSIX 1003.1e", "SUSv3", or "RFC 3549", I meant it as in "whatever is currently most widely in use". Which actually reinforces your point.
Reference ntpd source: ~130 kloc
systemd timesyncd source: ~2 kloc
Reference ntpd binary: ~700 KB
systemd timesyncd binary: ~38 KB
I get that you don't like systemd, or trust that team. But it's hard to say that ntpd is less complicated than timesyncd with a straight face. Maybe it is better engineered, more correct, more secure, or something; but not less complicated.
1) Install the package
2) Modify the configuration file if needed
3) Enable the service
Taken alone timesyncd can be considered simpler to configure (no package to install, short configuration file), but it follows its own workflow, specially the command to enable or disable it (timedatectl set-ntp true), and to a lesser extent the location of its configuration file.
For me it makes it harder to configure because, now, I must remember precisely all the steps where I could only remember a loss pattern, common with all other services, for ntpd.
As itself, it's not that bad, it's a few commands, I can remember them, but it would definitely suck if every single service had its own pattern.
1) Install the package (it's probably part of the systemd package you already have)
2) Modify the configuration file if needed (/etc/systemd/timesyncd.conf)
3) Enable the service (`systemctl enable systemd-timesyncd`; the same as any other service)
Sure, you can use timedatectl to enable it (which makes a D-Bus call to timedated, which then makes the same call that `systemctl enable --now` does). But you don't have to. It's a weird feature of timedated/timedatectl because they try to be the Swiss-army-knife of messing with time settings on the box.
Accuracy: 100ms, no clock slewing. Try to correlate your logs with that, or run any distributed applications. https://unix.stackexchange.com/questions/305643/ntpd-vs-syst... https://github.com/coreos/bugs/issues/391
Talking about attack vectors: SNTP has no no authentication, so you can practically set the clock on a server, if you have sufficient network access.
That's fine for me on my laptop, but I don't see much point favouring well established solutions for saving a couple of MB RAM on a server.
To run one internal NTP reference that synchronizes to one or more external sources, with all other internal machines syncing with that one internal reference.
Or, to hook an external hardware time clock up to one machine, then have the other internal local machines sync with that one machine that has an external hardware time clock.
However, depending upon how one defines "average" user/admin will determine if either of the two above are things that such a user/admin might find useful.
Gotta say, I'm happy about that, as I wrote the newsletter :-D
I know ntpsec is a somewhat questionable fork. But the refactoring work itself can't be all bad...
I miss the days when people would use tables and minimal or no css.
Maybe you miss the days of simple text as HTML. That one did work everywhere.