Time Synchronisation: Difference between revisions

From SambaWiki
(Rewrote documentation. Rephrased, clearer wording, etc.)
(Mentioned that this is only an example and that we don't document MS software in detail here. Removed screenshot about enabling the NTP client. The text is self-explaining. Integrated the procedure for enabling NTP client into the existing one.)
(14 intermediate revisions by 3 users not shown)
Line 3: Line 3:
In an Active Directory (AD) you must have an accurate time synchronisation. For example, Kerberos requires correct time stamps to prevent replay attacks and the AD uses the time to resolve replication conflicts. The default maximum allowed time deviation in an AD is 5 minutes. If a domain member or domain controller (DC) has a higher or lower time difference, the access is denied. As a result, a user cannot access shares or query the directory.
In an Active Directory (AD) you must have an accurate time synchronisation. For example, Kerberos requires correct time stamps to prevent replay attacks and the AD uses the time to resolve replication conflicts. The default maximum allowed time deviation in an AD is 5 minutes. If a domain member or domain controller (DC) has a higher or lower time difference, the access is denied. As a result, a user cannot access shares or query the directory.


Samba supports the "ntpd" from http://ntp.org. The daemon synchronises the time with external sources and enables clients to retrieve the time from the server running the daemon.
Samba supports the <code>ntpd</code> from http://ntp.org. The daemon synchronises the time with external sources and enables clients to retrieve the time from the server running the daemon.


Note that "ntpd" does not support authenticated time synchronisation with Windows 2000 clients.
Note that <code>ntpd</code> does not support authenticated time synchronisation with Windows 2000 clients.




Line 15: Line 15:
== Requirements ==
== Requirements ==


* ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support ("--enable-ntp-signd")
* ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support (<code>--enable-ntp-signd</code>)


* Verify the socket permissions on your domain controller (DC). The "ntpd" daemon must have read permissions in the "ntp_signed" directory. To list the permissions, enter:
* Verify the socket permissions on your domain controller (DC). The <code>ntpd</code> daemon must have read permissions in the <code>ntp_signed</code> directory. To list the permissions, enter:


# ls -ld /usr/local/samba/var/lib/ntp_signd/
# ls -ld /usr/local/samba/var/lib/ntp_signd/
Line 30: Line 30:
== Set up the ntpd.conf File on a DC ==
== Set up the ntpd.conf File on a DC ==


Typically, the "ntpd" daemon read its configuration from the /etc/ntpd.conf file.
Typically, the <code>ntpd</code> daemon read its configuration from the <code>/etc/ntpd.conf</code> file.


The following is a minimum "ntpd.conf" file that synchronises the time with three external NTP server and enables clients to query the time using signed NTP requests:
The following is a minimum <code>ntpd.conf</code> file that synchronises the time with three external NTP server and enables clients to query the time using signed NTP requests:


# Local clock. Note that is not the "localhost" address!
# Local clock. Note that is not the "localhost" address!
Line 59: Line 59:
restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery


For further information about the "ntpd" access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.
For further information about the <code>ntpd</code> access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.


If you have SELinux enabled on your server, see [[Time_Synchronisation_-_SELinux_Labeling_and_Policy|Time Synchronisation - SELinux Labeling and Policy]].
If you have SELinux enabled on your server, see [[Time_Synchronisation_-_SELinux_Labeling_and_Policy|Time Synchronisation - SELinux Labeling and Policy]].
Line 67: Line 67:




= Configuring Time Synchronisation on a Linux Domain Member =
= Configuring Time Synchronisation on a Unix Domain Member =


== Requirements ==
== Requirements ==
Line 75: Line 75:




== Set up the ntpd.conf File on a Linux Domain Member ==
== Set up the ntpd.conf File on a Unix Domain Member ==


Typically, the "ntpd" daemon read its configuration from the /etc/ntpd.conf file.
Typically, the <code>ntpd</code> daemon reads its configuration, depending on the operating system, from the <code>/etc/ntpd.conf</code> or <code>/etc/ntp.conf</code> file.


The following is a minimum "ntpd.conf" file that synchronises the time with the Samba Active Directory (AD) domain controllers (DC) "DC1" and "DC2" and does not provide time services for other hosts.
The following is a minimum conf file that synchronises the time with the Samba Active Directory (AD) domain controllers (DC) <code>DC1</code> and <code>DC2</code> and does not provide time services for other hosts.


# Local clock. Note that is not the "localhost" address!
# Local clock. Note that is not the "localhost" address!
Line 103: Line 103:
restrict DC2.samdom.example.com mask 255.255.255.255 nomodify notrap nopeer noquery
restrict DC2.samdom.example.com mask 255.255.255.255 nomodify notrap nopeer noquery


For further information about the "ntpd" access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.
For further information about the <code>ntpd</code> access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.




Line 110: Line 110:


= Configuring Time Synchronisation on a Windows Domain Member =
= Configuring Time Synchronisation on a Windows Domain Member =

The following describes the basics of how to configure time synchronizsation on a Windows domain member. For further details, see your Microsoft Windows documentation.




== Default Time Source ==
== Default Time Source ==


Windows AD domain members use the DC holding the [[Flexible_Single-Master_Operations_(FSMO)_roles#PDC_Emulator|PDC emulator FSMO role]] as default time source. For more information about the time synchronisation and hierarchy in an AD, see http://technet.microsoft.com/en-us/library/cc773013%28v=ws.10%29.aspx#w2k3tr_times_how_izcr.
Windows AD domain members use the DC holding the [[Flexible_Single-Master_Operations_(FSMO)_Roles#PDC_Emulator|PDC emulator FSMO role]] as default time source. For more information about the time synchronisation and hierarchy in an AD, see http://technet.microsoft.com/en-us/library/cc773013%28v=ws.10%29.aspx#w2k3tr_times_how_izcr.




Line 119: Line 123:
== Setting User Defined Time Sources and Options ==
== Setting User Defined Time Sources and Options ==


To create a group policy object (GPO) to for setting a user defined NTP time source and options:
To configure a different time source than the domain controller (DC) holding the [[Flexible_Single-Master_Operations_(FSMO)_roles#PDC_Emulator|PDC emulator FSMO role]]:

* Open the Group Policy Management Console (GPMC).
: To install, see [[Installing_RSAT|Installing the Remote Server Administration Tools (RSAT)]].


* Log in to a computer using an account that is allowed you to edit group policies, such as the AD domain <code>Administrator</code> account.
* Create a new group policy object (GPO).


* Open the <code>Group Policy Management Console</code>. If you are not having the Remote Server Administration Tools (RSAT) installed on this computer, see [[Installing RSAT|Installing RSAT]].
* Right-click the GPO and select "Edit".


* Right-click to your AD domain and select <code>Create a GPO in this domain, and Link it here</code>.
* In the Group Policy Management Editor (GPME) navigate to "Computer Configuration" / "Administrative Templates" / "System" / "Windows Time Service" / "Time Providers".


* Enter a name for the GPO, such as <code>Time Sources</code>. The new GPO is shown below the domain entry.
* Edit the "Configure Windows NTP Client" policy:


* Right-click to the newly-created GPO and select <code>Edit</code> to open the <code>Group Policy Management Editor</code>.
* To set "DC2.samdom.example.com" as the only and primary time source ("0x9") using the NTP protocol:


* Navigate to the <code>Computer Configuration</code> &rarr; <code>Policies</code> &rarr; <code>Administrative Templates</code> &rarr; <code>System</code> &rarr; <code>Windows Time Service</code> &rarr; <code>Time Providers</code> entry, and double-click <code>Configure Windows NTP Client</code> to configure the policy:
:[[Image:GPO_Windows_NTP_Client_Options.png]]
:* Enable the policy and set the following options:
::* Enter the fully-quallified domain name (FQDN) of the NTP server to the <code>NtpServer</code> field and and append the <code>0x9</code> flag. For example:
:::[[Image:GPO_Windows_NTP_Client_Options.png]]
::: To enter multiple server, separate the individual entries using a space.
::* Keep the <code>NT5DS</code> type setting.
::* Update the additional parameters, if necessary.
:* Click <code>OK</code> to save the settings.


* Navigate to the <code>Computer Configuration</code> &rarr; <code>Policies</code> &rarr; <code>Administrative Templates</code> &rarr; <code>System</code> &rarr; <code>Windows Time Service</code> &rarr; <code>Time Providers</code> entry, and double-click <code>Enable Windows NTP Client</code> to configure the policy:
:For descriptions on the other options in the screen capture, see the GPO help.
:* Enable the policy.
:* Click <code>OK</code> to save the settings.


* Close the <code>Group Policy Management Editor</code>.
* Save the GPO


* Close the <code>Group Policy Management Console</code>.
* Link the GPO to a organizational unit (OU) or to the domain.




Line 147: Line 157:


----
----
[[Category:Configuration]]
[[Category:Active Directory]]
[[Category:Active Directory]]

Revision as of 19:29, 2 November 2017

Introduction

In an Active Directory (AD) you must have an accurate time synchronisation. For example, Kerberos requires correct time stamps to prevent replay attacks and the AD uses the time to resolve replication conflicts. The default maximum allowed time deviation in an AD is 5 minutes. If a domain member or domain controller (DC) has a higher or lower time difference, the access is denied. As a result, a user cannot access shares or query the directory.

Samba supports the ntpd from http://ntp.org. The daemon synchronises the time with external sources and enables clients to retrieve the time from the server running the daemon.

Note that ntpd does not support authenticated time synchronisation with Windows 2000 clients.



Configuring Time Synchronisation on a DC

Requirements

  • ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support (--enable-ntp-signd)
  • Verify the socket permissions on your domain controller (DC). The ntpd daemon must have read permissions in the ntp_signed directory. To list the permissions, enter:
# ls -ld /usr/local/samba/var/lib/ntp_signd/
drwxr-x--- 2 root ntp 4096  1. May 09:30 /usr/local/samba/var/lib/ntp_signd/
To set the permissions, run:
# chown root:ntp /usr/local/samba/var/lib/ntp_signd/
# chmod 750 /usr/local/samba/var/lib/ntp_signd/


Set up the ntpd.conf File on a DC

Typically, the ntpd daemon read its configuration from the /etc/ntpd.conf file.

The following is a minimum ntpd.conf file that synchronises the time with three external NTP server and enables clients to query the time using signed NTP requests:

# Local clock. Note that is not the "localhost" address!
server 127.127.1.0
fudge  127.127.1.0 stratum 10

# Where to retrieve the time from
server 0.pool.ntp.org     iburst prefer
server 1.pool.ntp.org     iburst prefer
server 2.pool.ntp.org     iburst prefer

driftfile       /var/lib/ntp/ntp.drift
logfile         /var/log/ntp
ntpsigndsocket  /usr/local/samba/var/lib/ntp_signd/

# Access control
# Default restriction: Allow clients only to query the time
restrict default kod nomodify notrap nopeer mssntp

# No restrictions for "localhost"
restrict 127.0.0.1

# Enable the time sources to only provide time to this host
restrict 0.pool.ntp.org   mask 255.255.255.255    nomodify notrap nopeer noquery
restrict 1.pool.ntp.org   mask 255.255.255.255    nomodify notrap nopeer noquery
restrict 2.pool.ntp.org   mask 255.255.255.255    nomodify notrap nopeer noquery

For further information about the ntpd access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.

If you have SELinux enabled on your server, see Time Synchronisation - SELinux Labeling and Policy.



Configuring Time Synchronisation on a Unix Domain Member

Requirements


Set up the ntpd.conf File on a Unix Domain Member

Typically, the ntpd daemon reads its configuration, depending on the operating system, from the /etc/ntpd.conf or /etc/ntp.conf file.

The following is a minimum conf file that synchronises the time with the Samba Active Directory (AD) domain controllers (DC) DC1 and DC2 and does not provide time services for other hosts.

# Local clock. Note that is not the "localhost" address!
server 127.127.1.0
fudge  127.127.1.0 stratum 10

# Where to retrieve the time from
server DC1.samdom.example.com     iburst prefer
server DC2.samdom.example.com     iburst

driftfile /var/lib/ntp/ntp.drift
logfile   /var/log/ntp

# Access control
# Default restriction: Disallow everything
restrict default ignore

# No restrictions for "localhost"
restrict 127.0.0.1

# Enable the time sources only to only provide time to this host
restrict DC1.samdom.example.com   mask 255.255.255.255    nomodify notrap nopeer noquery
restrict DC2.samdom.example.com   mask 255.255.255.255    nomodify notrap nopeer noquery

For further information about the ntpd access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.



Configuring Time Synchronisation on a Windows Domain Member

The following describes the basics of how to configure time synchronizsation on a Windows domain member. For further details, see your Microsoft Windows documentation.


Default Time Source

Windows AD domain members use the DC holding the PDC emulator FSMO role as default time source. For more information about the time synchronisation and hierarchy in an AD, see http://technet.microsoft.com/en-us/library/cc773013%28v=ws.10%29.aspx#w2k3tr_times_how_izcr.


Setting User Defined Time Sources and Options

To create a group policy object (GPO) to for setting a user defined NTP time source and options:

  • Log in to a computer using an account that is allowed you to edit group policies, such as the AD domain Administrator account.
  • Open the Group Policy Management Console. If you are not having the Remote Server Administration Tools (RSAT) installed on this computer, see Installing RSAT.
  • Right-click to your AD domain and select Create a GPO in this domain, and Link it here.
  • Enter a name for the GPO, such as Time Sources. The new GPO is shown below the domain entry.
  • Right-click to the newly-created GPO and select Edit to open the Group Policy Management Editor.
  • Navigate to the Computer ConfigurationPoliciesAdministrative TemplatesSystemWindows Time ServiceTime Providers entry, and double-click Configure Windows NTP Client to configure the policy:
  • Enable the policy and set the following options:
  • Enter the fully-quallified domain name (FQDN) of the NTP server to the NtpServer field and and append the 0x9 flag. For example:
GPO Windows NTP Client Options.png
To enter multiple server, separate the individual entries using a space.
  • Keep the NT5DS type setting.
  • Update the additional parameters, if necessary.
  • Click OK to save the settings.
  • Navigate to the Computer ConfigurationPoliciesAdministrative TemplatesSystemWindows Time ServiceTime Providers entry, and double-click Enable Windows NTP Client to configure the policy:
  • Enable the policy.
  • Click OK to save the settings.
  • Close the Group Policy Management Editor.
  • Close the Group Policy Management Console.