pfSense » pfSense Packages

Chrony is a modern implemention of the Network Time Protocol (NTP), which includes support for Network Time Sercurity (NTS). The pfSense Chrony package provides configuration, control and status for the chrony daemon (chronyd).

In order to bring the Chrony package in, two dependencies will need to be brought in from upstream FreeBSD ports. The dependencies are chrony itself, and gnutls.

For building chrony, my recommended configuration is this:

freebsd-15:/usr/ports/net/chrony # make showconfig
===> The following configuration options are available for chrony-4.8:
     DOCS=off: Build and/or install documentation
     EXAMPLES=off: Build and/or install examples
     HTMLDOCS=off: Build HTML docs (IMPLIES DOCS, needs ruby, asciidoctor)
     NTS=on: Support Network Time Security (NTS, uses GnuTLS & Nettle)
     USER=on: Run as user/group chronyd (unset: user/group ntpd)
====> Support for secure hash functions
     NETTLE=on: Nettle crypto library support for secure hash and NTS
     NSS=off: NSS-based support for more hashing algorithms

In short, I’ve turned off MAN3 and P11KIT which are on by default.

For building gnutls, my recommended configuration is this:

freebsd-15:/usr/ports/net/chrony # make showconfig
===> The following configuration options are available for chrony-4.8:
     DOCS=off: Build and/or install documentation
     EXAMPLES=off: Build and/or install examples
     HTMLDOCS=off: Build HTML docs (IMPLIES DOCS, needs ruby, asciidoctor)
     NTS=on: Support Network Time Security (NTS, uses GnuTLS & Nettle)
     USER=on: Run as user/group chronyd (unset: user/group ntpd)
====> Support for secure hash functions
     NETTLE=on: Nettle crypto library support for secure hash and NTS
     NSS=off: NSS-based support for more hashing algorithms

In short, I’ve turned off DOCS, EXAMPLES, and HTMLDOCS which are on by default. Note also that the user/group used for chrony are not explicitly set, and so default to ntpd/ntpd.

A PR will be up shortly.