NTP security: NTS providers, chrony

Site Development Guide Suggestions
1

On Linux (Ubuntu) I had just installed Chrony and entered server time.cloudflare.com nts to /etc/chrony/chrony.conf

This forces system to ask time via NTS (TLS) so nobody can intercept or spoof it.

So I think it will be good to add extended guide about this situations.

Regarding NTS servers, here what i found:

time.cloudflare.com
ptbtime1.ptb.de
nts.netnod.se

Plain NTP have plenty of issues and concerns. Detailed articles here, here and here

And even if it is not your threat model, there can always be someone with even higher threat models

2 Likes
„Lost topics“
2

I agree with recommending using NTS but I don’t think we can offer much value in terms of offering a specific configuration. I use and recommend the GrapheneOS chrony.conf

4 Likes
3

It seems to be a real issue. I vote for such guide

1 Like
4

The main issue seems to be certificates errors. Attacker can make victim start to ignore warnings if it will happen all the time. Plus this can DOS some security systems that use TLS.