Recently, I was informed of that ntpd-rs implements NTS, whereas systemd-timesyncd does not:
opened 11:19AM - 01 Jul 18 UTC
RFE 🎁
timesync
At the moment IETF Network Time Protocol working group [is standardizing](https:… //www.ietfjournal.org/a-new-security-mechanism-for-the-network-time-protocol/) extensions to NTP to add authenticity and confidentiality to NTP. Central to this effort is the [Network Time Security (NTS) mechanism](https://datatracker.ietf.org/doc/draft-ietf-ntp-using-nts-for-ntp/).
The proposed NTS-KE protocol and NTP protocol extensions do not seem to be complex and therefore it should be possible to extend systemd-timesyncd to support NTS with medium effort.
Two of the authors of the current draft are employed by Physikalisch-Technische Bundesanstalt (PTB), the German national metrology institute that is also the legal time authority in Germany. So it can perhaps be expected that NTS becomes widely available after the NTS standardization is finished. The PTB also [described efforts to formally verify NTS](https://www.dfn-cert.de/dokumente/workshop/2014/Folien_Sibold.pdf), [collaborated in security research about NTS](https://www.ibr.cs.tu-bs.de/theses/goltzsch/ntp-ptb.html) and [presented an attack against an earlier version of the protocol](https://www8.cs.fau.de/staff/milius/AttackPossibilityTimeSyncTESLA.pdf). So perhaps it can be expected that NTS provides better security than Autokey.
There also seems to be an [ongoing effort to add NTS to ntpd](https://www.nwtime.org/network-time-security-nts-replacing-autokey/).
So I think it would make sense for systemd-timesyncd to support NTS to allow secure time synchronization which often seems to be a [requirement](https://www.internetsociety.org/blog/2017/09/time-synchronization-security-trust/). If there is a consensus to support NTS in systemd-timesyncd, I can have a look whether I'm able to implement it.
However, because incorrect time synchronisation can cause so many problems, I want to confirm whether anyone has attempted to replace timesyncd with ntpd-rs:
PS /> dnf search ntpd-rs
Matched fields: name (exact)
ntpd-rs.x86_64 Full-featured implementation of NTP with NTS support
Nts looks interesting.
I recall that nts has problems because of limited number of correctly configured/implemented/available servers.
But I do not recall where I read this. It would be worth researching to see if you see issues with nts as an early adopter.
@barryascott , my hope is that I’m not much of an early adopter:
I am thrilled to announce the next target in our campaign to replace core system utilities with memory-safe Rust rewrites in Ubuntu. In upcoming releases, Ubuntu will be adopting ntpd-rs as the default time synchronization client and server,...
Reading time: 3 mins 🕑
Likes: 18 ❤
However, what’s unclear to me, is what steps I need to take to configure it, and/or how to verify that those steps have been taken for me by the installer, or that I need to:
# Getting started
Ntpd-rs is an implementation of the NTP protocol. It aims to synchronize your system's clock to time received from the internet. It can also, when [configured as server](server-setup.md), provide time to other machines on the network.
## Installation
Installation instructions for your system can be found in the [installation guide](installation.md). For first time users, we strongly recommend using either your OS package repository packages, or the packages we provide. If you have installed ntpd-rs from source, and you have installed files in different locations than the default, you may need to modify the instructions below.
## Checking the synchronization.
The default configuration for ntpd-rs sets it up to synchronize with four servers chosen from [the NTP pool](https://www.ntppool.org). We can check its synchronization status using:
```sh
ntp-ctl status
```
If everything is installed and working correctly this will display information looking like:
```
I don’t much trust LLMs for this, although GPT4-o produces the most comprehensible:
@steppybug , what does Fedora utilise by default? I’d presumed that it is timesyncd. My sole objective was to trial something well-supported, which utilises NTS. To that end, a project which Ubuntu intends to switch to by default doesn’t appear particularly insane.
vekruse
(Villy Kruse)
August 13, 2026, 6:02pm
7
Try https://forge.fedoraproject.org/releng/fedora-comps.git .
Or just run a combination of dnf environment info EE and dnf group info GG
where EE is the environment you are interested in and GG is one of the groups from the previous listing.
@steppybug , I agree:
opened 09:38PM - 10 Aug 26 UTC
closed 04:49PM - 13 Aug 26 UTC
documentation
Site specific
### Describe the bug
When I attempt to access [`https://git.ffmpeg.org/`](https… ://git.ffmpeg.org/), I am `.assign`'d to ≈ [`http://git.ffmpeg.org/.within.website/x/cmd/anubis/api/pass-challenge?id=019fed97-f3e4-7d33-8b34-c1ff16d103f7&response=007a3e51d12f5a392aefcd5114c9556bd2778c0ace27fc37465290f39b093be4&nonce=627&redir=http%3A%2F%2Fgit.ffmpeg.org%2Fffmpeg.git&elapsedTime=100#title:~:text=Your%20browser%20is%20configured%20to%20disable%20cookies%2E%20Anubis%20requires%20cookies%20for%20the%20legitimate%20interest%20of%20making%20sure%20you%20are%20a%20valid%20client%2E%20Please%20enable%20cookies%20for%20this%20domain%2E`](http://git.ffmpeg.org/.within.website/x/cmd/anubis/api/pass-challenge?id=019fed97-f3e4-7d33-8b34-c1ff16d103f7&response=007a3e51d12f5a392aefcd5114c9556bd2778c0ace27fc37465290f39b093be4&nonce=627&redir=http%3A%2F%2Fgit.ffmpeg.org%2Fffmpeg.git&elapsedTime=100#title:~:text=Your%20browser%20is%20configured%20to%20disable%20cookies%2E%20Anubis%20requires%20cookies%20for%20the%20legitimate%20interest%20of%20making%20sure%20you%20are%20a%20valid%20client%2E%20Please%20enable%20cookies%20for%20this%20domain%2E), whereupon I observe:
> Your browser is configured to disable cookies. Anubis requires cookies for the legitimate interest of making sure you are a valid client. Please enable cookies for this domain.
To empirically demonstrate this:
<p></p><img width="636" height="693" alt="Image" src="https://github.com/user-attachments/assets/c6c3c0a8-362f-409e-aac5-fdd518238c60" /><p></p>
### Steps to reproduce
~~~JS
#!/usr/bin/env xdg-open
window.location.assign('https://git.ffmpeg.org/');
~~~
### Expected behavior
I should be able to access the website.
### Your operating system and its version.
[`fedora-release-identity-kde-desktop-44`](https://eu.edge.kernel.org/fedora/updates/44/Everything/x86_64/Packages/f/fedora-release-identity-kde-desktop-44-18.noarch.rpm)
### Your browser and its version.
`firefox-nightly-155.0a1-20260809214638.x86_64`
### Additional context
Originally, this was originally reported at [`issues/1305#issuecomment-5244963966`](https://github.com/TecharoHQ/anubis/issues/1305#issuecomment-5244963966), because the behaviour appeared to differ, when visited via HTTP and HTTPS, on Fenix for AOSP. However, now, it does not appear to. There, I was advised to create a ticket.
#### Diagnosis
The ECMAScript console returns:
<blockquote>
~~~ini
00:43:29.490 GET
http://git.ffmpeg.org/.within.website/x/cmd/anubis/api/pass-challenge?id=019fee0f-26d4-7d5c-b50a-02165a370c11&response=008f63936a4677cd06c955020eacff3fefbe0811af30794592c591f844fa04b0&nonce=113&redir=http://git.ffmpeg.org/gitweb&elapsedTime=70
[HTTP/1.1 500 Internal Server Error 105ms]
00:43:29.623 Cookie “techaro.lol-anubis-auth-347ddb4a” has been rejected because a non-HTTPS cookie can’t be set as “secure”. pass-challenge
00:43:29.623 Cookie “techaro.lol-anubis-cookie-verification-347ddb4a” has been rejected because a non-HTTPS cookie can’t be set as “secure”. pass-challenge
00:43:29.634 GET
http://git.ffmpeg.org/.within.website/x/xess/xess.min.css?cachebuster=v1.27.0
[HTTP/1.1 200 OK 351ms]
00:43:29.651 Layout was forced before the page was fully loaded. If stylesheets are not yet loaded this may cause a flash of unstyled content. node.js:416:1
00:43:29.666 GET
http://git.ffmpeg.org/.within.website/x/cmd/anubis/static/img/reject.webp?cacheBuster=v1.27.0
[HTTP/1.1 200 OK 488ms]
00:43:29.861 GET
http://git.ffmpeg.org/favicon.ico
[HTTP/1.1 403 Forbidden 240ms]
00:43:29.986 Unknown descriptor ‘monospace’ in @font-face rule. Skipped to next declaration. xess.min.css:1:167315
~~~
</blockquote>
However, I've removed a hideously long call, appended:
~~~diff
xess.min.css:1:167315
00:43:29.992 GET
- data:font/woff2;base64,
~~~
However, it’s required, nowadays:
Unless one utilises a GitLab instance with ElasticSearch available, to my knowledge, no alternative software provides anything that is that comprehensive:
@vekruse , dnf environment info kde-desktop-environment doesn’t appear to directly provide this information. Is one expected to somehow introspect a group?
It’s chronyd and has been for a while.
I wondered how you might query this and came up with:
systemctl --all | grep -i ntp
augenauf
(Flo)
August 13, 2026, 7:43pm
12
In addition, chrony – Frequently Asked Questions has a lot of information regarding NTS.
I think in the very beginning it was only Cloudflare offering NTS, but that has changed.
Potential list of available NTS servers: GitHub - jauderho/nts-servers: NTP servers with NTS support · GitHub (no warranty that they all work or the list is complete)
Example output of chrony with NTS option enabled in /etc/chrony.conf
chronyc sources
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
^* ptbtime1.ptb.de 1 6 17 54 +1157us[+1722us] +/- 12ms
^- ptbtime2.ptb.de 1 6 17 53 -609us[ -609us] +/- 11ms
^- ptbtime3.ptb.de 1 6 17 53 +41us[ +41us] +/- 10ms
^- ptbtime4.ptb.de 1 6 17 53 -1291us[-1291us] +/- 12ms
^- ntp3.rrze.uni-erlangen.de 1 6 17 53 +2861us[+2861us] +/- 14ms
sudo chronyc -N authdata
Name/IP address Mode KeyID Type KLen Last Atmp NAK Cook CLen
=========================================================================
ptbtime1.ptb.de NTS 1 15 256 62 0 0 8 100
ptbtime2.ptb.de NTS 1 15 256 61 0 0 8 100
ptbtime3.ptb.de NTS 1 15 256 62 0 0 8 100
ptbtime4.ptb.de NTS 1 15 256 62 0 0 8 100
ntp3.fau.de NTS 1 15 256 62 0 0 8 104
Not off the top of my head. I am speaking from experience running fedora server and kde plasma for a few years where chrony has been the default for a very long time.
vekruse
(Villy Kruse)
August 14, 2026, 8:49am
16
Yes you you are. First you get a list of groups, and then you have to check the contents of each group. Then there may be some extra packages according to some control files at https://forge.fedoraproject.org/releng/kiwi-descriptions.git . Don’t ask me how to interpret that, though.
Also check the presets in /usr/lib/systemd/system-preset/*, where the first file in numeric order takes precedence.
grumpey
(Joe Walker)
August 14, 2026, 10:02am
17
You can check what groups a package is in with:
dnf group list --hidden --contains-pkgs=chrony
You can then look at the environment info to see what group pulls the package in.
You can also look through the kiwi desktop files to see which groups/environments are pulled in.