How to Verify NTS Server Connectivity Using chronyd: A Complete Guide

Use chronyd -Q with the -t 5 timeout and maxsamples 1 parameters to test NTS connectivity without modifying your system configuration, leveraging the helper scripts in the jauderho/nts-servers repository for single or bulk verification.

The jauderho/nts-servers repository maintains a curated list of Network Time Security (NTS) servers and provides automated tooling to verify their connectivity. Whether you are validating a single server or auditing the entire fleet listed in nts-sources.yml, you can verify NTS server connectivity using chronyd without altering your running daemon.

Understanding the chronyd Query Mode

The chronyd daemon includes a query mode (-Q) specifically designed for one-off time checks and server validation. This mode operates independently of the background service, making it ideal for testing new NTS servers before adding them to your production chrony.conf configuration.

Key parameters for NTS verification:

• -Q: Query mode (exits after checking time, doesn't update the system clock or daemon state)
• -t 5: Sets a 5-second timeout to prevent hanging on unresponsive hosts
• iburst: Sends a burst of packets on startup for rapid synchronization
• nts: Explicitly requests NTS (TLS-encrypted NTP) authentication
• maxsamples 1: Limits the check to a single measurement for quick validation

When this command returns exit code 0, the server successfully responded to an NTS request. Any non-zero exit code indicates a connectivity, certificate, or protocol error.

Verifying a Single NTS Server

For quick validation of individual hosts, the repository provides scripts/ntsCheck.sh. This lightweight bash wrapper executes the chronyd query with appropriate timeouts and error handling.

In scripts/ntsCheck.sh at line 15, the script constructs and executes the verification command:

./scripts/ntsCheck.sh time.cloudflare.com

Behind the scenes, this invokes:

chronyd -Q -t 5 "server time.cloudflare.com iburst nts maxsamples 1"

The script outputs the chronyd response directly, allowing you to inspect the NTS handshake details. If the server fails to respond or lacks proper NTS support, the script exits with the corresponding error code from chronyd.

Bulk Verification of NTS Servers

When auditing multiple servers—such as the complete list maintained in nts-sources.yml—use scripts/verifyNTSServers.py. This Python utility reads the YAML source file, extracts hostnames (stripping any Markdown formatting), and runs the chronyd verification command against each entry.

Located at lines 22-31 in scripts/verifyNTSServers.py, the core logic iterates through the server list:

./scripts/verifyNTSServers.py nts-sources.yml

Typical output shows the status for each host:

Verifying time.cloudflare.com ... Good
[chronyd output...]

Verifying nts.teambelgium.net ... Good
[chronyd output...]

Verifying a.st1.ntp.br ... Failed
Error verifying a.st1.ntp.br: Command '['chronyd', '-Q', '-t', '5', "server a.st1.ntp.br iburst nts maxsamples 1"']' returned non-zero exit status 1.

This bulk approach ensures that only reachable, properly configured NTS servers are included in pull requests before they are merged into chrony.conf.

Manual Command Line Verification

You can run the verification directly without helper scripts. This is useful for ad-hoc testing or integration into custom CI pipelines:

chronyd -Q -t 5 "server nts.teambelgium.net iburst nts maxsamples 1"

The quoted server string must include the nts flag to trigger TLS authentication. Omitting this flag tests standard NTP connectivity only, which will fail to validate the server's NTS capabilities.

Interpreting chronyd Exit Codes

Understanding chronyd's exit status is critical for automated verification:

• Exit 0: The server responded with a valid NTS packet and the time offset was successfully measured
• Exit 1: General failure—could indicate DNS resolution issues, connection timeouts, certificate validation failures, or lack of NTS support on the remote host
• Exit 2: System error (rare in query mode, typically indicates chronyd binary issues)

Both ntsCheck.sh and verifyNTSServers.py rely on these exit codes to determine "Good" versus "Failed" status, making them suitable for pre-commit hooks or GitHub Actions workflows that validate nts-sources.yml updates.

Summary

• chronyd -Q provides a safe, non-destructive method to verify NTS server connectivity without modifying running daemon configurations
• scripts/ntsCheck.sh offers a convenient wrapper for single-host validation using a 5-second timeout and single-sample measurement
• scripts/verifyNTSServers.py enables batch testing of all entries in nts-sources.yml, extracting hostnames and reporting individual pass/fail status
• Successful verification requires the nts parameter in the server string to ensure TLS-encrypted authentication is tested
• Exit code 0 confirms proper NTS protocol support; non-zero codes indicate connectivity or security handshake failures

Frequently Asked Questions

What is the difference between chronyd -Q and chronyc for testing NTS servers?

chronyd -Q is a standalone query mode that exits immediately after checking the time, making it perfect for scripting and CI validation. chronyc is an interactive control tool for managing a running chronyd instance. For verifying NTS server connectivity without affecting your system's time synchronization, chronyd -Q is the appropriate choice as it operates independently of any background daemon.

Can I use these verification scripts on servers not listed in nts-sources.yml?

Yes. While verifyNTSServers.py specifically processes the YAML file format used by jauderho/nts-servers, you can use ntsCheck.sh with any valid NTS hostname. For custom bulk testing, you can also adapt the Python script or create a simple loop that runs the chronyd -Q -t 5 "server <HOST> iburst nts maxsamples 1" command against your own server list.

Why does my NTS verification fail with exit code 1 even though the server responds to regular NTP?

Exit code 1 typically indicates the server lacks proper NTS support or certificate configuration. Common causes include missing NTS-KE (Network Time Security Key Establishment) service on port 4460, expired TLS certificates, or the server not advertising NTS capabilities. Ensure the remote host explicitly supports NTS and that your local chronyd binary was compiled with TLS support enabled.

How long should I set the timeout when verifying NTS servers?

The repository scripts use -t 5 (5 seconds) as a reasonable default for quick validation. NTS handshakes involve TLS negotiation, which requires more time than standard NTP. If testing servers with high latency or slow certificate chains, you may increase this to 10-15 seconds, but for automated bulk verification, 5 seconds balances thoroughness with execution speed.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}