Implement Network Time Security (NTS) for encrypted time synchronization with chrony

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
CHRONY_USER="chrony"
NTS_DIR="/var/lib/chrony/nts"
LOG_DIR="/var/log/chrony"
CERT_DAYS=365

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Cleanup function for rollback
cleanup() {
    if [ $? -ne 0 ]; then
        print_error "Installation failed. Rolling back changes..."
        systemctl stop chrony 2>/dev/null || true
        systemctl disable chrony 2>/dev/null || true
        rm -f /etc/chrony/chrony.conf.backup 2>/dev/null || true
        rm -f /etc/chrony.conf.backup 2>/dev/null || true
    fi
}

trap cleanup ERR

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Install and configure Network Time Security (NTS) with chrony"
    echo ""
    echo "Options:"
    echo "  --server-mode    Configure as NTS server (default: client only)"
    echo "  --hostname FQDN  Override hostname for certificate generation"
    echo "  --help          Show this help message"
    exit 1
}

# Parse arguments
SERVER_MODE=false
HOSTNAME=$(hostname -f)

while [[ $# -gt 0 ]]; do
    case $1 in
        --server-mode)
            SERVER_MODE=true
            shift
            ;;
        --hostname)
            HOSTNAME="$2"
            shift 2
            ;;
        --help)
            usage
            ;;
        *)
            print_error "Unknown option: $1"
            usage
            ;;
    esac
done

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    print_error "This script must be run as root or with sudo"
    exit 1
fi

# Detect distribution and package manager
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            CHRONY_CONF="/etc/chrony/chrony.conf"
            GNUTLS_PKG="gnutls-bin"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            CHRONY_CONF="/etc/chrony.conf"
            GNUTLS_PKG="gnutls-utils"
            FIREWALL_CMD="firewall-cmd"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            CHRONY_CONF="/etc/chrony.conf"
            GNUTLS_PKG="gnutls-utils"
            FIREWALL_CMD="firewall-cmd"
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    print_error "Cannot detect distribution. /etc/os-release not found."
    exit 1
fi

print_status "Installing NTS-enabled chrony on $PRETTY_NAME"

# Step 1: Update system packages
echo "[1/8] Updating system packages..."
$PKG_UPDATE

# Step 2: Install chrony and dependencies
echo "[2/8] Installing chrony with NTS support..."
$PKG_INSTALL chrony $GNUTLS_PKG openssl

# Step 3: Stop chrony service
echo "[3/8] Stopping chrony service..."
systemctl stop chrony

# Step 4: Create NTS directories
echo "[4/8] Creating NTS directories..."
mkdir -p "$NTS_DIR"
mkdir -p "$LOG_DIR"
chown $CHRONY_USER:$CHRONY_USER "$NTS_DIR"
chown $CHRONY_USER:$CHRONY_USER "$LOG_DIR"
chmod 750 "$NTS_DIR"
chmod 755 "$LOG_DIR"

# Step 5: Backup existing configuration
echo "[5/8] Configuring chrony..."
if [ -f "$CHRONY_CONF" ]; then
    cp "$CHRONY_CONF" "${CHRONY_CONF}.backup"
fi

# Create new chrony configuration
cat > "$CHRONY_CONF" << EOF
# NTS-enabled time servers
server time.cloudflare.com iburst nts
server nts.netnod.se iburst nts
server ptbtime1.ptb.de iburst nts
server nts.time.nl iburst nts

# Fallback to standard NTP if NTS fails
pool 2.pool.ntp.org iburst

# Record the rate at which the system clock gains/loses time
driftfile /var/lib/chrony/drift

# Allow the system clock to be stepped in the first three updates
makestep 1.0 3

# Enable kernel synchronization of the real-time clock (RTC)
rtcsync

# NTS key and certificate storage
ntsdumpdir $NTS_DIR

# Enhanced logging
log tracking measurements statistics
logdir $LOG_DIR

# Security settings
user $CHRONY_USER
lock_all
EOF

# Add server configuration if requested
if [ "$SERVER_MODE" = true ]; then
    echo "[6/8] Generating NTS server certificates..."
    openssl req -x509 -newkey rsa:4096 -keyout "$NTS_DIR/server.key" -out "$NTS_DIR/server.crt" \
        -days $CERT_DAYS -nodes -subj "/C=US/ST=State/L=City/O=Organization/CN=$HOSTNAME"
    
    chown $CHRONY_USER:$CHRONY_USER "$NTS_DIR/server.key" "$NTS_DIR/server.crt"
    chmod 600 "$NTS_DIR/server.key"
    chmod 644 "$NTS_DIR/server.crt"

    # Add server configuration to chrony.conf
    cat >> "$CHRONY_CONF" << EOF

# NTS server configuration
ntsservercert $NTS_DIR/server.crt
ntsserverkey $NTS_DIR/server.key
ntsport 4460
ntstrustedcerts $NTS_DIR
ntsprocesses 4
ntsrotate 86400

# Allow specific subnets to query time
allow 192.168.0.0/16
allow 10.0.0.0/8
allow 172.16.0.0/12
EOF
else
    echo "[6/8] Skipping server certificate generation (client mode)..."
fi

# Step 7: Configure firewall
echo "[7/8] Configuring firewall..."
if [ "$FIREWALL_CMD" = "ufw" ]; then
    if command -v ufw >/dev/null 2>&1; then
        ufw allow 123/udp comment 'NTP' || true
        if [ "$SERVER_MODE" = true ]; then
            ufw allow 4460/tcp comment 'NTS-KE' || true
        fi
        ufw reload || true
    fi
elif [ "$FIREWALL_CMD" = "firewall-cmd" ]; then
    if command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
        firewall-cmd --permanent --add-port=123/udp || true
        if [ "$SERVER_MODE" = true ]; then
            firewall-cmd --permanent --add-port=4460/tcp || true
        fi
        firewall-cmd --reload || true
    fi
fi

# Step 8: Start and enable chrony
echo "[8/8] Starting chrony service..."
systemctl enable chrony
systemctl start chrony

# Wait a moment for service to start
sleep 3

# Verification
print_status "Verifying NTS configuration..."
if systemctl is-active --quiet chrony; then
    print_status "✓ Chrony service is running"
else
    print_error "✗ Chrony service failed to start"
    exit 1
fi

# Check NTS sources
sleep 5
if chrony sources 2>/dev/null | grep -q "^[\*\+].*NTS"; then
    print_status "✓ NTS sources are active"
elif chrony sources 2>/dev/null | grep -q "NTS"; then
    print_warning "NTS sources configured but not yet synchronized (this may take a few minutes)"
else
    print_warning "NTS sources not detected in output"
fi

# Display status
print_status "NTS installation completed successfully!"
print_status "Configuration file: $CHRONY_CONF"
print_status "NTS directory: $NTS_DIR"
print_status "Log directory: $LOG_DIR"

if [ "$SERVER_MODE" = true ]; then
    print_status "Server mode enabled - NTS-KE available on port 4460"
fi

print_status "Use 'chronyc sources -v' to check time sources"
print_status "Use 'chronyc authdata' to verify NTS authentication"