> SSH needs accurate time, within minutes I believe
You may be mis-remembering a few details, SSH does not care about the time at all unless you are using _very_ short-lived SSH certificates.
You may be mis-remembering a few details, SSH does not care about the time at all unless you are using _very_ short-lived SSH certificates.
By default tokens are valid for 30 seconds, with a token from the previous 30-second window also being accepted. Being off by more than that is pretty rare for NTP-connected systems.
The specs also provide ways to deal with a dedicated hardware token slowly going out of sync by keeping track of the last-known clock drift, but that's pretty useless these days and can even do more harm than good.