How to Use the ntsCheck.sh Script to Test NTS Server Availability

The ntsCheck.sh script is a lightweight wrapper around chronyd that validates Network Time Security (NTS) server connectivity without modifying your system clock.

The jauderho/nts-servers repository provides the ntsCheck.sh utility to help administrators and contributors verify that NTS servers are reachable and responding correctly. This bash script located at scripts/ntsCheck.sh performs non-invasive availability tests using chronyd's query mode.

What Is ntsCheck.sh?

ntsCheck.sh is a diagnostic tool designed to test NTS server availability through a single command. Unlike full NTP client configurations, this script performs a one-time check that leaves your local time settings untouched.

How the Script Works

The implementation in scripts/ntsCheck.sh follows a three-step validation process:

1. Argument validation (lines 7-10): The script verifies that a server hostname or IP address is provided. If missing, it prints usage instructions and exits with status 1.

2. Variable assignment (line 13): The first positional argument is stored in the NTS_SERVER variable for use in the chronyd command.

3. Chronyd query (line 16): The script executes chronyd -Q -t 5 "server $NTS_SERVER iburst nts maxsamples 1", which:

   • Uses -Q flag for query mode (no clock adjustment)
   • Sets a 5-second timeout with -t 5
   • Requests NTS encryption via the nts keyword
   • Sends an initial burst with iburst for faster response
   • Limits to one sample with maxsamples 1

How to Use ntsCheck.sh to Test Server Availability

Prerequisites

Before running the script, ensure chronyd is installed on your system. The script relies on the chronyd binary being available in your system PATH, typically located at /usr/sbin/chronyd on Linux distributions.

Basic Usage

Execute the script from the repository root with the target server as the first argument:

./scripts/ntsCheck.sh time.cloudflare.com

For IPv6 addresses, enclose the address in quotes to prevent shell interpretation issues:

./scripts/ntsCheck.sh "2001:4860:1::68"

Interpreting Results

The script uses exit codes to indicate success or failure, making it ideal for automation and CI/CD pipelines:

• Exit code 0: The server responded successfully to the NTS query
• Exit code 1: The server failed to respond or NTS negotiation failed

Check the exit code immediately after execution:

./scripts/ntsCheck.sh time.cloudflare.com
echo $?

A successful test produces no output (chronyd runs in quiet mode), while failures display chronyd error messages such as no response or TLS handshake failures.

Common Use Cases

Pre-Submission Validation

The jauderho/nts-servers repository requires contributors to verify new server entries before submitting pull requests. According to the README.md usage guidelines, running ntsCheck.sh against proposed servers ensures they support NTS and are reachable from diverse network locations.

Troubleshooting Network Connectivity

System administrators use this script to diagnose NTS-specific issues without modifying production NTP configurations. The isolated test determines whether connectivity problems stem from NTS certificate issues, firewall rules, or general network unreachability.

Summary

• The ntsCheck.sh script provides a safe, non-invasive method to test NTS server availability using chronyd's query mode.
• Located at scripts/ntsCheck.sh in the jauderho/nts-servers repository, it validates servers through a 5-second timeout query that requests NTS encryption.
• The script exits with code 0 for responsive servers and code 1 for failures, making it suitable for both manual verification and automated CI/CD testing.
• Contributors must use this tool to validate servers before submitting pull requests to the repository.

Frequently Asked Questions

What does the ntsCheck.sh script do?

The ntsCheck.sh script tests whether a Network Time Security (NTS) server is reachable and properly responding to NTS queries. It wraps the chronyd command to perform a one-time connectivity check without modifying your system's clock or NTP configuration.

Do I need root privileges to run ntsCheck.sh?

No, root privileges are not required to run ntsCheck.sh because it uses chronyd's query mode (-Q flag), which does not adjust the system clock. However, you need read permissions on the script and the chronyd binary must be executable by your user account.

What does exit code 0 mean in ntsCheck.sh?

Exit code 0 indicates that the NTS server responded successfully to the query and supports NTS encryption as requested. Any non-zero exit code indicates failure, which could mean network unreachability, NTS protocol errors, TLS certificate issues, or timeout after 5 seconds.

Can I test IPv6 servers with ntsCheck.sh?

Yes, ntsCheck.sh supports IPv6 addresses. When passing an IPv6 address as an argument, enclose it in quotes to prevent the shell from interpreting the colons, for example: ./scripts/ntsCheck.sh "2001:4860:1::68".

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}