Network Time Security
Network Time Security (NTS) is an important security upgrade to the Network Time Protocol (NTP) that most computers use to set their clocks. It eliminates the possibility of security and denial-of-service issues caused by someone remotely tampering with the time on your system.
System76 is proud to offer five NTS-enabled NTP servers that are free to use anywhere in the world.
- virginia.time.system76.com
- ohio.time.system76.com
- oregon.time.system76.com
- paris.time.system76.com
- brazil.time.system76.com
Contact: time@system76.com
Pop!_OS Configuration
NTS is enabled by default starting with Pop!_OS 22.04.
To confirm that you're connected to the System76 servers and using NTS, you can use the following two commands.
chronyc sources -v sudo chronyc authdata -v
Since Pop!_OS is used on a variety of systems, the default configuration disables the time checks of the NTS servers' certificates on the first attempt. This is because the clock may not be accurate after booting on a system without an RTC (real-time clock) - or on a system where the clock has been manually altered. In these cases the certificate validation can fail, leaving no way to get the correct time!
However, some users may want to harden their system so that the certificate activation and expiration times are always validated. This can be done with the following commands.
echo "nocerttimecheck 0" | sudo tee /etc/chrony/conf.d/20-always-check-certs.conf sudo systemctl restart chrony
In this case, if the clock is ever off by a large amount, it will need to be manually restored to a close approximation of the true time before it can sync up again.