chrony With NTS, Time Nobody On The Path Can Move

chrony-nts

Time nobody on the path can move. The role configures chrony to take its time over NTS (RFC 8915), so every measurement is authenticated: an attacker between this host and its servers can drop packets but cannot shift the clock. The NTP listener is closed, because a client does not need to answer anyone.

No download, and no version to pin. EL 10 packages chrony, so the role installs it by name and enables the unit the distribution ships. What the role owns is which servers are trusted, whether they are authenticated, whether this host answers NTP at all, and whether it may touch the clock.

The role decides whether the clock is this system's to set. On a host it is, and chronyd steps and slews as normal. Inside a container it is NOT - the kernel clock belongs to the machine underneath - so the role passes -x and chronyd measures without touching it. The default reads ansible_facts['virtualization_type'] rather than asking an operator to remember, and the live test asserts the daemon logged "Disabled control of system clock".

The live test needs CAP_SYS_TIME. The container the lane boots carries it, and without it the kernel refuses the very call this role exists to make, so the test would pass having changed nothing. The lane is therefore run as live-ansible.sh ... --cap-add=SYS_TIME, and the receipt records it: a pass under an added capability is not the same claim as a pass without one.

cmdport 0 also disables the UNIX command socket. It looks like the way to stop chronyd answering command requests from the network, and it stops chronyc answering at all. What this role does instead is leave the command socket alone and close the NTP port with port 0.

chronyd refuses a /run/chrony it does not like, and carries on. If the directory is not chrony:chrony 0750 it logs "Wrong permissions", DISABLES the command socket, and runs perfectly well otherwise - so chronyc authdata then answers "501 Not authorised" and a test reads that as an NTS failure. The role does not create that directory: the package's own tmpfiles entry does it right.

The NTS cookies are written when chronyd stops, not while it runs. The live test restarts the daemon before looking for them, which is also a small proof that the key exchange survives a restart.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.