Is my chrony.conf safe & good to use?

Hello;

I use public pools here are my conf file for chrony;

server time dot cloudflare dot com iburst nts
server time dot google dotcom iburst nts
pool ntp dot ubuntu dotcom iburst maxsources 4
pool pool dot ntp dot org iburst maxsources 4
allow 0.0.0.0/0
allow ::/0
driftfile /var/lib/chrony/drift
rtcsync
makestep 0.5 3
noclientlog (due to maybe gdpr etc.. disabled intentionally)
cmdport 0
minsources 2

Do you think numbers & sources are safe to use ? + please make a comment for my conf file . Removed. com links due to my new membership

Thank you!

im not clear what the purpose of this chrono instande is? Is it intended for a client or a server? i assume the latter.

Personally i wouldn’t use google timeservers since they use leap smearing, while others do not.

Looks ok otherwise.

I have few servers on ntp pool on different countries.

I would not use Google timeservers as they smear time-corrections, where the pool just skips a beat.

So when you add it as pool, it instantly gives you 4 servers.

Adding the pool as well is not a good idea, as it gives you more cloudflare.

Ubuntu same.

Find a few Stratum1 servers near you, 4 or so, and help them distribute time via your server:

It’s not a good idea to add pools like Ubuntu or the pool itself.

But after you found a few good servers, then add your server(s) to the pool, that helps.

1 Like

How many stratum 1s must be on a config file? (and 2 and 3)? How should be the distribution?

Given that the probability of any leap events in the near future is currently rather low, and as it has been decided to generally do away with leap seconds anyhow, I don’t see this as critical anymore nowadays. But if given a choice, other servers might anyhow be better suited, e.g., Apple’s. Or rather, diversity is what one should aim for, i.e., not too many eggs in/from the same basket.

Both Apple servers as well as Google servers are used as references for the pool monitors, by the way.

The pool indeed discourages having the pool itself as upstream, but not because “it gives you more cloudflare”. Rather, due to the random nature of which servers one might end up upon each restart of the daemon, or when the daemon otherwise rotates servers learned via the pool (the NTP pool just has too many servers in at least some zones; other pools, such as Ubuntu’s, are less critical in that respect).

I.e., one approach could be to start using the pool initially, just to discover some servers that the daemon finds suitable. And then manually configure those servers specifically. (Or just do DNS queries for the pool names, and select some manually, and repeat if any of them does not perform well.)

I would use 4 to 5, if you don’t have your own GPS, else 3.

Do not use min/maxpoll, run them normal.

You can mix them with stratum2 servers, but I would use at least 1 stratum 1 server if you don’t have your own.

Then check after 10 minutes what ‘chronc tracking’ tells you about the offset to the NTP-system.

Normally it will be pretty good.

I meant with that, it’s reapeating the same servers over and over again.

Makes the pool vulnerable to bad-tickers. As such, seek own ntp.servers, outside the pool.

Then subscribe to the pool. The more different-clocks, the better,

However, the pool generates a lot of Claudflare, too much in my opinion.

I know what you meant.

Not more significantly than with other sources I would say.

Sure, diversity is usually better.

Yes. With emphasis on “different” rather than “more”.

Not sure what you mean. There’s a maximum of four Cloudflare servers that a client could pick up. Not optimal, more diversity would be better obviously. But if the only “good” servers you have access to in your zone are those from Cloudflare, what is one to do?

Sure, in some zones, I don’t know why Cloudflare needs to be present. E.g., I had been thinking about raising a discussion about dropping Cloudflare from, e.g., the DE zone. But then, based on the numbers you say you don’t understand, I realized their share in the DE zone is too low anyway to even warrant having a large discussion around it.

In other zones, they are the lifeline of the zone.

And then there are zones where Cloudflare servers are the only ones, so there, it does not make sense to have them at all from my point of view, as the implicit fall-back to the enclosing zone would/should take care of there being no servers in that zone (apart from the Cloudflare ones).

Though, maybe there used to be other servers in those zones that needed that “protection” in the past (like your BE server is now operating under the cover of bigger servers recently added to the zone). Or it could help bootstrap an ecosystem of smaller servers which on their own would not be able to survive in a specific zone.

None…You could run a server with only S6 servers as a source if you want (putting your server at S7) :wink:

Ideally you have a minimum of 3 servers so that at least 2 would agree closely and 1 could be detected as a “false-ticker”. After that any odd number like 5 or 7 etc. servers would be preferred, just so that you always have a quorum of more than half of your configured servers agreeing on a common view of “correct” time.

If you are able add as many low stratum servers as possible without resorting to higher stratum servers because a) the time precision doesn’t get better at the end of a chain of “chinese whisper” and b) many higher stratum servers may use the same reference clocks/S1 server anyway and you have no redundancy, just the same time from the same source diluted by errors through the chain of servers.

I would advise you to try and pick like 5 nearby low stratum servers from national laboratories or universities with low network latency. Just please check their websites if they are open access or make arrangements to be able to use them.

1 Like

I know it’s just an example, but important to note that the pool will not accept server with stratum 7, and I’m not sure off the top of my head as to whether 6 would still be accepted.

server time dot google dotcom iburst nts

this line implies that time.google.com supports NTS, but in fact it does not.
So you may s/NTS// in it

pool ntp dot ubuntu dotcom iburst maxsources 4
Ubuntu now supports NTS ,but on the followoing servers:
2.ntp.ubuntu.com
3.ntp.ubuntu.com
4.ntp.ubuntu.com

you may add them and NTS to it (1.ntp.ubuntu.com is failing on NTS)

If you really care about security, you should only use NTS servers