Skip to content
    • Welcome to the Linux Foundation Forum!

    ntp vs. ntpd vs. NTPsec

    Posts: 51
    edited October 2024 in LFS207 Class Forum

    Hello again :-)

    I found that the file /etc/ntp.conf doesn't exist in Debian 12 but /etc/ntpsec/ntp.conf. So it looks like there has even more changed since the chapter 27 has been written.

    While examining the files and services, I got somehow confused.

    When reading the ntp info page, it says that it depends on ntpsec:

    1. ┌──(alu@nb)-[/etc]
    2. └─$ apt info ntp
    3. Package: ntp
    4. Version: 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1
    5. Priority: optional
    6. Section: net
    7. Source: ntpsec (1.2.2+dfsg1-1+deb12u1)
    8. Maintainer: Richard Laager <rlaager@debian.org>
    9. Installed-Size: 63.5 kB
    10. Depends: ntpsec
    11. Homepage: https://www.ntpsec.org
    12. Tag: admin::benchmarking, admin::configuring, implemented-in::c,
    13.  interface::commandline, interface::daemon, network::server,
    14.  network::service, protocol::TODO, role::program, scope::utility,
    15.  use::monitor, use::timekeeping
    16. Download-Size: 22.0 kB
    17. APT-Sources: http://deb.debian.org/debian bookworm/main amd64 Packages
    18. Description: Network Time Protocol daemon/utilities (transitional package)
    19.  This is a dummy transitional package to transition to NTPsec.
    20.  It can be safely removed.

    Does this package just linking to the follow-up ntpsec package and therefore, it depends on ntpsec and can be removed as mentioned in the info pages description?

    In addition there are two services, which seem to be the same:

    • ntp.service
    • ntpsec.service
    1. ┌──(alu@nb)-[/etc/ntpsec]
    2. └─$ systemctl status ntp.service 
    3. ● ntpsec.service - Network Time Service
    4.      Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled)
    5.      Active: active (running) since Wed 2024-10-16 13:40:29 CEST; 17min ago
    6.        Docs: man:ntpd(8)
    7.     Process: 33814 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
    8.    Main PID: 33817 (ntpd)
    9.       Tasks: 1 (limit: 76726)
    10.      Memory: 2.4M
    11.         CPU: 95ms
    12.      CGroup: /system.slice/ntpsec.service
    13.              └─33817 /usr/sbin/ntpd -p /run/ntpd.pid -g -N -c /run/ntpsec/ntp.conf.dhcp -u ntpsec:ntpsec
    14.  
    15. ┌──(alu@nb)-[/etc/ntpsec]
    16. └─$ systemctl status ntpsec.service 
    17. ● ntpsec.service - Network Time Service
    18.      Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled)
    19.      Active: active (running) since Wed 2024-10-16 13:40:29 CEST; 17min ago
    20.        Docs: man:ntpd(8)
    21.     Process: 33814 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
    22.    Main PID: 33817 (ntpd)
    23.       Tasks: 1 (limit: 76726)
    24.      Memory: 2.4M
    25.         CPU: 96ms
    26.      CGroup: /system.slice/ntpsec.service
    27.              └─33817 /usr/sbin/ntpd -p /run/ntpd.pid -g -N -c /run/ntpsec/ntp.conf.dhcp -u ntpsec:ntpsec

    These two services just look to be setup as aliases. Why is that? For backwards compatibility?

    And finally, in the Lab 27.1 it's written to restart the services with:

    1. # systemctl restart ntpd
    2. # systemctl restart ntp

    What's the difference of the two and is ntpsec the replacement for the former ntpd?

    Thanks,
    Urs

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Answers

    • Posts: 1,264

      Hi Urs,

      I'll try to point to in the right direction.

      What's the difference of the two and is ntpsec the replacement for the former ntpd?

      That's correct. You can find more information here:

      https://docs.ntpsec.org/latest/ntpsec.html

      These two services just look to be setup as aliases. Why is that? For backwards compatibility?

      From the URL provided:

      "We retain, however, almost full compatibility and interoperation with NTP Classic. The qualification "almost" is required mainly because we do not support the Autokey (RFC 5906) public-key encryption scheme. It had interoperability and exploitable vulnerability issues too severe to be patched. We have also dropped broadcast and anycast modes because they cannot be secured".

      So, it seems somethings are being kept for compatibility, let's say if you already have a full systems working with NTP, you will be able to run these operations.

      For checking on the dependencies, you can do this:

      apt show ntpsec

      And then you will know for certain if you can remove ntp.

      Also, about the services, you can see ir here:

      ubuntu@master:/etc/systemd/system$ ls -l ntpd*
      lrwxrwxrwx 1 root root 38 Oct 15 11:07 ntpd.service -> /usr/lib/systemd/system/ntpsec.service

      So, the ntpd service is pointing to the ntpdsec service.

      I hope that helps to answer your questions!!

      Regards,
      Luis.

    • Posts: 51

      Hi Luis,
      Great, thank you very much. That's very helpful.
      Regards,
      Urs

    • Posts: 1,264

      Hi Urs, it's a pleasure!

      Regards,
      Luis.

    • Posts: 1
      edited February 1

      I always thought that Linux exists to avoid exactly that - someone telling you how to run your systems. Isnt it what Linux is about? To give users freedom and avoid "evil corporations" meddling in every nuance of your life?

      Now to the point - you want to help you users (who you obviously believe to be clueless lambs) to not get hacked. Thats fine. You quietly replaced A with B (that is not fine but nothing I can do about it). But you absolutely have to give options for users who wants ntp and not ntpsec. A script or whatever that we can run to rid off the symlinks and other shenanigans. I want to be hacked it is my machine and my decision.

    • Posts: 1,264

      Hi @maxima120,

      In general, software improves, evolves and get fixed. I could mention FTP/vsftpd/scp ,etc. Also SSL/TLS, in terms of security improvements. And that's good for services, servers, security of the information, organizations, etc.

      Regards,
      Luis.

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Welcome!

    It looks like you're new here. Sign in or register to get started.
    Sign In

    Quick Links

    Categories

    Upcoming Training