openstack/ansible-hardening
Code Issues Proposed changes

Chrony: new NTP server defaults

Browse Source 
This patch drops the offline option because this role usually
applies to always-on machines and the subsystem which detects
if you're online or offline seems to be largely unstable which
causes chronyd to never attempt to synchronize time.

It also drops the minpoll and maxpoll options to leave it to
the defaults of the chronyd service, this is due to the numbers
provided not allowing the system to properly sync up time.

It also adds the 'iburst' option which will send a few quick
bursts when the system first goes up in order to get it to sync
up with time faster.

Change-Id: Iad41ef505f5a1c142ec7ffe07e4a1c08aa614235
This commit is contained in:
Jakob Englisch 2019-01-10 00:12:42 +01:00 committed by Jesse Pretorius
parent 06f05b2984
commit 7473a45d98
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
defaults/main.yml
View File

@ -271,7 +271,7 @@ security_ntp_servers:
- 2.pool.ntp.org
- 3.pool.ntp.org
# NTP server options.
security_ntp_server_options: offline maxpoll 10 minpoll 8
security_ntp_server_options: iburst
# Configure Chrony to synchronize the hardware clock
security_ntp_sync_rtc: false
# Chrony limits access to clients that are on certain subnets. Adjust the

6
releasenotes/notes/chrony-ntp-server-defaults-7cd2e3a80723e0bd.yaml Normal file
View File

@ -0,0 +1,6 @@
---
upgrade:
- Changed the default NTP server options in ``chrony.conf``. The ``offline``
option has been removed, ``minpoll``/``maxpoll`` have been removed in favour of
the upstream defaults, while the ``iburst`` option was added to speed up
initial time synchronization.