Time Synchronisation: Difference between revisions

From SambaWiki
(Complete re-write of the HowTo, incl. client configuration, etc.)
(tell that client reconfiguration is usually NOT necessary)
(36 intermediate revisions by 6 users not shown)
Line 1: Line 1:
= Introducion =
= Introduction =


In an Active Directory, an accurate time syncronisation is required and critical like DNS E. g. Kerberos relies on correct timestamps to prevent replay attacks and AD needs them for resolving replication conflicts.
In an Active Directory (AD) you must have an accurate time synchronisation. For example, Kerberos requires correct time stamps to prevent replay attacks and the AD uses the time to resolve replication conflicts. The default maximum allowed time deviation in an AD is 5 minutes. If a domain member or domain controller (DC) has a higher or lower time difference, the access is denied. As a result, a user cannot access shares or query the directory.


Samba supports the <code>ntpd</code> from http://ntp.org. The daemon synchronises the time with external sources and enables clients to retrieve the time from the server running the daemon.
The maximum time tolerance in an Active Directory is 5 minutes per default. If e. g. your clients clock differs more than that to your servers clock, accessing the server is denied.


By default domain joined Windows clients synchronize their clock via NT5DS with the AD-DC which holds the PDC-emulator FSMO role.
In an Active Directory, the Domain Controller with the PDC Emulator role is considered as the default time source in a forest. See http://technet.microsoft.com/en-us/library/cc773013%28v=ws.10%29.aspx#w2k3tr_times_how_izcr for information about time syncronisation in an AD DS hierarchy.
The NT5DS protocol uses digital signatures. These can be provided by Samba if ntp runs on the same server, and is configured as described on this page (with options mssntp and ntpsigndsocket).
Alternatively you could configure all machines to do standard ntp, but NT5DS is recommended.


Note that <code>ntpd</code> does not support authenticated time synchronisation with Windows 2000 clients.


= Configuring Time Synchronisation on a DC =

= General information =

== Server information used in this HowTo ==

Inside this HowTo, we will be using the following configuration/settings:

Installation Directory: /usr/local/samba/
Domain Controller (owner of PDC role): DC1.samdom.example.com
Domain Controller (not owner of PDC role): DC2.samdom.example.com



== Limitations of ntpd with old clients ==

Please note that [http://www.ntp.org/ ntpd from ntp.org] Samba interface with, does not support authenticated time to Windows 2000 clients! This is due to these clients not behaving as the ntpd server expects. As these clients are now very old and unsupported, you may need to find another way to keep these clocks in sync.





= Configuring Time Syncronisation on a DC =


== Requirements ==
== Requirements ==


* [http://www.ntp.org/ ntpd] >= 4.2.6 with enabled signed ntp support
* ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support (<code>--enable-ntp-signd</code>)


* Verify the socket permissions on your domain controller (DC). The <code>ntpd</code> daemon must have read permissions in the <code>ntp_signed</code> directory. To list the permissions, enter:


# ls -ld /usr/local/samba/var/lib/ntp_signd/
drwxr-x--- 2 root ntp 4096 1. May 09:30 /usr/local/samba/var/lib/ntp_signd/


: To set the permissions, run:
== Installation ==
# chown root:ntp /usr/local/samba/var/lib/ntp_signd/
# chmod 750 /usr/local/samba/var/lib/ntp_signd/


* Install ntpd from your distributions repository. Make sure, that it was compiled using the „--enable-ntp-signd“ option!


* Compile by yourself (Add „--enable-ntp-signd“ to the „configure“ options!).


== Set up the ntpd.conf File on a DC ==


Typically, the <code>ntpd</code> daemon read its configuration from the <code>/etc/ntpd.conf</code> file.


The following is a minimum <code>ntpd.conf</code> file that synchronises the time with three external NTP server and enables clients to query the time using signed NTP requests:
== Check Samba AD DC socket permissions ==


# Local clock. Note that is not the "localhost" address!
Check that the socket permissions are set correct. It must be readable by the account your ntpd uses and should not be accessable by other:

# ls -ld /usr/local/samba/var/lib/ntp_signd/
drwxr-x--- 2 root ntp 4096 1. May 09:30 /usr/local/samba/var/lib/ntp_signd/



== Setup ntpd.conf ==

# Local clock (this is not the localhost address!)
server 127.127.1.0
server 127.127.1.0
fudge 127.127.1.0 stratum 10
fudge 127.127.1.0 stratum 10
# Where to retrieve the time from
# The source, where we are receiving the time from
server 0.pool.ntp.org iburst prefer
server 0.pool.ntp.org iburst prefer
server 1.pool.ntp.org iburst prefer
server 2.pool.ntp.org iburst prefer
driftfile /var/lib/ntp/ntp.drift
driftfile /var/lib/ntp/ntp.drift
logfile /var/log/ntp
logfile /var/log/ntp
ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/
ntpsigndsocket /usr/local/samba/var/lib/ntp_signd/
# Access control
# Access control
# Default restriction: Only allow querying time (incl. ms-sntp) from this machine
# Default restriction: Allow clients only to query the time
restrict default kod nomodify notrap nopeer mssntp
restrict default kod nomodify notrap nopeer mssntp
# Allow everything from localhost
# No restrictions for "localhost"
restrict 127.0.0.1
restrict 127.0.0.1
# Allow that our time source can only provide time and do nothing else
# Enable the time sources to only provide time to this host
restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery


For further information about ntpd access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions
For further information about the <code>ntpd</code> access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.


If you have SELinux enabled on your server, see [[Time_Synchronisation_-_SELinux_Labeling_and_Policy|Time Synchronisation - SELinux Labeling and Policy]].




== SELinux Labeling and Policy (optional) ==


Set policy for Windows client time sync:
# chcon -u system_u -t ntpd_t /usr/local/samba/var/lib/ntp_signd


Make the policy permanent
# semanage -a -t ntpd_t "/usr/local/samba/var/lib/ntp_signd"


= Configuring Time Synchronisation on a Unix Domain Member =
Verify the change
# cat /etc/selinux/targeted/contexts/files/file_contexts.local

You should see a line like:
/usr/local/samba/var/lib/ntp_signd system_u:object_r:ntpd_t:s0

The below policy file is based on 4.1.6 on RHEL 6.5 and should be for reference only. Always run the below egrep command, after you have a base policy file created. Then stop / start ntpd and Samba AD services on your system and add to the base policy until competed.

egrep "samba|ntpd" /var/log/audit/audit.log | audit2allow

If all is fine, you'll see this for each "allow" line below in the policy file.
#!!! This avc is allowed in the current policy
allow ntpd_t self:capability sys_admin;
etc.

<tt>samba4.te</tt> policy:
module samba4 1.0;
require {
type ntpd_t;
type usr_t;
type initrc_t;
type fs_t;
type setfiles_t;
type lib_t;
type unconfined_t;
type locate_t;
class dir write;
class dir search;
class dir open;
class dir read;
class dir getattr;
class dir remove_name;
class dir add_name;
class dir relabelto;
class unix_stream_socket connectto;
class sock_file write;
class sock_file create;
class sock_file unlink;
class filesystem associate;
class capability sys_admin;
}
#============= initrc_t ==============
allow initrc_t ntpd_t:dir { write remove_name add_name };
allow initrc_t ntpd_t:sock_file create;
allow initrc_t ntpd_t:sock_file unlink;
#============= ntpd_t ==============
allow ntpd_t usr_t:sock_file write;
allow ntpd_t initrc_t:unix_stream_socket connectto;
allow ntpd_t fs_t:filesystem associate;
allow ntpd_t lib_t:sock_file write;
allow ntpd_t unconfined_t:unix_stream_socket connectto;
allow ntpd_t self:sock_file write;
allow ntpd_t self:capability sys_admin;
#============= locate_t ==============
allow locate_t ntpd_t:dir { read getattr open search };
#============= setfiles_t ==============
allow setfiles_t ntpd_t:dir relabelto;

Check and load policy:
$ checkmodule -M -m -o samba4.mod samba4.te
$ semodule_package -o samba4.pp -m samba4.mod
$ semodule -i samba4.pp





= Configuring Time Syncronisation on Samba Member Servers =


== Requirements ==
== Requirements ==


* [http://www.ntp.org/ ntpd]
* ntpd from http://www.ntp.org.






== Set up the ntpd.conf File on a Unix Domain Member ==
== Installation ==


Typically, the <code>ntpd</code> daemon reads its configuration, depending on the operating system, from the <code>/etc/ntpd.conf</code> or <code>/etc/ntp.conf</code> file.
* Install ntpd from your distributions repository.


The following is a minimum conf file that synchronises the time with the Samba Active Directory (AD) domain controllers (DC) <code>DC1</code> and <code>DC2</code> and does not provide time services for other hosts.
* Compile it by yourself.


# Local clock. Note that is not the "localhost" address!


== Setup ntpd.conf ==

# Local clock (this is not the localhost address!)
server 127.127.1.0
server 127.127.1.0
fudge 127.127.1.0 stratum 10
fudge 127.127.1.0 stratum 10
# The source, where we are receiving the time from (PDC)
# Where to retrieve the time from
server DC1.samdom.example.com iburst prefer
server DC1.samdom.example.com iburst prefer
server DC2.samdom.example.com iburst
driftfile /var/lib/ntp/ntp.drift
driftfile /var/lib/ntp/ntp.drift
Line 194: Line 93:
# Access control
# Access control
# Default restriction
# Default restriction: Disallow everything
restrict default ignore
restrict default ignore
# Allow everything from localhost
# No restrictions for "localhost"
restrict 127.0.0.1
restrict 127.0.0.1
# Allow that our time source can only provide time and do nothing else
# Enable the time sources only to only provide time to this host
restrict DC1.samdom.example.com mask 255.255.255.255 nomodify notrap nopeer noquery
restrict DC1.samdom.example.com mask 255.255.255.255 nomodify notrap nopeer noquery
restrict DC2.samdom.example.com mask 255.255.255.255 nomodify notrap nopeer noquery

For further information about the <code>ntpd</code> access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.





= Configuring Time Synchronisation on a Windows Domain Member =

The following describes the basics of how to configure time synchronizsation on a Windows domain member. For further details, see your Microsoft Windows documentation.


For further information about ntpd access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions




== Default Time Source ==


Windows AD domain members use the DC holding the [[Flexible_Single-Master_Operations_(FSMO)_Roles#PDC_Emulator|PDC emulator FSMO role]] as default time source. If you have set up ntp on the DC as described on this page, you usually do not need to reconfigure the clients. Alternative configuration options for the clients are described below.


For more information about the time synchronisation and hierarchy in an AD, see http://technet.microsoft.com/en-us/library/cc773013%28v=ws.10%29.aspx#w2k3tr_times_how_izcr.


== Setting User Defined Time Sources and Options ==
= Configuring Time Syncronisation on Windows Clients =


To create a group policy object (GPO) to for setting a user defined NTP time source and options:
== Default behaviour ==


* Log in to a computer using an account that is allowed you to edit group policies, such as the AD domain <code>Administrator</code> account.
Per default, Windows clients in an Active Directory, automatically syncronize their time with the DC, owning the „PDC“ role. If you don't want to use a different source, configure fallback time server, etc. you don't have to take action.


* Open the <code>Group Policy Management Console</code>. If you are not having the Remote Server Administration Tools (RSAT) installed on this computer, see [[Installing RSAT|Installing RSAT]].


* Right-click to your AD domain and select <code>Create a GPO in this domain, and Link it here</code>.


* Enter a name for the GPO, such as <code>Time Sources</code>. The new GPO is shown below the domain entry.
== Setting user defined time source(s) and options ==


* Right-click to the newly-created GPO and select <code>Edit</code> to open the <code>Group Policy Management Editor</code>.
If you require your Windows clients to syncronize time with a different server than your DC owning the PDC role, you can configure this via Group Policies. Using the following way, you can define multiple time servers and adjust time sycronisation related options:


* Navigate to the <code>Computer Configuration</code> &rarr; <code>Policies</code> &rarr; <code>Administrative Templates</code> &rarr; <code>System</code> &rarr; <code>Windows Time Service</code> &rarr; <code>Time Providers</code> entry, and double-click <code>Configure Windows NTP Client</code> to configure the policy:
* Create a new Group Policy Object in the Group Policy Management Console and edit it.
:* Enable the policy and set the following options:
::* Enter the fully-quallified domain name (FQDN) of the NTP server to the <code>NtpServer</code> field and and append the <code>0x9</code> flag. For example:
:::[[Image:GPO_Windows_NTP_Client_Options.png]]
::: To enter multiple server, separate the individual entries using a space.
::* Keep the <code>NT5DS</code> type setting.
::* Update the additional parameters, if necessary.
:* Click <code>OK</code> to save the settings.


* Navigate to the <code>Computer Configuration</code> &rarr; <code>Policies</code> &rarr; <code>Administrative Templates</code> &rarr; <code>System</code> &rarr; <code>Windows Time Service</code> &rarr; <code>Time Providers</code> entry, and double-click <code>Enable Windows NTP Client</code> to configure the policy:
* In the Group Policy Management Editor, go to „Computer Configuration“ / „Administrative Templates“ / „System“ / „Windows Time Service“ / „Time Providers“.
:* Enable the policy.
:* Click <code>OK</code> to save the settings.


* Close the <code>Group Policy Management Editor</code>.
* Edit the „Configure Windows NTP Client“ policy:


* Close the <code>Group Policy Management Console</code>.
[[Image:GPO_Windows_NTP_Client_Options.png]]


:This example changes the NTP server setting to a different DC, that provides time, but is not owner of the PDC role. For further explanations on the possible options, see the description in the policy and, visit http://technet.microsoft.com/de-de/library/cc779145%28v=ws.10%29.aspx.


Notes:
* Save the GPO and link it to the desired OU.


* The default Type NT5DS ignores the parameter NtpServer, and syncs with the DC.


* If ntpd on your DC is not configured for mssntp with ntpsigndsocket, use Type NTP.


* If a client will not be able to connect to the DC for a long time (for example a laptop), use Type AllSync and set NtpServer to "time.windows.com,0x9". This will cause the client to try both NT5DS to your DC, and NTP to NtpServer.




= Configuring Time Syncronisation on Linux Clients =


----
See [[#Configuring_Time_Syncronisation_on_Samba_Member_Servers|Configuring Time Syncronisation on Samba Member Servers]].
[[Category:Active Directory]]

Revision as of 11:32, 26 April 2018

Introduction

In an Active Directory (AD) you must have an accurate time synchronisation. For example, Kerberos requires correct time stamps to prevent replay attacks and the AD uses the time to resolve replication conflicts. The default maximum allowed time deviation in an AD is 5 minutes. If a domain member or domain controller (DC) has a higher or lower time difference, the access is denied. As a result, a user cannot access shares or query the directory.

Samba supports the ntpd from http://ntp.org. The daemon synchronises the time with external sources and enables clients to retrieve the time from the server running the daemon.

By default domain joined Windows clients synchronize their clock via NT5DS with the AD-DC which holds the PDC-emulator FSMO role. The NT5DS protocol uses digital signatures. These can be provided by Samba if ntp runs on the same server, and is configured as described on this page (with options mssntp and ntpsigndsocket). Alternatively you could configure all machines to do standard ntp, but NT5DS is recommended.

Note that ntpd does not support authenticated time synchronisation with Windows 2000 clients.

Configuring Time Synchronisation on a DC

Requirements

  • ntpd >= 4.2.6 from http://www.ntp.org, compiled with enabled signed ntp support (--enable-ntp-signd)
  • Verify the socket permissions on your domain controller (DC). The ntpd daemon must have read permissions in the ntp_signed directory. To list the permissions, enter:
# ls -ld /usr/local/samba/var/lib/ntp_signd/
drwxr-x--- 2 root ntp 4096  1. May 09:30 /usr/local/samba/var/lib/ntp_signd/
To set the permissions, run:
# chown root:ntp /usr/local/samba/var/lib/ntp_signd/
# chmod 750 /usr/local/samba/var/lib/ntp_signd/


Set up the ntpd.conf File on a DC

Typically, the ntpd daemon read its configuration from the /etc/ntpd.conf file.

The following is a minimum ntpd.conf file that synchronises the time with three external NTP server and enables clients to query the time using signed NTP requests:

# Local clock. Note that is not the "localhost" address!
server 127.127.1.0
fudge  127.127.1.0 stratum 10

# Where to retrieve the time from
server 0.pool.ntp.org     iburst prefer
server 1.pool.ntp.org     iburst prefer
server 2.pool.ntp.org     iburst prefer

driftfile       /var/lib/ntp/ntp.drift
logfile         /var/log/ntp
ntpsigndsocket  /usr/local/samba/var/lib/ntp_signd/

# Access control
# Default restriction: Allow clients only to query the time
restrict default kod nomodify notrap nopeer mssntp

# No restrictions for "localhost"
restrict 127.0.0.1

# Enable the time sources to only provide time to this host
restrict 0.pool.ntp.org   mask 255.255.255.255    nomodify notrap nopeer noquery
restrict 1.pool.ntp.org   mask 255.255.255.255    nomodify notrap nopeer noquery
restrict 2.pool.ntp.org   mask 255.255.255.255    nomodify notrap nopeer noquery

For further information about the ntpd access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.

If you have SELinux enabled on your server, see Time Synchronisation - SELinux Labeling and Policy.



Configuring Time Synchronisation on a Unix Domain Member

Requirements


Set up the ntpd.conf File on a Unix Domain Member

Typically, the ntpd daemon reads its configuration, depending on the operating system, from the /etc/ntpd.conf or /etc/ntp.conf file.

The following is a minimum conf file that synchronises the time with the Samba Active Directory (AD) domain controllers (DC) DC1 and DC2 and does not provide time services for other hosts.

# Local clock. Note that is not the "localhost" address!
server 127.127.1.0
fudge  127.127.1.0 stratum 10

# Where to retrieve the time from
server DC1.samdom.example.com     iburst prefer
server DC2.samdom.example.com     iburst

driftfile /var/lib/ntp/ntp.drift
logfile   /var/log/ntp

# Access control
# Default restriction: Disallow everything
restrict default ignore

# No restrictions for "localhost"
restrict 127.0.0.1

# Enable the time sources only to only provide time to this host
restrict DC1.samdom.example.com   mask 255.255.255.255    nomodify notrap nopeer noquery
restrict DC2.samdom.example.com   mask 255.255.255.255    nomodify notrap nopeer noquery

For further information about the ntpd access control, see http://support.ntp.org/bin/view/Support/AccessRestrictions.



Configuring Time Synchronisation on a Windows Domain Member

The following describes the basics of how to configure time synchronizsation on a Windows domain member. For further details, see your Microsoft Windows documentation.


Default Time Source

Windows AD domain members use the DC holding the PDC emulator FSMO role as default time source. If you have set up ntp on the DC as described on this page, you usually do not need to reconfigure the clients. Alternative configuration options for the clients are described below.

For more information about the time synchronisation and hierarchy in an AD, see http://technet.microsoft.com/en-us/library/cc773013%28v=ws.10%29.aspx#w2k3tr_times_how_izcr.

Setting User Defined Time Sources and Options

To create a group policy object (GPO) to for setting a user defined NTP time source and options:

  • Log in to a computer using an account that is allowed you to edit group policies, such as the AD domain Administrator account.
  • Open the Group Policy Management Console. If you are not having the Remote Server Administration Tools (RSAT) installed on this computer, see Installing RSAT.
  • Right-click to your AD domain and select Create a GPO in this domain, and Link it here.
  • Enter a name for the GPO, such as Time Sources. The new GPO is shown below the domain entry.
  • Right-click to the newly-created GPO and select Edit to open the Group Policy Management Editor.
  • Navigate to the Computer ConfigurationPoliciesAdministrative TemplatesSystemWindows Time ServiceTime Providers entry, and double-click Configure Windows NTP Client to configure the policy:
  • Enable the policy and set the following options:
  • Enter the fully-quallified domain name (FQDN) of the NTP server to the NtpServer field and and append the 0x9 flag. For example:
GPO Windows NTP Client Options.png
To enter multiple server, separate the individual entries using a space.
  • Keep the NT5DS type setting.
  • Update the additional parameters, if necessary.
  • Click OK to save the settings.
  • Navigate to the Computer ConfigurationPoliciesAdministrative TemplatesSystemWindows Time ServiceTime Providers entry, and double-click Enable Windows NTP Client to configure the policy:
  • Enable the policy.
  • Click OK to save the settings.
  • Close the Group Policy Management Editor.
  • Close the Group Policy Management Console.


Notes:

  • The default Type NT5DS ignores the parameter NtpServer, and syncs with the DC.
  • If ntpd on your DC is not configured for mssntp with ntpsigndsocket, use Type NTP.
  • If a client will not be able to connect to the DC for a long time (for example a laptop), use Type AllSync and set NtpServer to "time.windows.com,0x9". This will cause the client to try both NT5DS to your DC, and NTP to NtpServer.