RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1211600 - RFE: add support for SRV _ntp._udp resolution
Summary: RFE: add support for SRV _ntp._udp resolution
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: chrony
Version: 7.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Miroslav Lichvar
QA Contact: Robin Hack
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-04-14 12:15 UTC by Jan Pazdziora
Modified: 2020-07-16 08:32 UTC (History)
6 users (show)

Fixed In Version: chrony-2.0-1.el7
Doc Type: Enhancement
Doc Text:
Clone Of:
: 1234406 (view as bug list)
Environment:
Last Closed: 2015-11-19 08:30:10 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2241 0 normal SHIPPED_LIVE Moderate: chrony security, bug fix, and enhancement update 2015-11-19 08:59:36 UTC

Description Jan Pazdziora 2015-04-14 12:15:42 UTC 
Description of problem:

When chrony is configured, it is possible to specify list of server entries that the daemon should use.

It'd be nice if the daemon could be configured to (also) consult DNS, using the _ntp._udp SRV records.

Ideally, adding something like

   server _srv_

would do the DNS query during startup and insert the list of addresses to the server list, and then rerun the DNS query from time to time (after TTL expires, possible with low and high limits that could be configured) and update the list of servers with the new list.

Version-Release number of selected component (if applicable):

chrony-1.29.1-1.el7.x86_64

How reproducible:

Deterministic.

Steps to Reproduce:
1. Attempt to configure chrony do only use SRV records for its server list, or to also include servers as identified by SRV records in its server list.

Actual results:

Currently not possible.

Expected results:

It is possible.

Additional info:

The actual use case is ipa-client-install which enables ntpd (will do chronyd in the future) and does the initial NTP sync using SRV records. It would be nice if it could then also configure chrony to continue using SRV records.

It does not matter much if the resolution of the SRV records is done by the daemon server or some external helper (cron job), just that the changes in DNS get propagated.
Comment 1 Jan Pazdziora 2015-04-14 12:18:08 UTC 
RFE to configure chrony instead of ntpd by ipa-client-install is tracked in bug 1206608.
Comment 3 Miroslav Lichvar 2015-06-12 14:35:03 UTC 
I think we can add this functionality to the chrony-helper script. It could use the dig DNS lookup utility to obtain the SRV records and add them to the running chronyd process with chronyc, similarly to how DHCP servers are currently handled. The script could be called periodically from a templated systemd timer unit to update the servers when the SRV record changes.

The user (or the ipa install script) would enable it with

systemctl enable chrony-dnssrv.timer
Comment 5 Miroslav Lichvar 2015-06-18 12:44:31 UTC 
The chrony-helper script was extended to allow using servers from DNS SRV records. The dig utility is used to make DNS lookups and periodic updates are implemented with systemd timers. The systemctl calls that enable/disable them are wrapped in chrony-helper to make it easier to use and not break compatibility with scripts in case the SRV lookup functionality will be implemented in chronyd some day.

Example of use:

# chronyc -n sources
210 Number of sources = 0
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================

# /usr/libexec/chrony-helper enable-dnssrv _ntp._udp.example.com
Created symlink from /etc/systemd/system/timers.target.wants/chrony-dnssrv.example.com.timer to /usr/lib/systemd/system/chrony-dnssrv@.timer.

# /usr/libexec/chrony-helper list-dnssrv
_ntp._udp.example.com

# chronyc -n sources
210 Number of sources = 3
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^? 192.168.100.3                 0   7     0   10y     +0ns[   +0ns] +/-    0ns
^? 192.168.100.2                 0   7     0   10y     +0ns[   +0ns] +/-    0ns
^? 192.168.100.1                 0   7     0   10y     +0ns[   +0ns] +/-    0ns

# /usr/libexec/chrony-helper disable-dnssrv _ntp._udp.example.com
Removed symlink /etc/systemd/system/timers.target.wants/chrony-dnssrv.example.com.timer.

# chronyc -n sources
210 Number of sources = 0
MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================

# /usr/libexec/chrony-helper list-dnssrv

#
Comment 9 errata-xmlrpc 2015-11-19 08:30:10 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2241.html
Note You need to log in before you can comment on or make changes to this bug.