Compare commits
No commits in common. 'c9' and 'i10-beta' have entirely different histories.
@ -1,3 +1,2 @@
|
|||||||
bc7884eb4fde69478a00faee3d42092d426d57c1 SOURCES/chrony-4.3.tar.gz
|
4661e5df181a9761b73caeaef2f2ab755bbe086a SOURCES/chrony-4.5.tar.gz
|
||||||
9c453ae65e5c1a6983cd1121410faf1ffd2d9092 SOURCES/clknetsim-f00531.tar.gz
|
e021461c23fe4e5c46fd53c449587d8f6cc217ae SOURCES/clknetsim-5d1dc0.tar.gz
|
||||||
1395afa521d2e3302a31083edcf568bbc036aafc SOURCES/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
|
|
||||||
|
|||||||
@ -1,3 +1,2 @@
|
|||||||
SOURCES/chrony-4.3.tar.gz
|
SOURCES/chrony-4.5.tar.gz
|
||||||
SOURCES/clknetsim-f00531.tar.gz
|
SOURCES/clknetsim-5d1dc0.tar.gz
|
||||||
SOURCES/gpgkey-8F375C7E8D0EE125A3D3BD51537E2B76F7680DAC.asc
|
|
||||||
|
|||||||
@ -0,0 +1,343 @@
|
|||||||
|
From 490c310c3218f5ea5a27d850e42fa1083cec788b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sergey Cherevko <s.cherevko@msvsphere-os.ru>
|
||||||
|
Date: Tue, 17 Dec 2024 20:40:35 +0300
|
||||||
|
Subject: [PATCH] Synchronize time via Russian NTP servers
|
||||||
|
|
||||||
|
---
|
||||||
|
FAQ | 12 ++++++------
|
||||||
|
INSTALL | 4 ++--
|
||||||
|
doc/chrony.conf.adoc | 8 ++++----
|
||||||
|
doc/chrony.conf.man.in | 10 +++++-----
|
||||||
|
doc/chronyc.adoc | 2 +-
|
||||||
|
doc/chronyc.man.in | 4 ++--
|
||||||
|
doc/faq.adoc | 12 ++++++------
|
||||||
|
doc/installation.adoc | 4 ++--
|
||||||
|
examples/chrony.conf.example1 | 11 +++++++++--
|
||||||
|
examples/chrony.conf.example2 | 12 +++++++++---
|
||||||
|
examples/chrony.conf.example3 | 4 ++--
|
||||||
|
11 files changed, 48 insertions(+), 35 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/FAQ b/FAQ
|
||||||
|
index c96acfa..18687b7 100644
|
||||||
|
--- a/FAQ
|
||||||
|
+++ b/FAQ
|
||||||
|
@@ -101,7 +101,7 @@ poll multiple servers at the same time and detect servers having incorrect time
|
||||||
|
(falsetickers in the NTP terminology). It should be used only with trusted
|
||||||
|
reliable servers, ideally in local network.
|
||||||
|
|
||||||
|
-Using timesyncd with pool.ntp.org is problematic. The pool is very robust as a
|
||||||
|
+Using timesyncd with https://www.vniiftri.ru/ is problematic. The pool is very robust as a
|
||||||
|
whole, but the individual servers run by volunteers cannot be relied on.
|
||||||
|
Occasionally, servers drift away or make a step to distant past or future due
|
||||||
|
to misconfiguration, problematic implementation, and other bugs (e.g. in
|
||||||
|
@@ -141,10 +141,10 @@ next boot from the RTC, the rtcsync directive enables a mode in which the
|
||||||
|
system time is periodically copied to the RTC. It is supported on Linux and
|
||||||
|
macOS.
|
||||||
|
|
||||||
|
-If you wanted to use public NTP servers from the pool.ntp.org project, the
|
||||||
|
+If you wanted to use public NTP servers from the https://www.vniiftri.ru/ project, the
|
||||||
|
minimal chrony.conf file could be:
|
||||||
|
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool https://www.vniiftri.ru/ iburst
|
||||||
|
driftfile /var/lib/chrony/drift
|
||||||
|
makestep 1 3
|
||||||
|
rtcsync
|
||||||
|
@@ -433,7 +433,7 @@ the -Q option it will print the measured offset without setting the clock. If
|
||||||
|
you do not want to use a configuration file, NTP servers can be specified on
|
||||||
|
the command line. For example:
|
||||||
|
|
||||||
|
-# chronyd -q 'pool pool.ntp.org iburst'
|
||||||
|
+# chronyd -q 'pool https://www.vniiftri.ru/ iburst'
|
||||||
|
|
||||||
|
The command above would normally take about 5 seconds if the servers were well
|
||||||
|
synchronised and responding to all requests. If not synchronised or responding,
|
||||||
|
@@ -444,7 +444,7 @@ option to one (supported since chrony version 4.0), and a timeout can be
|
||||||
|
specified with the -t option. The following command would take only up to about
|
||||||
|
one second.
|
||||||
|
|
||||||
|
-# chronyd -q -t 1 'server pool.ntp.org iburst maxsamples 1'
|
||||||
|
+# chronyd -q -t 1 'server https://www.vniiftri.ru/ iburst maxsamples 1'
|
||||||
|
|
||||||
|
It is not recommended to run chronyd with the -q option periodically (e.g. from
|
||||||
|
a cron job) as a replacement for the daemon mode, because it performs
|
||||||
|
@@ -507,7 +507,7 @@ same server instance.
|
||||||
|
|
||||||
|
An example configuration of the client instance could be
|
||||||
|
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool https://www.vniiftri.ru/ iburst
|
||||||
|
allow 127.0.0.1
|
||||||
|
port 11123
|
||||||
|
driftfile /var/lib/chrony/drift
|
||||||
|
diff --git a/INSTALL b/INSTALL
|
||||||
|
index 9ca6e22..6f48020 100644
|
||||||
|
--- a/INSTALL
|
||||||
|
+++ b/INSTALL
|
||||||
|
@@ -116,10 +116,10 @@ make install-docs
|
||||||
|
Now that the software is successfully installed, the next step is to set up a
|
||||||
|
configuration file. The default location of the file is /etc/chrony.conf.
|
||||||
|
Several examples of configuration with comments are included in the examples
|
||||||
|
-directory. Suppose you want to use public NTP servers from the pool.ntp.org
|
||||||
|
+directory. Suppose you want to use public NTP servers from the https://www.vniiftri.ru/
|
||||||
|
project as your time reference. A minimal useful configuration file could be
|
||||||
|
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool https://www.vniiftri.ru/ iburst
|
||||||
|
makestep 1.0 3
|
||||||
|
rtcsync
|
||||||
|
|
||||||
|
diff --git a/doc/chrony.conf.adoc b/doc/chrony.conf.adoc
|
||||||
|
index cb3f95c..1f0168e 100644
|
||||||
|
--- a/doc/chrony.conf.adoc
|
||||||
|
+++ b/doc/chrony.conf.adoc
|
||||||
|
@@ -365,7 +365,7 @@ sources responding to requests. The default value is 4 and the maximum value is
|
||||||
|
An example of the *pool* directive is
|
||||||
|
+
|
||||||
|
----
|
||||||
|
-pool pool.ntp.org iburst maxsources 3
|
||||||
|
+pool https://www.vniiftri.ru/ iburst maxsources 3
|
||||||
|
----
|
||||||
|
|
||||||
|
[[peer]]*peer* _hostname_ [_option_]...::
|
||||||
|
@@ -2820,7 +2820,7 @@ the following methods:
|
||||||
|
stratum 1 and stratum 2 servers. You should find one or more servers that are
|
||||||
|
near to you. Check that their access policy allows you to use their
|
||||||
|
facilities.
|
||||||
|
-* Use public servers from the https://www.pool.ntp.org/[pool.ntp.org] project.
|
||||||
|
+* Use public servers from the https://www.vniiftri.ru/[ntp1.vniiftri.ru] project.
|
||||||
|
|
||||||
|
Assuming that your NTP servers are called _ntp1.example.net_, _ntp2.example.net_
|
||||||
|
and _ntp3.example.net_, your _chrony.conf_ file could contain as a minimum:
|
||||||
|
@@ -2853,7 +2853,7 @@ directive instead of multiple *server* directives. The configuration file could
|
||||||
|
in this case look like:
|
||||||
|
|
||||||
|
----
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool ntp1.vniiftri.ru iburst
|
||||||
|
driftfile @CHRONYVARDIR@/drift
|
||||||
|
makestep 1.0 3
|
||||||
|
rtcsync
|
||||||
|
@@ -3112,7 +3112,7 @@ information to be saved.
|
||||||
|
=== Public NTP server
|
||||||
|
|
||||||
|
*chronyd* can be configured to operate as a public NTP server, e.g. to join the
|
||||||
|
-https://www.pool.ntp.org/en/join.html[pool.ntp.org] project. The configuration
|
||||||
|
+https://www.vniiftri.ru/[ntp1.vniiftri.ru] project. The configuration
|
||||||
|
is similar to the NTP client with permanent connection, except it needs to
|
||||||
|
allow client access from all addresses. It is recommended to find at least four
|
||||||
|
good servers (e.g. from the pool, or on the NTP homepage). If the server has a
|
||||||
|
diff --git a/doc/chrony.conf.man.in b/doc/chrony.conf.man.in
|
||||||
|
index 66d2358..3a6d6a7 100644
|
||||||
|
--- a/doc/chrony.conf.man.in
|
||||||
|
+++ b/doc/chrony.conf.man.in
|
||||||
|
@@ -479,7 +479,7 @@ An example of the \fBpool\fP directive is
|
||||||
|
.if n .RS 4
|
||||||
|
.nf
|
||||||
|
.fam C
|
||||||
|
-pool pool.ntp.org iburst maxsources 3
|
||||||
|
+pool ntp1.vniiftri.ru iburst maxsources 3
|
||||||
|
.fam
|
||||||
|
.fi
|
||||||
|
.if n .RE
|
||||||
|
@@ -4651,7 +4651,7 @@ facilities.
|
||||||
|
. IP \(bu 2.3
|
||||||
|
.\}
|
||||||
|
Use public servers from the \c
|
||||||
|
-.URL "https://www.pool.ntp.org/" "pool.ntp.org" ""
|
||||||
|
+.URL "https://www.ntp1.vniiftri.ru/" "ntp1.vniiftri.ru" ""
|
||||||
|
project.
|
||||||
|
.RE
|
||||||
|
.sp
|
||||||
|
@@ -4696,7 +4696,7 @@ in this case look like:
|
||||||
|
.if n .RS 4
|
||||||
|
.nf
|
||||||
|
.fam C
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool ntp1.vniiftri.ru iburst
|
||||||
|
driftfile @CHRONYVARDIR@/drift
|
||||||
|
makestep 1.0 3
|
||||||
|
rtcsync
|
||||||
|
@@ -4993,7 +4993,7 @@ information to be saved.
|
||||||
|
.SS "Public NTP server"
|
||||||
|
.sp
|
||||||
|
\fBchronyd\fP can be configured to operate as a public NTP server, e.g. to join the
|
||||||
|
-.URL "https://www.pool.ntp.org/en/join.html" "pool.ntp.org" ""
|
||||||
|
+.URL "https://www.ntp.vniiftri.ru/en/join.html" "ntp1.vniiftri.ru" ""
|
||||||
|
project. The configuration
|
||||||
|
is similar to the NTP client with permanent connection, except it needs to
|
||||||
|
allow client access from all addresses. It is recommended to find at least four
|
||||||
|
@@ -5040,4 +5040,4 @@ For instructions on how to report bugs, please visit
|
||||||
|
.URL "https://chrony\-project.org/" "" "."
|
||||||
|
.SH "AUTHORS"
|
||||||
|
.sp
|
||||||
|
-chrony was written by Richard Curnow, Miroslav Lichvar, and others.
|
||||||
|
\ No newline at end of file
|
||||||
|
+chrony was written by Richard Curnow, Miroslav Lichvar, and others.
|
||||||
|
diff --git a/doc/chronyc.adoc b/doc/chronyc.adoc
|
||||||
|
index 96a0551..d88c7dc 100644
|
||||||
|
--- a/doc/chronyc.adoc
|
||||||
|
+++ b/doc/chronyc.adoc
|
||||||
|
@@ -979,7 +979,7 @@ them immediately, e.g. after suspending and resuming the machine in a different
|
||||||
|
network.
|
||||||
|
+
|
||||||
|
Note that with pools which have more than 16 addresses, or not all IPv4 or IPv6
|
||||||
|
-addresses are included in a single DNS response (e.g. pool.ntp.org), this
|
||||||
|
+addresses are included in a single DNS response (e.g. https://www.vniiftri.ru/), this
|
||||||
|
command might replace the addresses even if they are still in the pool.
|
||||||
|
|
||||||
|
[[reload]]*reload* *sources*::
|
||||||
|
diff --git a/doc/chronyc.man.in b/doc/chronyc.man.in
|
||||||
|
index 4541fc6..7888eff 100644
|
||||||
|
--- a/doc/chronyc.man.in
|
||||||
|
+++ b/doc/chronyc.man.in
|
||||||
|
@@ -1793,7 +1793,7 @@ them immediately, e.g. after suspending and resuming the machine in a different
|
||||||
|
network.
|
||||||
|
.sp
|
||||||
|
Note that with pools which have more than 16 addresses, or not all IPv4 or IPv6
|
||||||
|
-addresses are included in a single DNS response (e.g. pool.ntp.org), this
|
||||||
|
+addresses are included in a single DNS response (e.g. ntp1.vniiftri.ru), this
|
||||||
|
command might replace the addresses even if they are still in the pool.
|
||||||
|
.RE
|
||||||
|
.sp
|
||||||
|
@@ -2753,4 +2753,4 @@ For instructions on how to report bugs, please visit
|
||||||
|
.URL "https://chrony\-project.org/" "" "."
|
||||||
|
.SH "AUTHORS"
|
||||||
|
.sp
|
||||||
|
-chrony was written by Richard Curnow, Miroslav Lichvar, and others.
|
||||||
|
\ No newline at end of file
|
||||||
|
+chrony was written by Richard Curnow, Miroslav Lichvar, and others.
|
||||||
|
diff --git a/doc/faq.adoc b/doc/faq.adoc
|
||||||
|
index 8fd350f..69b8b3e 100644
|
||||||
|
--- a/doc/faq.adoc
|
||||||
|
+++ b/doc/faq.adoc
|
||||||
|
@@ -56,7 +56,7 @@ limitations is that it cannot poll multiple servers at the same time and detect
|
||||||
|
servers having incorrect time (falsetickers in the NTP terminology). It should
|
||||||
|
be used only with trusted reliable servers, ideally in local network.
|
||||||
|
|
||||||
|
-Using `timesyncd` with `pool.ntp.org` is problematic. The pool is very
|
||||||
|
+Using `timesyncd` with `ntp.vniiftri.ru` is problematic. The pool is very
|
||||||
|
robust as a whole, but the individual servers run by volunteers cannot be
|
||||||
|
relied on. Occasionally, servers drift away or make a step to distant past or
|
||||||
|
future due to misconfiguration, problematic implementation, and other bugs
|
||||||
|
@@ -98,11 +98,11 @@ system time is periodically copied to the RTC. It is supported on Linux and
|
||||||
|
macOS.
|
||||||
|
|
||||||
|
If you wanted to use public NTP servers from the
|
||||||
|
-https://www.pool.ntp.org/[pool.ntp.org] project, the minimal _chrony.conf_ file
|
||||||
|
+https://www.vniiftri.ru/[ntp1.vniiftri.ru] project, the minimal _chrony.conf_ file
|
||||||
|
could be:
|
||||||
|
|
||||||
|
----
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool ntp1.vniiftri.ru iburst
|
||||||
|
driftfile /var/lib/chrony/drift
|
||||||
|
makestep 1 3
|
||||||
|
rtcsync
|
||||||
|
@@ -411,7 +411,7 @@ clock. If you do not want to use a configuration file, NTP servers can be
|
||||||
|
specified on the command line. For example:
|
||||||
|
|
||||||
|
----
|
||||||
|
-# chronyd -q 'pool pool.ntp.org iburst'
|
||||||
|
+# chronyd -q 'pool ntp1.vniiftri.ru iburst'
|
||||||
|
----
|
||||||
|
|
||||||
|
The command above would normally take about 5 seconds if the servers were
|
||||||
|
@@ -424,7 +424,7 @@ timeout can be specified with the `-t` option. The following command would take
|
||||||
|
only up to about one second.
|
||||||
|
|
||||||
|
----
|
||||||
|
-# chronyd -q -t 1 'server pool.ntp.org iburst maxsamples 1'
|
||||||
|
+# chronyd -q -t 1 'server ntp1.vniiftri.ru iburst maxsamples 1'
|
||||||
|
----
|
||||||
|
|
||||||
|
It is not recommended to run `chronyd` with the `-q` option periodically (e.g.
|
||||||
|
@@ -491,7 +491,7 @@ the same server instance.
|
||||||
|
An example configuration of the client instance could be
|
||||||
|
|
||||||
|
----
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool ntp1.vniiftri.ru iburst
|
||||||
|
allow 127.0.0.1
|
||||||
|
port 11123
|
||||||
|
driftfile /var/lib/chrony/drift
|
||||||
|
diff --git a/doc/installation.adoc b/doc/installation.adoc
|
||||||
|
index b683911..0fa1eca 100644
|
||||||
|
--- a/doc/installation.adoc
|
||||||
|
+++ b/doc/installation.adoc
|
||||||
|
@@ -146,11 +146,11 @@ make install-docs
|
||||||
|
Now that the software is successfully installed, the next step is to set up a
|
||||||
|
configuration file. The default location of the file is _/etc/chrony.conf_.
|
||||||
|
Several examples of configuration with comments are included in the examples
|
||||||
|
-directory. Suppose you want to use public NTP servers from the pool.ntp.org
|
||||||
|
+directory. Suppose you want to use public NTP servers from the ntp1.vniiftri.ru
|
||||||
|
project as your time reference. A minimal useful configuration file could be
|
||||||
|
|
||||||
|
----
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+pool ntp1.vniiftri.ru iburst
|
||||||
|
makestep 1.0 3
|
||||||
|
rtcsync
|
||||||
|
----
|
||||||
|
diff --git a/examples/chrony.conf.example1 b/examples/chrony.conf.example1
|
||||||
|
index 5e93ea7..dd960ad 100644
|
||||||
|
--- a/examples/chrony.conf.example1
|
||||||
|
+++ b/examples/chrony.conf.example1
|
||||||
|
@@ -1,5 +1,12 @@
|
||||||
|
-# Use public NTP servers from the pool.ntp.org project.
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+# Use Russian public NTP servers (vniiftri and msk-ix)
|
||||||
|
+server ntp.msk-ix.ru iburst
|
||||||
|
+server ntp1.vniiftri.ru iburst
|
||||||
|
+server vniiftri2.khv.ru iburst
|
||||||
|
+server ntp1.niiftri.irkutsk.ru iburst
|
||||||
|
+server ntp.sstf.nsk.ru iburst
|
||||||
|
+server ntp2.vniiftri.ru iburst
|
||||||
|
+server ntp3.vniiftri.ru iburst
|
||||||
|
+server ntp4.vniiftri.ru iburst
|
||||||
|
|
||||||
|
# Record the rate at which the system clock gains/losses time.
|
||||||
|
driftfile /var/lib/chrony/drift
|
||||||
|
diff --git a/examples/chrony.conf.example2 b/examples/chrony.conf.example2
|
||||||
|
index bf2bbdd..61b4576 100644
|
||||||
|
--- a/examples/chrony.conf.example2
|
||||||
|
+++ b/examples/chrony.conf.example2
|
||||||
|
@@ -1,6 +1,12 @@
|
||||||
|
-# Use public servers from the pool.ntp.org project.
|
||||||
|
-# Please consider joining the pool (https://www.pool.ntp.org/join.html).
|
||||||
|
-pool pool.ntp.org iburst
|
||||||
|
+# Use Russian public NTP servers (vniiftri and msk-ix)
|
||||||
|
+server ntp.msk-ix.ru iburst
|
||||||
|
+server ntp1.vniiftri.ru iburst
|
||||||
|
+server vniiftri2.khv.ru iburst
|
||||||
|
+server ntp1.niiftri.irkutsk.ru iburst
|
||||||
|
+server ntp.sstf.nsk.ru iburst
|
||||||
|
+server ntp2.vniiftri.ru iburst
|
||||||
|
+server ntp3.vniiftri.ru iburst
|
||||||
|
+server ntp4.vniiftri.ru iburst
|
||||||
|
|
||||||
|
# Record the rate at which the system clock gains/losses time.
|
||||||
|
driftfile /var/lib/chrony/drift
|
||||||
|
diff --git a/examples/chrony.conf.example3 b/examples/chrony.conf.example3
|
||||||
|
index 6d84c01..e893292 100644
|
||||||
|
--- a/examples/chrony.conf.example3
|
||||||
|
+++ b/examples/chrony.conf.example3
|
||||||
|
@@ -25,13 +25,13 @@
|
||||||
|
# Provider or company have one or more NTP servers that you can specify.
|
||||||
|
# Failing that, there are a lot of public NTP servers. There is a list
|
||||||
|
# you can access at http://support.ntp.org/bin/view/Servers/WebHome or
|
||||||
|
-# you can use servers from the pool.ntp.org project.
|
||||||
|
+# you can use servers from the https://www.vniiftri.ru/ project.
|
||||||
|
|
||||||
|
! server ntp1.example.net iburst
|
||||||
|
! server ntp2.example.net iburst
|
||||||
|
! server ntp3.example.net iburst
|
||||||
|
|
||||||
|
-! pool pool.ntp.org iburst
|
||||||
|
+! pool ntp1.vniiftri.ru iburst
|
||||||
|
|
||||||
|
#######################################################################
|
||||||
|
### AVOIDING POTENTIALLY BOGUS CHANGES TO YOUR CLOCK
|
||||||
|
--
|
||||||
|
2.43.5
|
||||||
|
|
||||||
@ -1,16 +0,0 @@
|
|||||||
-----BEGIN PGP SIGNATURE-----
|
|
||||||
|
|
||||||
iQIzBAABCAAdFiEEjzdcfo0O4SWj071RU34rdvdoDawFAmMPLJAACgkQU34rdvdo
|
|
||||||
DaxDKRAAh5wfl990Q6sTPxXI92GegZYIGUxJDlCkJtemoI98g+DQbuCJ46AXsAn/
|
|
||||||
CIBTbPU3Brvq2KR1nDze/G/YOXkaqoFyaJD00H73qBI7MOMiSS4KbMQ26xLNrnHL
|
|
||||||
MCHrgZs+MHhyo6IEpesvr7F/+qyGHZifFlHT+HtCM+SBU1qooYUyQAdnhyK0rb16
|
|
||||||
j7/Jc5A28jROZB4lcRQyvB085whPj299FsB/0wJW5RjwA5tcpPH0sTozain3vvlo
|
|
||||||
64BAJXcQsyRsilcaPFlkY5zPgFiAuaEJnfTe/uMdfDO/V/g6wADt64+HhaxNPO+z
|
|
||||||
p3vzEGpio4Oi1HyYiXpDx9bMM1RLTpmKt9p1V5Y98Fn5Ymx6I7yAe1qwvA7T8eoC
|
|
||||||
hK8C27jPytiOgaWSYqPYb0WaHY3JZZpFzdtr0bAPSkEzL4EwrxVmbgTnkuzk2hxk
|
|
||||||
6MiIuDLUd9Zl1oroqv+rTd0XA8lXUcoyFhqtsMXHWdAC3yzteaPcJKzv7l9DT6xV
|
|
||||||
YadKrSBkzob9jRWRngY3FMKjTvcwnxLE8dfsNlsDNGyLNtTEOJ/QYgh6muOHh80L
|
|
||||||
MAayI8hSWPTR/3IXKlathjLIeilsrFthIZcrPq520FoS4A7E3A80vR3uKOqAIDwh
|
|
||||||
Y+6ASvEkCHAUneJqlLihqglYTNJlFnVhGw9/LV85JsmRsCZ0+j8=
|
|
||||||
=2xMP
|
|
||||||
-----END PGP SIGNATURE-----
|
|
||||||
@ -0,0 +1,16 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQIzBAABCAAdFiEEjzdcfo0O4SWj071RU34rdvdoDawFAmVvJPkACgkQU34rdvdo
|
||||||
|
DawQjw//Zkq4UTPZDpU/gifjUtE/jpIa6+tyhSFpRI5abNScOPaEa8nZz6Q33/s4
|
||||||
|
qiS9RJh1AA13xnal7bIHsixadON01x91ysW1sbNhFx942SwTpk00wDdLmySqW+u5
|
||||||
|
klrTfGlGRejp7ahasbXx/dXqk3Sz+J19YIvdz2X1o2HaUZwp1SIwq5Y8BYS8iE0a
|
||||||
|
G5ov/ail2965hwSoYWNbR7/UuOTEO3YgRk2YSpKKKGJgL27pAzwGlOVwgP9JLAD0
|
||||||
|
WsGDEpn+EY+4BOkwMyFeACOHyJ+QCcpKXF9B6CGJELyPqTp2uQy+OkaF4VtkGvpp
|
||||||
|
wRs6IhMoHFt5NjvCiBhOMvocKd6JrxDxN84gGhSG6OtSFp8GZoFhTxIp//mnZDoz
|
||||||
|
WPl/Z+n3yABdaG7IWavl6tn2wvipMsgcTJHxRYg6A4d2+mKKy0pRyfLUtGTM9EA/
|
||||||
|
NEhTIHVZZLORNK7zPaB8CkFmmsmDQVhowBjXjFcq2HDNzQawbU5gjWUBEH+4R4bq
|
||||||
|
rb4P9Eg3Kus0fvBxj4z72XkzYGNn951YFhwW26x4w09+J35/1eoshNkBaPfOdsRf
|
||||||
|
Xgb37MmEe5yfU32k27aYtERnH9w/+rOk1RISrVcK0c87uz0RnzPN5HBzc4PnEpx6
|
||||||
|
KQFkFxVaaMeJNc0Ca5/u9aE9nli1DIS8Afo/Z4zQtjVMqLsvecQ=
|
||||||
|
=4/yB
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
@ -1,38 +0,0 @@
|
|||||||
diff -up chrony-4.2/examples/chronyd.service.services chrony-4.2/examples/chronyd.service
|
|
||||||
--- chrony-4.2/examples/chronyd.service.services 2021-12-16 13:17:42.000000000 +0100
|
|
||||||
+++ chrony-4.2/examples/chronyd.service 2022-01-19 13:55:59.066677473 +0100
|
|
||||||
@@ -32,8 +32,7 @@ ProtectKernelLogs=yes
|
|
||||||
ProtectKernelModules=yes
|
|
||||||
ProtectKernelTunables=yes
|
|
||||||
ProtectProc=invisible
|
|
||||||
-ProtectSystem=strict
|
|
||||||
-ReadWritePaths=/run /var/lib/chrony -/var/log
|
|
||||||
+ProtectSystem=full
|
|
||||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
||||||
RestrictNamespaces=yes
|
|
||||||
RestrictSUIDSGID=yes
|
|
||||||
@@ -42,7 +41,6 @@ SystemCallFilter=~@cpu-emulation @debug
|
|
||||||
|
|
||||||
# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive)
|
|
||||||
NoNewPrivileges=no
|
|
||||||
-ReadWritePaths=-/var/spool
|
|
||||||
RestrictAddressFamilies=AF_NETLINK
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
|
|
||||||
Avoid a SELinux issue
|
|
||||||
|
|
||||||
diff --git a/examples/chrony-wait.service b/examples/chrony-wait.service
|
|
||||||
index 72b028f2..57646950 100644
|
|
||||||
--- a/examples/chrony-wait.service
|
|
||||||
+++ b/examples/chrony-wait.service
|
|
||||||
@@ -18,7 +18,7 @@ StandardOutput=null
|
|
||||||
|
|
||||||
CapabilityBoundingSet=
|
|
||||||
DevicePolicy=closed
|
|
||||||
-DynamicUser=yes
|
|
||||||
+#DynamicUser=yes
|
|
||||||
IPAddressAllow=localhost
|
|
||||||
IPAddressDeny=any
|
|
||||||
LockPersonality=yes
|
|
||||||
|
|
||||||
@ -0,0 +1,54 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQINBGCc9dwBEADLydyZIqgarshQeCtIlWAgP3coy0mdJwxet1CvXwF1xpq18Qi1
|
||||||
|
Tt9RZL64SkbQ8sKryBqnPjKZdOfVT5FwUucjp9L+/j7Bhk0tqv30EIQ57rnDLJ9T
|
||||||
|
c4LG1leO+Tc5Ym/0tvv4uMjkxr4KAKHPYrweHk6EAw06bbJ02mfy9xhlITSfyyFl
|
||||||
|
QRoRTEjy8N2IDutA4QzbZm0T5kvI7k7s/ILG5vyNo53X5PI/rWrSqmPZ5qs0lvDv
|
||||||
|
tA+rxOJp+FvlvOyBuv3ftIX0kAwRU+x/ET2Yd9qQWnXRx9d9D2UpFXm9DHfCDJYR
|
||||||
|
F56D0O3hf+rrCa/uSutIqmR33j5Wz4bYjWdmg4wbRQaoVxJl5AUrWuYEFwcCuY2B
|
||||||
|
FFgttLPb0qHpeBwuWaWJ9U6HM7qY3WEI2C/OWM0XFM8ERezedNEf7O2GTsoVVcm+
|
||||||
|
LRg31R3eJzipKMAGZWScSDSRAXhh6oZhflMRjYKGvwRfgeos/Sl2bdYL80hqyjGV
|
||||||
|
jMhEYDC9sfLXRyLU+9FexruIzSLR8Vornma3zjzu9pRkbfTHb8FfBMt9MZEWraF2
|
||||||
|
7riRq/zJE9QPWnBL/C8rdaXXxflBmGctn7RDKGOvxZ7SxPzzHbl5tV/Fizhkeph/
|
||||||
|
v8YLVuCOk0pIpX65mFun3Xw5IF01x1GMzU1xYezExti9yBNiv9HVqf1DWwARAQAB
|
||||||
|
tCZNaXJvc2xhdiBMaWNodmFyIDxtbGljaHZhckByZWRoYXQuY29tPokCVAQTAQgA
|
||||||
|
PhYhBI83XH6NDuElo9O9UVN+K3b3aA2sBQJgnPXcAhsDBQkSzAMABQsJCAcCBhUK
|
||||||
|
CQgLAgQWAgMBAh4BAheAAAoJEFN+K3b3aA2sl8IQAJ9AMppV6cdxzt8g2Ypz0hw1
|
||||||
|
6+9T5DjbYE/s0lozFQhCoYfo+SZyc3+yyKzlxI3ryHwFk9NjXGZZ8QjzT7FLj7/s
|
||||||
|
nKDjv5hUCOAi9Q+k217xwlBueeMyheeVaGGGa+Hv5CF1fZx/MtxiShUqu8oSqUyP
|
||||||
|
nW8lPGz73MfGAPT7kijVnz73pbht0vrZ9I+r8dnQGiweGBohexfCvmncrTyhjM8r
|
||||||
|
nvecycYBNnXhupzpmSMZgIA1s2v7oVmTnV0bntxE/gr7+SPk7KozhD12K8OU8deJ
|
||||||
|
cDD8F7NKa9Oe5NtuGVN4IPqp5cgj7GAyIj0sYss9Jknu4jX0imR5kwH6GbgFa7c/
|
||||||
|
kU+fKTz57Rs1OGr3glYpMnNftXSWbC2V/OJxHVEcMk8HwKLgnQjtmKLVGeCo5iS6
|
||||||
|
LFQuWaxpfjvxVjGSpnNu19cHVUhDM9cTP1DhUd4LdnltHQ+/xjwgzTgE4GJ1ZB0W
|
||||||
|
vhvxcdb69Sf50bGd4/WuURRoYSE7M6UKRwfXmMpyTiNhZz+3XjAoScA9AS7q9xfS
|
||||||
|
y3OddQEle/+qNFdABB12WmCgRhWemHzTZDXydIJuw+ucLO7U5RrDdqdaHkRVXJ9G
|
||||||
|
4mdk+3FgUlYgB9GY4pHQdqGdE60838R2zY9x0gK8cHU+FaRPAiTU8SJL0wb/Rko7
|
||||||
|
qbZUY/6bgrDoXp4otAP2iF0EExECAB0WIQSLH0qa2nPUAeMIWgtf8G8puh4BOwUC
|
||||||
|
YJ0C3AAKCRBf8G8puh4BO9k2AJ4ohgz/p49IBfjf22sEL1FvYM/DhwCfTyCkbogO
|
||||||
|
uagIg5qwuEGwHMgn19G5Ag0EYJz13AEQAMrLXgl5u6vAakSF9n+xCP2WOiMHzzrR
|
||||||
|
OxHnWzsX6PTXpJt14LSZOZ5wjdyR3gLJWGLdkfHoxHpQYp7PLgNS29SuAc4HQ+Br
|
||||||
|
O5F4g9EmwDJ0ueUYxU1FcySRXfXR+gLabpQCc2s9bW6RaMwLuQNxZwkfXClkPQms
|
||||||
|
ImTFA0KntWpHc+uEr1J2i6LQS7D/BK6m72l9x8z9k9gqAabXw+xHsis+ffPMG5Jm
|
||||||
|
HOqeHYtsq+2JW1VvBnA4Qh3DKH9OQaD9hZbEiUC3nMmlLkPF/r29tWTPa7luBHBn
|
||||||
|
X556JTXVm+vDUDwZ2srLfaKyQCxbNLwvQ2Pn5SOyyCnuIWR2xZs/+KPDMhtKUBAV
|
||||||
|
HcboVu6iPCTU42CVMPaJvYD2iUEncZNeUGJOSuG240LSLNGEFFsD7YgXb1XHjQD5
|
||||||
|
ci3Ki7P/hHi3AG53IsQTiaE5VgBdDje3zYCf5WaZ6c3DQQB9lab2RMz+5Fdr7Z6Y
|
||||||
|
mFRUbmxSnsMe0mwwcqVe3ofV0fKvE7Ep0T8bBg53dCqyU8hIbD5wUe99JmhMFnzs
|
||||||
|
5elwkv/Hb3Eg92dgu1zWb5kMzuvGEHtCIukIy1B+pzQOfT+iOC+lbmRHhPslJ9S0
|
||||||
|
1vENJE+nEEsGxPy9pRHrmWSKI4Zh+ysjb/vW/vOwAd1RsvxTfgBeOOawmlz+n0pJ
|
||||||
|
T018ZnUgmc35ABEBAAGJAjwEGAEIACYWIQSPN1x+jQ7hJaPTvVFTfit292gNrAUC
|
||||||
|
YJz13AIbDAUJEswDAAAKCRBTfit292gNrPuRD/43kM0P71gxfJQj6PBpPtjIVVfm
|
||||||
|
4TIPWKmV+F4/9eCwAPC/o44Yw+nxGr77Rk2DsaSn0V51j2egRCXKuZBZx/v6JXP7
|
||||||
|
qpDk3Uecml7IfxTd+N+gkI3viUsrt4ykUgyUH/wy/edMG3h9qhBQP0RxiDge18P6
|
||||||
|
YUpQSnq3uP72ycTPLBJlqp/Y9+GXUapvcyDqBFnvs96ieDmSbjSf6tris1cuLv6f
|
||||||
|
eld4HNUY/LmI5MlYbywbgWGpSOyKUlTtyF33LqPnWd7UuTN7QNsYyjGnlJbkkGi/
|
||||||
|
KwuNbIo5Gs4avaUSTc7SBLdCYneEIt7mt7hg0StKHQC6s/ak/w8yl1yFy5gRusO4
|
||||||
|
QCFT2ZMQ6jZUAuaQGx0rhWQr9akNNJEDsHTBQR8pxpFp3LcDXcUXSSeySRSFZLt+
|
||||||
|
hExvDQxXuhdbZHYGL1E6g5gtJQKnobNu2jMOziBcDivhAsqNw2Poq6fJVLavjBI5
|
||||||
|
BI1xAqmymIExJFSlHdLuZq09cVzY3EOj3x23YTzPKNOI/qu4jTUT4Byi8Oy3PN1B
|
||||||
|
B0n5SqORWJ0KfAyVEewshSAqJ7zrZ5sJXWnKeVQqBOg5EwkOB8rz/M3mqgrnBRiq
|
||||||
|
hLiiiG5tKETA1YIQGXIbP8t1vqoQrpvYaJfkk3kQlktxfFkDRt8dKIxpFk8uPiNb
|
||||||
|
bcAu2uXfRrQxpaqcOg==
|
||||||
|
=/wbD
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
Loading…
Reference in new issue