chronyc sources fails

[clustervision]

chronyc sources fails

It's a bug in firewalld that appears when masquerading is enabled.

Description:
https://bugzilla.redhat.com/show_bug.cgi?id=904098
https://bugzilla.redhat.com/show_bug.cgi?id=1326130

Workaround:
Disable masquerading on the controller. Comment out this line:
FWD_NAT_PUBLIC=1

Long-term fix:
The package included in RHEL7 has the bug, I will try to ship an updated one in the local repo for the time being.

I couldn't find a prebuilt update for CentOS 7. Firewalld is integrated with systemd and dbus, and I end up very quickly with conflicts.

Down the line I may end up rebuilding one, because this is one annoying issue. For now I disabled NAT by default and added a warning message in the config file.

[dchirikov]

Can we just drop chrony and instal old well known ntpd?

On Aug 12, 2016 3:18 PM, "jflf-CV" [email protected] wrote:

I couldn't find a prebuilt update for CentOS 7. Firewalld is integrated
with systemd and dbus, and I end up very quickly with conflicts.

Down the line I may end up rebuilding one, because this is one annoying
issue. For now I disabled NAT by default and added a warning message in the
config file.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#51 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AFvTCL7sKlFgv9bU_HSszBv41UM_1Lv0ks5qfHIigaJpZM4Ji1Nb
.

The problem is not with chrony, but with firewalld.

[dchirikov]

Yes, my concer is: crony is exotic, we won't encounter this bug if switch
to ntpd. What are the drawbacks?

On Aug 12, 2016 5:49 PM, "jflf-CV" [email protected] wrote:

The problem is not with chrony, but with firewalld.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#51 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AFvTCBMIh2OTRPp-jMDzMM7T_o1FHk-uks5qfJXxgaJpZM4Ji1Nb
.

I don't think that chrony is exotic anymore, as it has been picked up by RedHat by default and is now in all its derivatives. There have been conversations on the mailing lists about the merits of both, and they took the decision to move to chrony. So that part is done and out of our control.

Again, that problem is not with chrony. Chrony is the first software impacted by the firewalld bug that we saw, but it doesn't even prevent it from working properly, it's only affecting the CLI tool. That's not enough to throw out chrony entirely.

Now, once I'll figure out a way to work around the bug with firewalld, the chrony issue will disappear entirely. That is the real goal, not getting rid of chrony and then hitting the bug again with another piece of software.

[sibomarie]

no longer an issue in 2e7d1e9