sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

secure-ntp: remove the chrony pkg NM dispatcher that clobbered the NTS source

Browse Source 
NTS was inactive on the clean-build deploy (secure-ntp-d1621e9, comet-beacon-54):
chronyc authdata showed a plain IP source in Mode '-', Cook 0, with no NTS-KE
attempt at all -- chrony was on plain NTP.

Root cause: NetworkManager runs dispatcher scripts from BOTH
/etc/NetworkManager/dispatcher.d and /usr/lib/NetworkManager/dispatcher.d, merged
and sorted by filename. The chrony RPM ships
/usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp, which writes the DHCP
option-42 server to the SAME /run/chrony-dhcp/<iface>.sources file our
10-chrony-dhcp-ntp uses. Sorting after 10-, it ran last and overwrote our
`server ntp.fleet.lab iburst nts` line with `server 192.168.50.10 iburst`, then
reloaded chrony -- last writer wins on the shared filename, silently defeating
authenticated time.

Isolation proof: removing the distro script + hand-writing the NTS source brought
NTS up immediately (ntp.fleet.lab NTS, Cook 8, zero NAKs), confirming the host
image, the fleet-signed NTS-KE cert, DNS, and tcp/4460 were all already correct --
the collision was the sole defect.

Fix: the provisioner removes /usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp
at build (our dispatcher supersedes it in both modes); 20-chrony-onoffline is left
in place (harmless). Documents the finding in the dispatcher header,
docs/secure-ntp-design.md, and the CLAUDE.md secure_ntp note. BENCH-VERIFY on the
next clean build: a normal boot reaches NTS/cookies>0 with no manual step.
This commit is contained in:
Audiobuzz
2026-07-11 14:02:40 +00:00
parent d1621e9b74
commit 5a3eaedec5
4 changed files with 55 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+7 -1
View File
@@ -276,7 +276,13 @@ instead of working around it.
(`serving/chrony/nts-cert.sh`), and **tcp/4460** (NTS-KE) open + udp/123. Confirm
on a booted host: `chronyc -N authdata` shows the source in `NTS` mode, cookies
> 0. `nocerttimecheck 1` lets a cold boot clock (no RTC) bootstrap the first sync.
**Toggle:** `secure_ntp=false` reverts the dispatcher to the legacy
**Bench finding (2026-07-11, FIXED):** the chrony RPM ships its OWN NM dispatcher
`/usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp`; NM merges `/etc` + `/usr/lib`
dispatchers by name, so it ran AFTER our `10-chrony-dhcp-ntp` and overwrote the NTS
line in the shared `/run/chrony-dhcp/<iface>.sources` with the plain option-42
server — silently defeating NTS (authdata Mode `-`, Cook 0). The provisioner now
`rm`s it (NTS then reached Cook 8 on the bench). Don't re-add a competing writer to
that file. **Toggle:** `secure_ntp=false` reverts the dispatcher to the legacy
unauthenticated **DHCP option 42** path (plain `server <ip> iburst`).
- `fleet` Plymouth theme: confirm (a) the script plugin package actually
installed (`/usr/lib64/plymouth/script.so` — else the build fell back to