Configuring NTP service

     The network time protocol ( NTP ) is used to synchronize a computer system's time with an accurate time source. Interconnected and communicating systems should have their times in sync with each other to preserve the order of communication / sotring of information ( and and many more applications ).

     The ultimate source of accurate time is called a reference clock and will usually be an atomic/nuclear clocks ( usually using cesium as the element ).  Another variety of reference clocks will be gps receivers receiving time from satellites ( which in turn uses an atomic clock ). Other computer systems sync their time from reference clocks directly or from servers that sync from reference clock directly.

    NTP supports a hierarchy of time sources, the accuracy of each level of this hierarchy is referred to by the term startum.  A startum number is given to each source based on its reliability, smallest startum being most accurate.  Thus reference clocks are startum 0, the servers that sync time directly from them are startum 1, and servers that sync from these servers will be startum 2 and so on.  Basiaclly if the upstream NTP server is startum X, the server syncing from that server is startum X+1 upto a maximum value of 15.  NTP protocol/service has inherent mechanisms to determine the accuracy of upstream NTP server as well as its own by calculating different parameters like offset,resolution,jitter etc..

NTP is a UDP base protocol and uses port 123. Let us look at a basic NTP configuration

    First install the  NTP software, on ubuntu it is openntpd with main configuration file /etc/openntpd/ntpd.conf and optional include files kept under /etc/openntpd.  On a redhat system it will be ntp ( with configuration file at /etc/ntp.conf and include directory /etc/ntp.d/).

safeer@ntpc:~$sudo yum install ntp
safeer@ntpc:~$sudo /sbin/service ntpd status
 * ntpd is stopped

     First you have to determine from which NTP server you want to sync time.  This can be another server in your network, or one publicaly available.  You can even setup a standalone ntp server which syncs from its own hardware clock and provide time service to other servers in your network ( though not very much recommended )

     Now there are two ways to sync time from a server.  You can use the ntpdate binary, which will sync with the server time immediately, but this can have adverse effect on the server of the time difference between ntpserver and client and bigger.  The other option is to configure ntp service, which will allow the server to gracefully sync time.

How ntpdate works:

Check if the server is up and available:

safeer@ntpc:~$sudo ntpdate -q ntp1.safeer.in

The output will list one ore more servers behind the ntp dns name and its time details.  This indicates the sever is good, so go ahead and sync with it.

safeer@ntpc:~$ sudo ntpdate ntp1.safeer.in

You can provide multiple space separated NTP server to ntpdate.  If the command shows no error, the time will be set by now.  Check your system with date command.

Now let us see how the ntp server can be configured:

First add one or more servers:

server 1.1.1.1
server 2.2.2.2
server ntp1.safeer.in

NTPD can detect the time drift between system clock and the reference clock ( or server ) over a period of time and need to store this somewhere to adjust the system time.  This drift value has to be written to some file.  The user running NTP daemon should have write access to the file.

driftfile /var/lib/ntp/drift

     This much was about how you receive the time from upstream servers.  Now let us see what it takes to sync the server's own system clock or downstream servers. 
     First case, let us assume we just need to sync the time on our server and not provide time to any downstream servers ( ntp client mode )

    The configuration parameter to use here is "restrict" in the following syntax: restrict < host ip/hostname/network id > [mast < mask >] [flags .. ..]
     The mask is optional ( need only when u are defining access for networks and not single servers), if the flags are omitted the server will be having unrestricted access to ntp service.  Also you can use the entry "default" in place of host/network for setting default access policy.  If access is not explicitly defined for a host/network the default policy will be used.

    Since we are planning to sync only the local server we have to restrict everything except localhost from accessing ntp service. 

## This will deny ntp service to any host that done have an explicit "restrict" entry
restrict default ignore
## Allow access to localhost through loopback interface ( by omitting flags section )
restrict 127.0.0.1

If we are configuring our server to server other hosts, say the local network - 192.168.1.0/255.255.255.0 this is how you do it:

restric 192.168.1.0 mask 255.255.255.0 nomodify notrap nopeer
     The flag nomodify prevent clients from modifying servers ntp configuration, notrap prevents from sending log collection trap messages, nopeer prevents peering/associating the clients with the server to be "co-servers"

     If the upstream server becomes unavailable, the host will not be able to sync time, so as a fall back we configure the local clock as a time source, in ntp language the ip "127.127.1.0" indicates local clock

server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 10

If you want to log the ntp activity add the entry

logfile /var/log/ntp.log

Finally, let us consilidate everything in one place:

server 1.1.1.1
server 2.2.2.2
server ntp1.safeer.in

restrict default ignore
restrict 127.0.0.1

restric 192.168.1.0 mask 255.255.255.0 nomodify notrap nopeer

server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 10

driftfile /var/lib/ntp/drift
logfile /var/log/ntp.log


Before starting ntp service, run ntpdate with one of the servers listed as an initial sync, then start ntp service


safeer@ntpc:~$sudo ntpdate ntp1.safeer.in
safeer@ntpc:~$sudo /sbin/service ntpd start

For more on NTP, check official website and RFC page.

Configuring NTP client for Cisco devices

Lot many things in Cisco devices depend on time, like certificates, time based ACLs and syslog messages. When it comes to time sources, Cisco devices are pretty much same as Computers. Most of them have a hardware clock as well as a software clock. We are concerned here only about the software clock as that is the time source used in the above mentioned scenarios.

We can manually set the time of hardware and software clocks in Cisco. To know about it, see my post about setting time in Cisco devices.

Here we would see how we can set an NTP server as the time source for a Cisco device.

R0(config)#ntp server 202.55.1.1

This will set the cisco device as a client of the NTP server 202.55.1.1, but there are a few more thing to configure if you want you network to be safe and efficient.

Authentication.

To prevent malicius/accidental setting of incorrect time from an unwanted NTP server, you should use NTP authentication using NTP "keys". There will be keys configured on the NTP server, which are basically string with a maximum length of 8 characters. The encryption scheme used to protect the key exchange is MD5.

Now enable NTP authentication first:

R0(config)#ntp authenticate
Now define the NTP server authentication key(s)
R0(config)#ntp authentication-key 1 md5 SeCrEt
R0(config)#ntp authentication-key 2 md5 TeRcEs

Here 1 and 2 are arbitrary numbers used as identifiers for each different keys. MD5 is the protocol used and the last argument of the command is the key itself ( This will be matching with the keys configured on the NTP server).

R0(config)#ntp trusted-key 1

This tells the device that the key "SeCrEt" that is stored locally is a trusted key which can be used for NTP authentication. Only trusted keys can be associated with an NTP server.

R0(config)#ntp server 202.55.1.1 key 1

This command associates the server 202.55.1.1 with the key "1" (SeCrEt).

This should be enough to set the authentication.

Reliability

What will happen if this NTP server goes down for a while? To deal with such a scenario you need additional NTP server which you can configure using the same command as above ( the key part may differ
though, depending on the key configured on that server).

So we introduce another server 202.55.2.1 which has and MD5 key "TeRcEs" configured.

R0(config)#ntp trusted-key 2
R0(config)#ntp server 202.55.2.2 key 2

Now we have a fail-over NTP server. But what if we need the NTP traffic to be served by 202.55.1.1 as long as it is up and running? and use the other one only if this host is down? You can specify a preferred server, which in this case will be 202.55.1.1

R0(config)#ntp server 202.55.1.1 key 1 prefer

This will make 202.55.1.1 preferred over the other NTP servers.

There are many more security features that you can configure to secure NTP, like enabling NTP messages to be received on selected interfaces and NTP access-group ACLs. I will detail them in another post.

Setting time in Cisco devices

Cisco devices have two clocks, one hardware and one software. By default the software clock is synced from the hardware one. But there are many things thing that we can modify for our environment.

To view the current time configured:

R0#show clock
*23:21:08.907 UTC Sun May 24 200

R0#show clock detail
*23:21:26.111 UTC Sun May 24 2009
Time source is hardware calendar

Set the software clock time:

R0#clock set 11:26:30 24 MAY 2009
R0#show clock
11:26:32.839 GMT Sun May 24 2009

To change your timezone:

R0(config)#clock timezone IST +5 30
R0(config)#do show clock
11:39:08.535 IST Sun May 24 2009

If you want to set the daylight savings, use command "clock summer-time" with correct options. See "clock summer-time ?"

To sync hardware and software clocks:

R0#clock read-calendar - Read the hardware calendar into the clock
R0#clock update-calendar - Update the hardware calendar from the clock

To view and set the hardware clock:

R0#show calendar
00:40:37 GMT Mon May 25 2009
R0#calendar set 11:45:30 24 MAY 2009

To set time via NTP, see my post about Cisco NTP client configuration

Changing timezone in Linux

The timezone in Linux is defined in the file /etc/localtime. To change this setting you should modify the contents of this file to reflect the desired zone information. By default, the operating system will keep the zone information files for all timezones under /usr/share/zoneinfo. To set a timezone, you can either copy the file as /etc/localtime or link /etc/locatime to the target file. The preferred method is to use soft links.

I will show you how I changed the timezone in my server from PDT to IST.

Current date and timezone:

[root@www ~]# date
Sat Aug 9 09:32:11 PDT 2008
[root@www ~]# ls -l /etc/localtime
lrwxrwxrwx 1 root root 39 Aug 2 07:15 /etc/localtime -> /usr/share/zoneinfo/America/Los_Angeles

As you can see, the timezone of the system is PDT (Pacific Daylight Time) . Now I want to change this to Indian Standard Time (IST). So I am going to change the link to /etc/localtime. My timezone file will be at the location /usr/share/zoneinfo/Asia/Calcutta.

[root@www ~]# ln -sf /usr/share/zoneinfo/Asia/Calcutta /etc/localtime
[root@www ~]# date
Sat Aug 9 22:10:23 IST 2008
As you can see, the timezone is IST now.