Network Time Synchronization

From Kicksecure
Revision as of 07:10, 6 September 2024 by Hans1 (talk | contribs) (Text replacement - "[[image:" to "[[File:")
Jump to navigation Jump to search
A checked versionarchive.org iconarchive.today icon of this page, approvedarchive.org iconarchive.today icon on 6 September 2024, was based on this revision.

A reasonably accurate host clock is required for many general security properties. An inaccurate clock can lead to broken internet connectivity and time related security issues.

Introduction

It is recommended to have a host clock with accuracy of up to ± 30 minutes. Clocks that are days, weeks, months or even years slow or fast can lead to many issues such as connectivity problems with Tor, inability to download operating system upgrades. [1]

Follow the platform-specific recommendations below to avoid Tor connectivity problems and to limit possible adverse security impacts.

All Platforms

If the host clock is more than 1 hour in the past or more than 3 hours in the future, Tor cannot connect. In this case, manually fix the host clock by right-clicking on it, and also check for an empty battery.

  • If using Kicksecure as a host operating system: Reboot. (Easiest.)
  • If using a VM: Then, power off and power on Kicksecure and Tor should be able to reconnect.
  • Due to Block Networking until sdwdate Finishes if Tor failed or took too long to connect, then you need to fix Tor connection first and then restart your sdwdate sudo systemctl restart sdwdate in your VM/Qube.

Easy instructions

Kicksecure in VMs or as a host operating system: It is strongly discouraged to use the pause / suspend / save / hibernate features.

Kicksecure for Qubes VMs: It is strongly discouraged to use the pause feature of Qube Manager, but it is is safe to use the suspend or hibernate feature of dom0.

Advanced instructions

If you are interested in using the pause / suspend / save / hibernate features, please click the expand button for further instructions.

Restart sdwdate

To restart sdwdate.

Start Menu → Applications → System → Time Synchronization Monitor (sdwdate-gui) → restart sdwdate

Or in a terminal. [5]

Click = Copy Copied to clipboard! sudo /usr/lib/sdwdate/restart_fresh

Manually Set Clock Time and Date

Usually not required.

In case sdwdate fails to properly randomize the system clock, it is possible to manually set a random value.

The first step should be completed on the host to ensure the host clock is set to the correct time.

1. On the host (Kicksecure-Qubes: dom0), run the following command to report the time in UTC.

Click = Copy Copied to clipboard! date -u

The output should be similar to the following. [6]

Click = Copy Copied to clipboard! Apr 24 21:15:44 UTC 2025

2. Set the correct time in Kicksecure.

Run the following command with the correct date and time parameters. [7] [8]

  • clock-random-manual-gui: a randomized clock setting (in UTC) is entered via a GUI.
  • clock-random-manual-cli: a randomized clock setting (in UTC) is entered on the command line. For example [9]:

Click = Copy Copied to clipboard! echo "Apr 24 21:15:44 UTC 2025" | sudo clock-random-manual-cli

3. Restart sdwdate.

Click = Copy Copied to clipboard! sudo service sdwdate restart

4. If Tor is still not functional, try restarting Tor.

Click = Copy Copied to clipboard! sudo service tor restart

Tor should work once correct clock values are set, but that can be manually tested with systemcheck.

Block Networking until sdwdate Finishes

sdwdate is a Tor-friendly replacement for rdate and ntpdate that sets the system's clock by communicating via end-to-end encrypted TCP with Tor onion webservers. Since timekeeping is crucial for security, blocking network access until sdwdate succeeds is sensible. [10]

Note: When using this feature, there will be no internet connectivity until sdwdate succeeded which could take approximately 2 minutes.

How to enable this feature? Unsupported. This feature is has not been implemented yet for Kicksecure. Developers are welcome to contribute to Kicksecure.

Summary

Table: Network Time Synchonization Summary

Platform Recommendations
All Platforms
  • Tor cannot connect if the host clock is grossly inaccurate. In this case, users should manually fix the host clock before powering the Kicksecure off and on again.
  • Periodically check the host clock to ensure that it is accurate or approximately so.
  • For greater security, block networking until sdwdate finishes.
Kicksecure
  • It is strongly discouraged to use the pause / suspend / save / hibernate features.
Kicksecure-Qubes
  • It is strongly discouraged to use the pause feature of Qube Manager.
  • it is is safe to use the suspend or hibernate feature of dom0.

Appendix

Deactivate Automatic TimeSync

Warning: This action is recommended against and is usually not required. In all cases, first check with the Kicksecure developers.

To deactivate sdwdate, run.

Click = Copy Copied to clipboard! sudo service sdwdate stop

Click = Copy Copied to clipboard! sudo systemctl mask sdwdate

Related

Footnotes

  1. ↑ Due to invalid (not yet or no longer valid) TLS certificates.
  2. ↑ Similarly, if users suspend or save the Kicksecure state, the clock will again lag behind the correct value. This can be manually fixed by running: Start Menu → Applications → System → Time Synchronization Monitor (sdwdate-gui) → restart sdwdate.
  3. ↑ Qubes does not dispatch the /etc/qubes/suspend-post.d / /etc/qubes/suspend-pre.d hooks upon pause / resume using Qube Manager.
  4. ↑ https://github.com/QubesOS/qubes-issues/issues/1764archive.org iconarchive.today icon
  5. ↑ Simplified in next upgrade. Click = Copy Copied to clipboard! sudo sdwdate-clock-jump
  6. ↑ Click = Copy Copied to clipboard! Mon Apr 22 04:30:44 UTC 2019
  7. ↑ A non-zero exit codes signifies an error, while 0 means it succeeded.
  8. ↑ Also see: Click = Copy Copied to clipboard! man clock-random-manual-gui Click = Copy Copied to clipboard! man clock-random-manual-cli
  9. ↑ Click = Copy Copied to clipboard! echo "Sat Oct 26 07:18:25 UTC 2019" | /usr/bin/clock-random-manual-cli
  10. ↑ https://forums.whonix.org/t/blocking-networking-until-sdwdate-finished/5372archive.org iconarchive.today icon
Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Network_Time_Synchronization&oldid=84592"