ntp & ntpsec headless installation issues in Debian 11 (bullseye)

Jaikumar Sharma

unread,

Mar 22, 2022, 4:20:04 AM3/22/22

to

Hi,

We are using ntp for a long time in our product, everything was fine
till Debian 10 but starting from Debian 11 - it does not allow me to
install ntp or ntpsec in headless way (same behaviour for both).

Excerpts of log from /var/log/installer/syslog:
-----------------------------------------------

Mar 22 07:35:57 in-target: Building dependency tree...
Mar 22 07:35:57 in-target: Reading state information...
Mar 22 07:35:57 in-target:
Mar 22 07:35:57 in-target: The following additional packages will be
installed:
Mar 22 07:35:57 in-target: ntpsec ntpsec-ntpdate python3-ntp
Mar 22 07:35:57 in-target: Suggested packages:
Mar 22 07:35:57 in-target: certbot ntpsec-doc ntpsec-ntpviz
Mar 22 07:35:57 in-target: The following packages will be REMOVED:
Mar 22 07:35:57 in-target: systemd-timesyncd
Mar 22 07:35:57 in-target: The following NEW packages will be installed:
Mar 22 07:35:57 in-target: meta-ntp-install ntpsec ntpsec-ntpdate
python3-ntp
Mar 22 07:35:57 in-target: 0 upgraded, 4 newly installed, 1 to remove
and 0 not upgraded.
Mar 22 07:35:57 in-target: E: Packages need to be removed but remove is
disabled.
----------------------------------------------------------------------

If try to install it manually it gets installed but systemd-timesyncd
seems to have strange behaviour, it is marked to be removed, console log
of manual installation is below:
---------------------------------------------------------------------

vi100@myserver:~$ sudo apt-get install ntpsec ntpsec-ntpdate
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
python3-ntp
Suggested packages:
certbot ntpsec-doc ntpsec-ntpviz
The following packages will be REMOVED:
systemd-timesyncd
The following NEW packages will be installed:
ntpsec ntpsec-ntpdate python3-ntp
0 upgraded, 3 newly installed, 1 to remove and 0 not upgraded.
Need to get 465 kB of archives.
After this operation, 1,155 kB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://deb.debian.org/debian bullseye/main amd64 python3-ntp amd64
1.2.0+dfsg1-4 [89.1 kB]
Get:2 http://deb.debian.org/debian bullseye/main amd64 ntpsec amd64
1.2.0+dfsg1-4 [337 kB]
Get:3 http://deb.debian.org/debian bullseye/main amd64 ntpsec-ntpdate
amd64 1.2.0+dfsg1-4 [38.8 kB]
Fetched 465 kB in 2s (298 kB/s)
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog
based frontend cannot be used. at
/usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 78, <> 3.)
debconf: falling back to frontend: Readline
(Reading database ... 46182 files and directories currently installed.)
Removing systemd-timesyncd (250.4-1~bpo11+1~tfn11+1) ...
Selecting previously unselected package python3-ntp.
(Reading database ... 46167 files and directories currently installed.)
Preparing to unpack .../python3-ntp_1.2.0+dfsg1-4_amd64.deb ...
Unpacking python3-ntp (1.2.0+dfsg1-4) ...
Selecting previously unselected package ntpsec.
Preparing to unpack .../ntpsec_1.2.0+dfsg1-4_amd64.deb ...
Unpacking ntpsec (1.2.0+dfsg1-4) ...
Selecting previously unselected package ntpsec-ntpdate.
Preparing to unpack .../ntpsec-ntpdate_1.2.0+dfsg1-4_amd64.deb ...
Unpacking ntpsec-ntpdate (1.2.0+dfsg1-4) ...
Setting up python3-ntp (1.2.0+dfsg1-4) ...
Setting up ntpsec (1.2.0+dfsg1-4) ...
Created symlink /etc/systemd/system/timers.target.wants/ntpsec-rotate-
stats.timer → /lib/systemd/system/ntpsec-rotate-stats.timer.
Created symlink /etc/systemd/system/network-pre.target.wants/ntpsec-
systemd-netif.path → /lib/systemd/system/ntpsec-systemd-netif.path.
Created symlink /etc/systemd/system/multi-
user.target.wants/ntpsec.service → /lib/systemd/system/ntpsec.service.
Setting up ntpsec-ntpdate (1.2.0+dfsg1-4) ...
Processing triggers for dbus (1.12.20-2) ...
Processing triggers for man-db (2.9.4-2) ...
---------------------------------------------------------------------

It seems at first sight that systemd-timesyncd is default date/time
synchronization tool but it may act as full fledged NTP server? I think
'no' as per my initial docs reading.

How to handle 'ntp' or 'ntpsec' headless installation? and what are the
reasons for this behaviour?

Thank you.

Regards,
Jaikumar

signature.asc

Reco

unread,

Mar 22, 2022, 4:40:05 AM3/22/22

to

Hi.

On Tue, Mar 22, 2022 at 01:42:28PM +0530, Jaikumar Sharma wrote:
> It seems at first sight that systemd-timesyncd is default date/time
> synchronization tool but it may act as full fledged NTP server?

No. It can act as an NTP client only.

> How to handle 'ntp' or 'ntpsec' headless installation?

Choose one NTP implementation, install it.
If you need it to act as an NTP server - change an appropriate
configuration file.

> and what are the reasons for this behaviour?

It makes little sense to have two or more NTP clients installed on the
same host. Thus installing one should uninstall others.

Reco

jaikuma...@gmail.com

unread,

Mar 22, 2022, 5:20:05 AM3/22/22

to

On Tuesday, March 22, 2022 at 2:10:05 PM UTC+5:30, Reco wrote:

Thanks for quick reply :)

> Choose one NTP implementation, install it.
> If you need it to act as an NTP server - change an appropriate
> configuration file.

Yes, that is what I mentioned - any of the implemention (ntp or ntpsec) giving me the same behaviour in headless installation, also i'm not triggering installation of 'systemd-timesyncd' at all, how come this is getting installed and giving error in the log? :)

> It makes little sense to have two or more NTP clients installed on the
> same host. Thus installing one should uninstall others.

Yes, logical.

Regards,
Jaikumar

Reco

unread,

Mar 22, 2022, 6:00:07 AM3/22/22

to

On Tue, Mar 22, 2022 at 02:07:54AM -0700, jaikuma...@gmail.com wrote:
> On Tuesday, March 22, 2022 at 2:10:05 PM UTC+5:30, Reco wrote:
>
> Thanks for quick reply :)
> > Choose one NTP implementation, install it.
> > If you need it to act as an NTP server - change an appropriate
> > configuration file.
> Yes, that is what I mentioned - any of the implemention (ntp or ntpsec) giving me the same behaviour in headless installation, also i'm not triggering installation of 'systemd-timesyncd' at all, how come this is getting installed and giving error in the log? :)

Debian-installer is forbidden to remove installed packages by default.
Hence the message:

Mar 22 07:35:57 in-target: E: Packages need to be removed but remove is
disabled.

Reco

jaikuma...@gmail.com

unread,

Mar 22, 2022, 6:20:05 AM3/22/22

to

On Tuesday, March 22, 2022 at 3:30:07 PM UTC+5:30, Reco wrote:
> Debian-installer is forbidden to remove installed packages by default.
> Hence the message:
> Mar 22 07:35:57 in-target: E: Packages need to be removed but remove is
> disabled.

Understood, then (if you know) what it is the way forward to install either implementation i.e. ntp or ntpsec in a headless way?
Thank you.

Reco

unread,

Mar 22, 2022, 7:10:05 AM3/22/22

to

1) Make preseed.cfg, pass it to the installer as specified at [1].

2) Add something like this into pressed.cfg:
preseed/late_command="in-target apt-get install -y ntpsec"

3) Run the installer.

Reco

[1] https://www.debian.org/releases/stable/amd64/apbs02

Greg Wooledge

unread,

Mar 22, 2022, 7:50:05 AM3/22/22

to

On Tue, Mar 22, 2022 at 11:21:30AM +0300, Reco wrote:
> It makes little sense to have two or more NTP clients installed on the
> same host. Thus installing one should uninstall others.

In jessie, stretch and buster, systemd-timesyncd was not a separate
package. The systemd-timesyncd program was part of the systemd package,
which was of course installed by default. The unit file was written
so that if any of the *programs* from any of the other Debian NTP
packages (ntp, chrony, openntpd) exists, then systemd-timesyncd would
not start. If you installed ntp (for example), then ntpd would run,
but systemd-timesyncd would not.

(I'm looking at a buster box right now, and
/lib/systemd/system/systemd-timesyncd.service.d/disable-with-time-daemon.conf
contains the relevant directives.)

In bullseye, this configuration was changed. systemd-timesyncd is now
a separate package, and is still installed by default (assuming one does
not change the init system). If ntp or chrony or openntpd is installed,
then systemd-timesyncd is removed, as they all have this:

unicorn:~$ apt-cache show systemd-timesyncd | grep Prov
Provides: time-daemon
unicorn:~$ apt-cache show ntp | grep Prov
Provides: time-daemon
[...]

So, while it may "make little sense" to do it the older way, apparently
the Debian developers found it sensible for three releases. The current
method is definitely a change, and if the OP is running various scripts
that relied on the old method, those scripts may need to change.

jaikuma...@gmail.com

unread,

Mar 22, 2022, 10:50:05 AM3/22/22

to

On Tuesday, March 22, 2022 at 4:40:05 PM UTC+5:30, Reco wrote:
> 1) Make preseed.cfg, pass it to the installer as specified at [1].
> 2) Add something like this into pressed.cfg:
> preseed/late_command="in-target apt-get install -y ntpsec"
> 3) Run the installer.

Great, thanks Reco, it worked like a charm :) Solved.

Regards,
Jaikumar