Myside's Spew - Blog of Spontaneous Combustible Spew

HOWTO: Securely Setup an NTP (The Network Time Protocol) Server - Simplified

31 August, 2010 02:15 CST6CDT

This documentation assumes you have a compiled and installed NTP server version of 4.2.6 or newer.

NTP is a protocol designed to synchronize the clocks of computers over a network. NTP version 3 is an internet draft standard, formalized in RFC 1305. NTP version 4 is a significant revision of the NTP standard, and is the current development version, but has not been formalized in an RFC. Simple NTP (SNTP) version 4 is described in RFC 2030. - [source]

The first two steps to begin the installation is to setup a NTP log file and a statsdir which will hold the servers log messages and time computations acquired from external stratum time servers.  Here is an example of the first two lines in a ntp.conf (/etc/ntp.conf) file:

logfile /var/log/ntpd
statsdir /var/log/ntpstats/

When compiling by source, you may create the log file by issuing the command "touch /var/log/ntpd" and create the directory which will hold your NTPD statistics such as peer communications with the command "mkdir /var/log/ntpstats".

Now we want to keep good track of NTP server communication to better help your server synchronize its internal time clock.  We will add the following four lines for this:

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

Next we will list the NTP servers you would like to communicate with in order to synchronize your system's time in conjunction with.  These servers should only be used on a proven and sturdy machine:

server time.nist.gov
server time-a.nist.gov
server time-b.nist.gov
server utcnist.colorado.edu
server utcnist2.colorado.edu

At this point you will want to secure your NTP server.  To do so we will start by denying all traffic in or out of this communication medium:

restrict default ignore

Now in order to negotiate synchronization to the time servers listed above, you will want to allow your server permission to query these hosts by resolving the IP addresses and granting query actions:

# time.nist.gov
restrict 192.43.244.18 mask 255.255.255.245 nomodify notrap noquery
# time-a.nist.gov
restrict 129.6.15.28 mask 255.255.255.245 nomodify notrap noquery
# time-b.nist.gov
restrict 129.6.15.29 mask 255.255.255.245 nomodify notrap noquery
# utcnist.colorado.edu
restrict 128.138.140.44 mask 255.255.255.245 nomodify notrap noquery
# utcnist2.colorado.edu
restrict 128.138.188.172 mask 255.255.255.245 nomodify notrap noquery

In order to allow local or remote hosts access to your time server after it has been properly synced to your correct time, you may add the following rule to respond to queries, with this example, on a class C network:

restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

Most importantly, do not forget to assign your drift file and directory:

driftfile /var/lib/ntp/drift

You may create this using: "mkdir /var/lib/ntp; touch /var/lib/ntp/drift".  Note that if you decide to run NTPD under a non root user, this directory must have full write access to your alternative username, as with the ntpd and statsdir file and directory mentioned above.

I will touch on two ntpd command switches that may come in usefull.

The "-g" switch will allow your NTPD process to continue running if your internal time clock is off by more than 1000 seconds.  If this switch is not present and your time is stewed & spewed, the process will die.  The "-I eth0" switch, as an example, allows you to bind NTPD to a physical network interface.  The interface may be eth0, eth1, lo, etc.

The configuration above should get you headed in the right direction to set up a network time server and client.

Software  Projects  Article & Comments (1)

correction: drift file

You should not do a "touch /var/lib/ntp/drift" as it will create an invalid application data file. This file will be created automatically by ntpd. It may take up to 14 hours, even longer in some cases to estimate the time drift.

Myside | 09/03/2010, 12:59 [Reply]

Add a Comment
Verification (Required)
 authimage
Your comment will appear once it is approved and
your e-mail address will NOT be shared

Main Entry:   spew   Pronunciation:   \ˈspyü\
Function: verb
Etymology: Middle English, from Old English spīwan; akin to Old High German spIwan to spit, Latin spuere, Greek ptyein   First Known Use: before 12th century

intransitive verb
  1. VOMIT
  2. to come forth in a flood or gush
  3. to ooze out as if under pressure : EXUDE
transitive verb
  1. VOMIT
  2. to send or cast forth with vigor or violence or in great quantity <a volcano spewing out ash> —often used with out —spew·er noun
Land where drunk cows swim and home to my daily hand