[time-admin] ntp server selection should not suggest stratum 1 servers

[Xavier Robin]

Binary package hint: gnome-system-tools

In the Time and Date configuration window (documented on <https://help.ubuntu.com/community/UbuntuTime>), the servers suggested in the Time server window is inadequate.

Many of the servers suggested are stratum 1 servers (for servers around Switzerland for instance I found out ntps1-0.cs.tu-berlin.de, ntps1-1.cs.tu-berlin.de, ntps1-2.uni-erlangen.de, canon.inria.fr, chronos.cru.fr, ntp.cesnet.cz, time.ien.it, ntp0.nl.net and ntp1.nl.net to be stratum 1).

Stratum 1 servers are servers directly connected to a reference clock. Stratum 1 time servers should be used only by stratum 2 time servers (serving a large number of clients and / or stratum 3 servers). Stratum 1 servers should not be used by terminal clients (see <http://support.ntp.org/bin/view/Servers/RulesOfEngagement>) and should not be advertised in the server selection window. Failing to do so will increase stratum 1 servers load and consequently reduce their availability, reducing the accuracy of the whole system.

Stratum 1 servers should be detected, removed from this selection window, and replaced by stratum 2 (or even 3) servers which are good enough for most cases. Ideally the NTP pool should be used (see bug #104525).

[Milan Bouchet-Valat (nalimilan)]

Thanks for raising this issue, but as I understand it, the only right way to solve this is to fix bug 104525. As a temporary improvement, we can simply remove Stratum 1 (and possibly 3) from our list, but how many servers would be left? We should definitely be using a custom NTP pool and leave the list empty by default.

If you want this fix to happen, please get the file from [1], remove servers you think should not be present, and attach it here. I'll take care of committing this upstream. Else, I don't think there's a chance somebody will work on it... And if you want to spend your time on even more useful tasks, I guess you should contact pool.ntp.org so that they set up a GNOME or Ubuntu pool, and then we can use this as the default, after asking the security team. ;-)

BTW, I'm setting the importance to Low because by default, the bug doesn't happen, and I don't think many people play with their NTP servers without knowing the name of a correct server they want to use.

1: http://git.gnome.org/browse/gnome-system-tools/plain/src/time/ntp-servers-list.c

[Xavier Robin (jti-533g)]

Thanks for this quick answer.
Here is the modified file.

I found the following 20 servers to be stratum 1 (with ntpdate -q and a perl regex):
ntp1.arnes.si
ntp2.arnes.si
ntp.cesnet.cz
ntps1-0.cs.tu-berlin.de
ntps1-1.cs.tu-berlin.de
ntps1-2.uni-erlangen.de
canon.inria.fr
chronos.cru.fr
clock.cuhk.edu.hk
time.ien.it
cronos.cenam.mx
ntp0.nl.net
ntp1.nl.net
ntp2.nl.net
ntp.certum.pl
vega.cbk.poznan.pl
time1.stupi.se
goodtime.ijs.si
ntp2.ja.net
laikas.pfi.lt

This is unrelated but the following servers were unreachable (ntpdate returns "no server suitable for synchronization found"):
wuarchive.wustl.edu
gilbreth.ecn.purdue.edu
molecule.ecn.purdue.edu
bernina.ethz.ch
time.esec.com.au
ntpa2.kph.uni-mainz.de

[Milan Bouchet-Valat (nalimilan)]

I've committed both changes (stratum 1 and unreachable servers) upstream. Thanks for the help! Of course, the proper fix would be creating a pool, but better fix this in the short term.

Commits are 0fef206 and 8e01e05.