NTP/NTS-KE - Integrity

Introduction

The CUSTOM_NTS_INTEGRITY audit event documents problems during the secure Network Time Security (NTS) TLS handshake between the firewall appliance and its configured NTS time server.

If this handshake fails, the device may not be able to synchronize time securely. In industrial and OT environments this can impact log integrity, time‑based access rules, and correlation of events in a SIEM or SOC.

This event is created by chronyd and written into the Linux audit.log. It is rate‑limited to 4 messages per hour to avoid filling the audit log with repeated handshake errors.

From a security perspective you should investigate these events, because they can indicate invalid or untrusted certificates, misconfigured TLS parameters, or network issues that prevent secure time synchronization. Until the issue is fixed, treat timestamps from the device with care when performing forensic analysis or compliance reporting.

Webinterface View

In the VIEW web interface this event appears in the Anomaly audit section.

The CUSTOM_NTS_INTEGRITY records are shown together with other anomaly alerts from the integrated monitoring system. An example row looks like in the screenshot:

• Title: NTS TLS handshake failed
• Description: Error with certificate from time.cloudflare.com

The table columns in the Anomaly audit view are:

Web field	Description	Example value
Date	Local date when the audit event was recorded, derived from the audit time.	12/25/14
Time	Local time when the event was recorded.	12:35:05
Title	Short summary taken from the title field of the audit record.	NTS TLS handshake failed
Description	Detailed text from the description field of the audit record.	Error with certificate from time.cloudflare.com

Usage hints for operators and SOC analysts:

• Use the Anomaly audit view to quickly see recent NTS integrity problems without parsing the raw audit.log.
• Correlate the Date and Time with other events in your SIEM (for example VPN changes or certificate deployments).
• If NTS TLS handshake failed appears:
• Check the NTS server configuration on the device.
• Verify the server certificate and CA trust on both sides.
• Verify that intermediate firewalls or TLS‑inspection devices are not breaking the TLS handshake.

All entries visible in the Anomaly audit table are backed by entries in /var/log/audit/audit.log, so they can be forwarded and parsed centrally for SIEM/SOC integration.

Explanation of the raw audit.log entry

The CUSTOM_NTS_INTEGRITY event is written into /var/log/audit/audit.log by auditd. A sample line is:

type=CUSTOM_NTS_INTEGRITY msg=audit(1419507305.264:11): pid=7121 uid=323 auid=4294967295 ses=4294967295 msg='title="NTS TLS handshake failed" description="Error with certificate from time.cloudflare.com" exe="/usr/sbin/chronyd" hostname=? addr=? terminal=? res=success'UID="chrony" AUID="unset"

Only the event‑specific fields are explained below. For the generic audit fields such as pid, uid, auid, and ses you can refer to the official auditd documentation.

Field	Description	Example value
type	Audit record type. Identifies this message as an NTS integrity event.	CUSTOM_NTS_INTEGRITY
msg (hdr)	Standard audit header with timestamp and event ID.	audit(1419507305.264:11)
pid	Process ID of the process that triggered the event (chronyd).	7121
uid	User ID under which the process runs.	323
auid	Audit user ID.	4294967295
ses	Audit session ID.	4294967295
msg (body)	Free‑form key‑value block with human readable details.	title="..." description="..." ...
title	Short summary of the problem. This text is shown as Title in the Anomaly audit table.	NTS TLS handshake failed
description	Detailed description, usually naming the affected NTS server or certificate problem. Shown as Description in the web UI.	Error with certificate from time.cloudflare.com
exe	Full path to the executable that generated the audit record.	/usr/sbin/chronyd
hostname	Not used for this event. Always ?.	?
addr	Not used for this event. Always ?.	?
terminal	Not used for this event. Always ?.	?
res	Result flag from auditd. For this custom event it is always set to success for technical reasons.	success
UID	Textual user name corresponding to uid.	chrony
AUID	Textual representation of auid.	unset

For SIEM/SOC integration you typically:

• Filter on type=CUSTOM_NTS_INTEGRITY to capture all NTS integrity events.
• Extract title, description, and exe from the msg body for use as normalized fields (event.action, event.reason, process.name, and similar).
• Use the audit header timestamp audit(…) as the primary event time and convert it to your SIEM time zone.

Repeated occurrences of this event for the same NTS server indicate a persistent misconfiguration or connectivity problem that should be resolved to maintain correct and trustworthy system time.

When the event is generated

A CUSTOM_NTS_INTEGRITY event is generated whenever an NTS‑TLS handshake between the device (NTS client) and a configured NTS server fails.

The event is produced as follows:

• The NTP daemon chronyd detects that it cannot complete an NTS‑TLS handshake with an NTS time server.
• Typical technical reasons are:
• Invalid, expired, or mismatching server certificate.
• The server certificate chain cannot be validated to a trusted CA.
• Incompatible TLS parameters or cipher suites.
• Network interruptions or middleboxes interfering with the TLS handshake.
• chronyd calls audit_log_user_message() from libaudit.
• auditd writes an entry of type CUSTOM_NTS_INTEGRITY into /var/log/audit/audit.log with a short title and a more detailed description.

To protect the audit log against flooding, the device limits the creation of this audit event to 4 messages per hour. Additional handshake failures during that hour will not create further CUSTOM_NTS_INTEGRITY entries.

Note: the res field inside the message is always set to success for technical reasons, even though the semantic meaning of the event is a handshake failure. The failure is expressed in the title and description fields.

Sample audit.log entry

type=CUSTOM_NTS_INTEGRITY msg=audit(1419507305.264:11): pid=7121 uid=323 auid=4294967295 ses=4294967295 msg='title="NTS TLS handshake failed" description="Error with certificate from time.cloudflare.com" exe="/usr/sbin/chronyd" hostname=? addr=? terminal=? res=success'UID="chrony" AUID="unset"