Time Synchronisation: Difference between revisions
(adjust NTP expectations) |
m (Grammar fix.) |
||
Line 35: | Line 35: | ||
For explanation: This config allows clients to receive time from this NTP host, localhost |
For explanation: This config allows clients to receive time from this NTP host, localhost |
||
doesn't have any restrictions, and the servers we receive the time from ,are not allowed |
doesn't have any restrictions, and the servers we receive the time from ,are not allowed |
||
to do anything else than providing the time to us. For |
to do anything else than providing the time to us. For more information about ntpd |
||
access controll, see |
access controll, see |
||
http://support.ntp.org/bin/view/Support/AccessRestrictions |
http://support.ntp.org/bin/view/Support/AccessRestrictions |
Revision as of 16:53, 25 June 2013
You require a recent ntpd version (=>4.2.6) that supports signed ntp. E. g. the version shipped with RHEL6 and Ubuntu < 11.04 are too old. The Ntpd of Debian Squeeze supports signed ntp.
1a. Download ntpd from ntp.org (verify md5 sum) and compile it (add additionals ./configure parameters, if needed):
$ tar -zxvf ntp-4.x.x.tar.gz $ cd ntp-4.x.x $ ./configure --enable-ntp-signd $ make $ make install
1b. Set the permission of the ntp_signd directory (default /usr/local/samba/var/lib/ntp_signd/) to 0750 and its owner to root:ntp to ensure that it is readable from ntpd.
2a. If you already have a supported ntpd version and ntp.conf, you have to add/adjust only the following lines for minimal:
ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ restrict default mssntp
2b. If a minimal/simple ntp.conf is fine for you, then fill the file with the following:
server 127.127.1.0 fudge 127.127.1.0 stratum 12 ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ restrict default mssntp
2c. A more complex ntp.conf is the following:
server 127.127.1.0 fudge 127.127.1.0 stratum 10 server 0.pool.ntp.org iburst prefer server 1.pool.ntp.org iburst prefer driftfile /var/lib/ntp/ntp.drift logfile /var/log/ntp ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/ restrict default kod nomodify notrap nopeer mssntp restrict 127.0.0.1 restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
For explanation: This config allows clients to receive time from this NTP host, localhost doesn't have any restrictions, and the servers we receive the time from ,are not allowed to do anything else than providing the time to us. For more information about ntpd access controll, see http://support.ntp.org/bin/view/Support/AccessRestrictions
3. On members of the domain you don't have to configure anything. Per default they will receive the time from the DC that has the FSMO role PDC.
Supported client versions
Please note that the ntp.org server we interface with does not support authenticated time to Windows 2000 clients. This is due to these clients not behaving as the ntp.org server expects (they send garbage - presumably un-initialised memory - when the server expects zeros). As these clients are now very old and unsupported, you may need to find another way to keep these clocks in sync.
Permissions, SELinux Labeling and Policy
NTP
Set Permissions:
$ chgrp ntp /usr/local/samba/var/lib/ntp_signd
Multiple attempts to set the context for ntp failed so the below policy was needed for windows clients time sync after joining the DOMAIN.
$ chcon -u system_u -t ntpd_t /usr/local/samba/var/run/ntp_signd $ chcon -u system_u -t ntpd_t /usr/local/samba/var/run/ $ chcon -t ntpd_t /usr/local/samba/var/run/ntp_signd/socket
samba4.te policy:
module samba4 1.0; require { type ntpd_t; type usr_t; type initrc_t; class sock_file write; class unix_stream_socket connectto; } #============= ntpd_t ============== allow ntpd_t usr_t:sock_file write; #============= ntpd_t ============== allow ntpd_t initrc_t:unix_stream_socket connectto;
Check and load policy:
$ checkmodule -M -m -o samba4.mod samba4.te $ semodule_package -o samba4.pp -m samba4.mod $ semodule -i samba4.pp