Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1148932

Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm)

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2023-06-07 02:37, Rob Janssen wrote:
> Yes I was using the "ntp" package before.
> I have upgraded and it installed "ntpsec".  I tried to remove it as I have no need
> for the "security" part but it removed "ntp" as well.

And then you presumably reinstalled it. Did this result in you starting 
over with a default ntp.conf, where you then manually removed (or 
commented out) the pool lines and added your server lines?

> Please don't fall in the common trap of trying to make everything "top secure" and then making it
> unusable or causing problems for people that do not require that.
NTPsec is a fork of NTP. Most of the security benefit of NTPsec comes 
from NTPsec simply removing and cleaning up decades of code cruft in 
NTP. NTPsec is a drop-in replacement for NTP.

 > It looks like "ntp" is only a dummy package.

In Debian, NTPsec was packaged alongside NTP for some time. This release 
cycle, the Debian ntp maintainer suggested it was time to retire ntp, 
and the consensus was to do so and migrate existing ntp installs to ntpsec:
https://lists.debian.org/debian-devel/2022/01/msg00172.html

 > Probably you should put that
 > config line commented in the default config so people who like it can
 > easily enable it.

This configuration exists for correctness. If a given system has two 
time sources and they disagree, which one is correct? There is no way to 
be sure. If you have three sources, then you take whichever two agree.

"A man with a watch knows what time it is. A man with two watches is 
never sure."
https://en.wikipedia.org/wiki/Segal%27s_law

If you're only running your own servers, then the best practice is to 
run 3 (or more) servers. (Some sources say 4, so if one server is down, 
you can still detect a falseticker.) And I say that as someone who runs 
two. But my clients use my two servers plus the pool.

https://access.redhat.com/solutions/58025
https://www.tenable.com/audits/items/CIS_Cisco_NX-OS-v1.0.0_Level_2.audit:6a5be86b59dc9342bd22dfc2b7c70cb4
https://insights.sei.cmu.edu/blog/best-practices-for-ntp-services/
https://labs.ripe.net/author/christer-weinigel/best-practices-for-connecting-to-ntp-servers/

-- 
Richard

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1036821: NTP does not keep accurate time on bookworm Rob Janssen <debian@pe1chl.nl> - 2023-05-27 13:10 +0200
  Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Rob Janssen <debian@pe1chl.nl> - 2023-05-27 14:30 +0200
    Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Richard Laager <rlaager@debian.org> - 2023-06-07 05:20 +0200
      Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Richard Laager <rlaager@debian.org> - 2023-06-07 05:30 +0200
        Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Rob Janssen <debian@pe1chl.nl> - 2023-06-07 09:50 +0200
          Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Richard Laager <rlaager@debian.org> - 2023-06-07 10:20 +0200
            Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Rob Janssen <debian@pe1chl.nl> - 2023-06-07 10:30 +0200
              Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Richard Laager <rlaager@debian.org> - 2023-06-07 11:00 +0200
                Bug#1036821: Acknowledgement (NTP does not keep accurate time on bookworm) Rob Janssen <debian@pe1chl.nl> - 2023-06-07 11:10 +0200
                Bug#1036821: NTP does not keep accurate time on bookworm Richard Laager <rlaager@wiktel.com> - 2023-06-08 00:10 +0200

csiph-web