Network Time Protocol (NTP) is a protocol for synchronising the clocks of computer systems over packet-switched, variable-latency data networks. A good description is available at http://en.wikipedia.org/wiki/Network_Time_Protocol.
The following guidance might be useful in helping to configure NTP on a Linux server.
After experimentation I arrived at the following /etc/ntp.conf configuration file.
# Permit time synchronization with our time source, but do not # permit the source to query or modify the service on this system. restrict default nomodify notrap noquery # Permit all access over the loopback interface. This could # be tightened as well, but to do so would effect some of # the administrative functions. restrict 127.0.0.1 # -- CLIENT NETWORK ------- # Permit systems on this network to synchronize with this # time service. Do not permit those systems to modify the # configuration of this service. Also, do not use those # systems as peers for synchronization. restrict 192.168.xxx.0 mask 255.255.255.0 notrust nomodify notrap # --- OUR TIMESERVERS ----- server 0.pool.ntp.org server 1.pool.ntp.org server 2.pool.ntp.org server uk.pool.ntp.org server ntp.nasa.gov # --- NTP MULTICASTCLIENT --- #multicastclient # listen on default 224.0.1.1 # restrict 224.0.1.1 mask 255.255.255.255 nomodify notrap # restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap # --- GENERAL CONFIGURATION --- # # Undisciplined Local Clock. This is a fake driver intended for backup # and when no outside source of synchronized time is available. The # default stratum is usually 3, but in this case we elect to use stratum # 0. Since the server line does not have the prefer keyword, this driver # is never used for synchronization, unless no other other # synchronization source is available. In case the local host is # controlled by some external source, such as an external oscillator or # another protocol, the prefer keyword would cause the local host to # disregard all other synchronization sources, unless the kernel # modifications are in use and declare an unsynchronized condition. # fudge 127.127.1.0 stratum 10 # # Drift file. Put this in a directory which the daemon can write to. # No symbolic links allowed, either, since the daemon updates the file # by creating a temporary in the same directory and then rename()'ing # it to the file. # driftfile /var/lib/ntp/drift broadcastdelay 0.008 # Log file. Put this in a directory which the daemon can write to. # logfile /var/log/ntp/ntp.log # # Keys file. If you want to diddle your server at run time, make a # keys file (mode 600 for sure) and define the key number to be # used for making requests. # # PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote # systems might be able to reset your clock at will. Note also that # ntpd is started with a -A flag, disabling authentication, that # will have to be removed as well. # keys /etc/ntp/keys restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict uk.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery restrict ntp.nasa.gov mask 255.255.255.255 nomodify notrap noquery
The firewall/port-blocking configuration also needs to be addressed.
NTP uses port 123. But does it require TCP as well as UPD to be opened in the firewall? Some sources say it is only necessary to open port 123 for UCP, others for both UDP and TCP: http://www.patton.com/support/faqs_detail.asp?id=88.
Configuring the NTP server (service) can give problems, as described in the following example:
To:Date: Wed, 15 Oct 2003 10:40:09 -0400 I have installed RedHat 8.0 and i've trying to use it as a ntp server for my switches. I configured the ntp.conf and it is seems to working as a daemon at least. First i have been trying to allow sync only for another machine with windows xp, but when i try to sync from the xp machine (home version) it tells me the following error message: An error occurred while Windows was synchronizing with 10.1.52.39. The time sample was rejected because: The peer's stratum is less than the host's stratum. I tried to sync XP with stratum 1 and stratum 2 public servers and it seems to work fine. My guess is that somehow the stratum of the Linux box is less than the windows box requires. I want to change redhat in a stratum 2 server so xp can sync from it. I do not really care that much about the exact time, i just want to have the same time in my network. An maybe some one can give me a clue how to start ntp daemon without having to connect to to internet, but just with the local clock The following is the ntp.conf file server time.nist.gov server 128.227.205.3 broadcast 10.255.255.255 restrict 127.0.0.1 restrict 10.1.52.37 // which is the name of XP machine driftfile /etc/ntp/ntp.drift resolver /etc/ntp/ntpres keys /etc/ntp/ntp.keys restrict default ignore
Here the difficulty turned out to be a Stratum issue. The table below contain useful references describing NTP servers and the concept of Stratum 0, 1, etc.
I found that I had problems getting my Windows XP PCs to synchonize off the Linux NTP server. In the end I had to resort to those WinXP boxes using the Samba time service off the Linux box. Such an approach is described in detail in using Samba on a NTP server to serve time.
Thus I modified the Samba configuration file /etc/samba/smb.conf as follows:
... #======================= Global Settings ===================================== [global] # workgroup = NT-Domain-Name or Workgroup-Name workgroup =# Added 28/06/2006 netbios name = hide dot files = yes preserve case = yes # server string is the equivalent of the NT Description field server string = My Samba Server (v%v) # Added 17/12/2005 time server = yes
The WinXP PCs on my LAN were then able to successfully synchorise to time off the Linux NTP server.
The following general links are useful references when setting up NTP: