I’m in the process of writing a tech note to guide users on how to change their time synchronization from systemd-timedate.service (NTP) to the encrypted chronyd.service time (NTS). What I noticed (in Gnome) is when I toggle the time date synchronize settings ON\OFF the system will switch back to using systemd-timedate.service.
Question:
What is the best way to make chronyd.service the default time date sync service?
This is my guess based on what i am reading:
a. Edit the “/usr/lib/systemd/ntp-units.d/80-systemd-timesync.list”.
b. Remove the line “systemd-timesyncd.service”.
c. Add the line “SYSTEMD_TIMEDATED_NTP_SERVICES=chronyd.service:systemd-timesyncd.service”.
d. Disable the “systemd-timesyncd.service”.
e. Enable and start the “chronyd.service”.
f. The systemd-timedated.service will now know to use chronyd.service.
I’m just not quite sure what it means by changing the system environment variables.
So after this is done the “systemd-timedated.service” is restarted automatically and it switches to using systemd-timesyncd.service.
sudo systemctl status systemd-timedated.service
● systemd-timedated.service - Time & Date Service
Loaded: loaded (/usr/lib/systemd/system/systemd-timedated.service; static)
Active: active (running) since Sun 2023-09-10 14:37:30 EDT; 1min 21s ago
Docs: man:systemd-timedated.service(8)
man:localtime(5)
man:org.freedesktop.timedate1(5)
Main PID: 24115 (systemd-timedat)
Tasks: 1 (limit: 19007)
Memory: 1.2M
CPU: 53ms
CGroup: /system.slice/systemd-timedated.service
└─24115 /usr/lib/systemd/systemd-timedated
Sep 10 14:37:30 mani systemd[1]: Starting Time & Date Service...
Sep 10 14:37:30 mani systemd[1]: Started Time & Date Service.
Sep 10 14:37:36 mani systemd-timedated[24115]: chronyd.service: Disabling unit.
Sep 10 14:37:37 mani systemd-timedated[24115]: Set NTP to disabled.
Sep 10 14:38:00 mani systemd-timedated[24115]: Changed local time to Sun 2023-09-10 14:38:00 EDT
Sep 10 14:38:24 mani systemd-timedated[24115]: systemd-timesyncd.service: Enabling unit.
Sep 10 14:38:24 mani systemd-timedated[24115]: Set NTP to enabled (systemd-timesyncd.service).
I’m going to post the below steps as what I did to set it up:
How to setup Chrony on Linux for Secure Time Synchronization (NTP)
Many computers use the Network Time Protocol (NTP) to synchronize their system clocks over the internet. NTP is one of the few unsecured internet protocols still in common use today. Usi Network Time Security (NTS) is one method secure NTP.
Install Chrony from Arch Repository:
sudo pacman -S chrony
Output:
Package (1) New Version Net Change Download Size
extra/chrony 4.4-1 1.06 MiB 0.34 MiB
Total Download Size: 0.34 MiB
Total Installed Size: 1.06 MiB
:: Proceed with installation? [Y/n] y
:: Retrieving packages...
chrony-4.4-1-x86_64 344.6 KiB 520 KiB/s 00:01 [----------------------------------------] 100%
(1/1) checking keys in keyring [----------------------------------------] 100%
(1/1) checking package integrity [----------------------------------------] 100%
(1/1) loading package files [----------------------------------------] 100%
(1/1) checking for file conflicts [----------------------------------------] 100%
:: Processing package changes...
(1/1) installing chrony [----------------------------------------] 100%
:: Running post-transaction hooks...
(1/4) Creating system user accounts...
Creating group 'chrony' with GID 956.
Creating user 'chrony' (Network Time Protocol) with UID 956 and GID 956.
(2/4) Reloading system manager configuration...
(3/4) Creating temporary files...
(4/4) Arming ConditionNeedsUpdate...
Update the /etc/chrony.conf file with your preferred configuration:
### SPECIFY YOUR NTP SERVERS
# Most computers using chrony will send measurement requests to one or
# more 'NTP servers'. You will probably find that your Internet Service
# Provider or company have one or more NTP servers that you can specify.
# Failing that, there are a lot of public NTP servers. There is a list
# you can access at http://support.ntp.org/bin/view/Servers/WebHome or
# you can use servers from the pool.ntp.org project.
# Cloudflare (Anycast)
server time.cloudflare.com nts iburst
# System76
server ohio.time.system76.com nts iburst
# Default Arch NTP Pool
! pool 2.arch.pool.ntp.org iburst
#######################################################################
### AVOIDING POTENTIALLY BOGUS CHANGES TO YOUR CLOCK
#
# To avoid changes being made to your computer's gain/loss compensation
# when the measurement history is too erratic, you might want to enable
# one of the following lines. The first seems good with servers on the
# Internet, the second seems OK for a LAN environment.
maxupdateskew 100
# By default, chronyd allows synchronisation to an unauthenticated NTP
# source (i.e. specified without the nts and key options) if it agrees with
# a majority of authenticated NTP sources, or if no authenticated source is
# specified. If you don't want chronyd to ever synchronise to an
# unauthenticated NTP source, uncomment the first from the following lines.
# If you don't want to synchronise to an unauthenticated NTP source only
# when an authenticated source is specified, uncomment the second line.
# If you want chronyd to ignore authentication in the source selection,
# uncomment the third line.
authselectmode require
! authselectmode prefer
! authselectmode ignore
#######################################################################
### FILENAMES ETC
# Chrony likes to keep information about your computer's clock in files.
# The 'driftfile' stores the computer's clock gain/loss rate in parts
# per million. When chronyd starts, the system clock can be tuned
# immediately so that it doesn't gain or lose any more time. You
# generally want this, so it is uncommented.
driftfile /var/lib/chrony/drift
# Your RTC can be set to keep Universal Coordinated Time (UTC) or local
# time. (Local time means UTC +/- the effect of your timezone.) If you
# use UTC, chronyd will function correctly even if the computer is off
# at the epoch when you enter or leave summer time (aka daylight saving
# time). However, if you dual boot your system with Microsoft Windows,
# that will work better if your RTC maintains local time. You take your
# pick!
rtconutc
# Alternatively, if not using the -s option, this directive can be used
# to enable a mode in which the RTC is periodically set to the system
# time, with no tracking of its drift.
rtcsync
Have Systemd use Chrony for time sync:
You can actually define the order of preference in which systemd-timedated searches for the actual synchronization services, either by defining an environment variable in an override file, e.g.:
a. Create a systemd service to allow for creation of an override file.
sudo systemctl edit myservice
b. The directory /etc/systemd/system/myservice.service.d will be created automatically.
c. Create an override file in the /etc/systemd/system/myservice.service.d directory.
