Going in circles without a real-time clock
rachelbythebay.com
Going in circles without a real-time clock
1–10 of 157 posts
Re: Going in circles without a real-time clock
#2tl;dr: machine is unable synchronize its clock because it won't trust the NTP server's DNSSEC certificate because its clock isn't synchronized. Oof.
Re: Going in circles without a real-time clock
#3> By "everything else", I also mean WireGuard. Did you know that if your machine gets far enough out of sync, that'll stop working, too? I had no idea that it apparently includes time in its crypto stuff, but what other explanation is there?
WireGuard only requires a monotonic clock, because it periodically rotates keys to provide the forward secrecy. Peer clocks are otherwise not required to be synchronized [1]. I guess the clock had a higher rate than usual and it couldn't be corrected due to the lack of RTC?
[1] https://www.wireguard.com/papers/wireguard.pdf#page=7 "In fact, it does not even have to be an accurate timestamp; it simply must be a per-peer monotonically increasing 96-bit number."
Re: Going in circles without a real-time clock
#4tl;dr: machine is unable synchronize its clock because it won't trust the NTP server's DNSSEC certificate because its clock isn't synchronized. Oof.
Yeah in hindsight it might not be the best idea to enable this for ntp.org, especially when the ntp protocol itself isn't secure.
Re: Going in circles without a real-time clock
#5What is she referring to by “THE ONE”?
Re: Going in circles without a real-time clock
#6What is she referring to by “THE ONE”?
The know it all. This “wouldn’t have happened to them because they are” THE ONE. Also known as, “that guy” as in, “don’t be THAT GUY.”
Re: Going in circles without a real-time clock
#7tl;dr: machine is unable synchronize its clock because it won't trust the NTP server's DNSSEC certificate because its clock isn't synchronized. Oof.
https://github.com/systemd/systemd/commit/abf4e5c1d3ad767bc0...
While systemd-timesyncd contains a workaround for this, chrony does not seem to.
Re: Going in circles without a real-time clock
#8RTC module for Raspberry is ~ $1.
Re: Going in circles without a real-time clock
#9What is she referring to by “THE ONE”?
It's pre-empting the sibling comment saying "RTC module is $1"
Re: Going in circles without a real-time clock
#10What is she referring to by “THE ONE”?