Change:
<ins> From 7a27556920fe1feefd17096841c8f3ca1294a1b3 Mon Sep 17 00:00:00 2001 From: Yuri Nesterov <yuriy.nesterov@unikie.com> Date: Wed, 21 Jun 2023 17:17:38 +0300 Subject: [PATCH] timesyncd: disable NSCD when DNSSEC validation is disabled Systemd-timesyncd sets SYSTEMD_NSS_RESOLVE_VALIDATE=0 in the unit file to disable DNSSEC validation but it doesn't work when NSCD is used in the system. This patch disabes NSCD in systemd-timesyncd when SYSTEMD_NSS_RESOLVE_VALIDATE is set to 0 so that it uses NSS libraries directly. --- src/timesync/timesyncd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c index 1d8ebecc91..2b0ae361ff 100644 --- a/src/timesync/timesyncd.c +++ b/src/timesync/timesyncd.c @@ -21,6 +21,11 @@ #include "timesyncd-conf.h" #include "timesyncd-manager.h" #include "user-util.h" +#include "env-util.h" + +struct traced_file; +extern void __nss_disable_nscd(void (*)(size_t, struct traced_file *)); +static void register_traced_file(size_t dbidx, struct traced_file *finfo) {} static int advance_tstamp(int fd, const struct stat *st) { assert_se(fd >= 0); @@ -198,6 +203,12 @@ static int run(int argc, char *argv[]) { if (r < 0) return log_error_errno(r, "Failed to parse fallback server strings: %m"); +        r = getenv_bool_secure("SYSTEMD_NSS_RESOLVE_VALIDATE"); +        if (r == 0) { +                log_info("Disabling NSCD because DNSSEC validation is turned off"); +                __nss_disable_nscd(register_traced_file); +        } + log_debug("systemd-timesyncd running as pid " PID_FMT, getpid_cached()); notify_message = notify_start("READY=1n" -- 2.34.1 </ins>

Discussion:
I'm bringing up new RPis and their clocks are often wrong. Even though upstream systemd has given exceptions to be able to skip dnssec check for ntp sync, it doesn't... appear to be working. If I set the date manually, often by time I check timesyncd will have already taken care of kicking in and it reports that it's synced. Steps to reproduce the behavior: the clock badly. . and see if your DNS works
If I read it right, only works for systemd-resolved. One general workaround is to use hard-coded IP addresses for NTP (our routers actually do that IIRC).
That commit seems to indicate that it should bypass DNSSEC for timesyncd. This would get my clock back in sync, thus resolving DNSSEC errors for the rest of the system. But timesyncd isn't doing its job. I assume that's because: date wrong -dnssec failure. But maybe also fails if the clock is just too askew? I'll try to look more later, maybe I have to opt-in large corrections? Seems a bit weird to me. Or do we maybe use timesyncd in a non-standard way?
I ran into this on a Raspberry Pi 3B. I'm using systemd-networkd including systemd-resolved. At some point DNS started failing, and I noticed the system clock was out of sync by about 4 hours and not synchronizing anymore. The log of systemd-resolved was full of DNSSEC s: I'm not sure what changed, because I was able to install NixOS just fine. It also was offline before for some time without this problem happening (as far as I noticed at least), and it started happening after it was online for some time without break. Also, the systemd-native workaround should be working on NixOS as well, I can't find anything that indicates a non-standard setup that might overwrite tha workaround. Checking is the standard original systemd unit file that includes the relevant line and as far as I can see it isn't overridden. I also checked and it includes . For now, I worked around the issue by specifying my NTP servers by IP (I used the ones by the ).
Closing as this should be fixed by Please reopen if this is still an issue.