Network Time Protocol Objectives Contents to learn how to setup ntp The NTP Server What is NTP? Download and Install The NTP Package The /etc/ntp.conf File How To Get NTP Started Determining If NTP Is Synchronized Properly

What is NTP? Network Time Protocol Stratum levels Used to keep clock’s syncronized within your nodes Important for logservers and logfiles Transaction servers Various applications Time critic operations that needed to be syncronized Stratum levels Level 1 most accurate, many public exist Level 2 next accurate, often companies timeservers Lower levels LW radio carriers as reference Important atomic clock servers that supports NTP http://www.eecis.udel.edu/~mills/ntp/servers.html Network Time Protocol (NTP) is a protocol used to help synchronize your system clock with an accurate time source. There are a number of "Stratum 1" (NTP sites using an atomic clock for timing) and "Stratum 2" (NTP sites with slightly less accurate time sources) sites that allow the general public to synchronize with them. It is good practice to have at least one server on your network be the local time server for all your other devices, this makes the correlation of system events on different systems much easier.

Download and Install The NTP Package Check if NTP is there and then download it Install NTP after it is downloaded NTP is redhat standard, however it is not started. First time chkconfig and service will open iptables firewall as well, ntp used port 123 UDP # ftp ftp.redhat.com ftp> cd /pub/redhat/linux/9/en/os/i386/RedHat/RPMS ftp> ls ntp* ftp> mget ntp* # rpm –ivh ntp-4.1.2-5.i386.rpm # chkconfig ntpd on # service ntpd start Most RedHat and Fedora Linux software products are available in the RPM format. Downloading and installing RPMs isn't hard. When searching for the file, remember that the NTP RPM's filename usually starts with the word "ntp" followed by a version number like this: ntp-4.1.2-5.i386.rpm. Remember to download ntp –rpm file in a ”desent” catalog on your upcoming NTP enabled host, a good place could be: mkdir /usr/src/extras ; cd /usr/src/extras

The /etc/ntp.conf File First we specify the sample servers we're interested in: Servers are used in order, average time can be calculated Then we restrict the type of access you allow these servers Declare the networks this NTP server should serve This NTP server should serve itself unrestricted server  otherntp.server.org    # A stratum 1 server server  ntp.research.gov       # A srtatum 2 server restrict otherntp.server.org mask 255.255.255.255 nomodify notrap noquery restrict ntp.research.gov mask 255.255.255.255 nomodify notrap noquery Fetch time from somewhere This is the main configuration file for Linux NTP in which you place the IP addresses of the stratum 1 and stratum 2 servers you want to use. Here is a sample of a configuration using a pair of sample Internet based NTP servers. The mask statement 255.255.255.255 is really a subnet mask limiting access to the single IP address of the remote NTP servers. Serve time to some nets If this server is also going to provide time for other computers, such as PCs, other Linux servers and networking devices, then you'll have to define the networks from which this server will accept NTP synchronization requests. This is done with a modified restrict statement with the "nomodify" replaced with a "notrust" keyword. In this case the mask statement has been expanded to include all 255 possible IP addresses on our local network. NTP Server yourself as server We also want to make sure that localhost (The universal IP address used to refer to a Linux server itself) has full access without any restricting keywords restrict 192.168.0.0 mask 255.255.255.0 notrust nomodify notrap restrict 192.168.1.0 mask 255.255.255.0 notrust nomodify notrap restrict 127.0.0.1

How To Get NTP Started To get NTP configured to start at boot: The demon is called ntpd To start/stop/restart NTP after booting: If you like with init scripts: Logging in /var/log/messages Logging in /var/log/ntpd.log # chkconfig ntpd on # service ntpd start # service ntpd stop # service ntpd restart # /etc/init.d/ntpd start # /etc/init.d/ntpd stop # /etc/init.d/ntpd restart You have to restart the NTP process every time you make a change to the configuration file for the changes to take effect on the running process.

Testing And Troubleshooting NTP Verifying NTP is Running you should get a response of plain old process ID numbers Doing An Initial Synchronization against one server First check current idea of time Then syncronize against NTP server Last check that time was adjusted If time it was to big difference in time you might want to set the time as exact you can manually and do the sync again # pgrep ntpd # date Thu Sep 7 00:00:00 PDT 2004 # ntpdate –u ntp.research.gov  Looking for host ntp.research.gov and service ntp host found : ntp.research.gov 7 Sep 08:03:38 ntpdate[2472]: step time server ntp.research.gov offset 28993.084943 sec      Sep 7 08:03:38 PDT 2004 NTP sync is sensitive to to large timedeltas, if more than two hours local time you will be refused sync. Bad motherboard or motherboard there BIOS batteries are worn down will have svere problems syncronizing with NTP, also time can drift to much in some system. Your NTP daemon will eventually terminate itself leaving an error message in the /var/log/messages file if the time on the local server is very different from that of its time server. You should run the "ntpdate -u" command to rapidly force it to synchronize. Doesn't run continuously in the background, and you will still have to run the ntpd daemon to get continuous NTP updates.

Determining If NTP Is Synchronized Properly With ntpq command see the servers you sync with Jitter should be less than 100 Try to use NTP server close to you with high strata level # ntpq -p      remote          refid       st t when poll reach  delay   offset   jitter ============================================================================== -jj.cs.umb.edu   gandalf.sigmaso  3 u   95 1024  377  31.681  -18.549    1.572 milo.mcs.anl.go  ntp0.mcs.anl.go  2 u  818 1024  125  41.993  -15.264    1.392 -mailer1.psc.edu ntp1.usno.navy.  2 u  972 1024  377  38.206   19.589   28.028 -dr-zaius.cs.wis ben.cs.wisc.edu  2 u  502 1024  357  55.098    3.979    0.333 +taylor.cs.wisc. ben.cs.wisc.edu  2 u  454 1024  347  54.127    3.379    0.047 -ntp0.cis.strath harris.cc.strat  3 u  507 1024  377 115.274   -5.025    1.642 *clock.via.net   .GPS.            1 u  426 1024  377 107.424   -3.018    2.534 ntp1.conectiv.c  0.0.0.0         16 u    - 1024    0   0.000    0.000  4000.00 Use the ntpq command to see the servers with which you are synchronized. It will provide you with a list of configured time servers and the delay, offset and jitter that your server is experiencing with them. For correct synchronization, the delay and offset values should be non-zero and the jitter value should be under 100.

Your Linux NTP clients cannot Synchronize Properly Your test show something like this This could be caused by the following Older versions of NTP must have IP addresses, not FDQN A firewall blocking access to your Stratum 1 and 2 NTP servers, port 123 UDP must be opened. Fedora Core 2 syncing to Feodora 2 client has a known bug # ntpq -p      remote           refid      st t when poll reach   delay   offset  jitter ==============================================================================  LOCAL(0)        LOCAL(0)        10 l    -   64    7    0.000    0.000   0.008  ntp-cup.externa 0.0.0.0         16 u    -   64    0    0.000    0.000 4000.00  snvl-smtp1.trim 0.0.0.0         16 u    -   64    0    0.000    0.000 4000.00  nist1.aol-ca.tr 0.0.0.0         16 u    -   64    0    0.000    0.000 4000.00 A telltale sign that you haven't got proper synchronization is when all the remote servers have jitters of 4000 with delay and reach values of zero Feodora bug workaround Fedora Core 2 has a bug in which NTP clients will not be able to synchronize with a Fedora Core 2 time server unless the "notrust nomodify notrap" keywords in the restrict statement for the NTP client network is removed. The example below shows a restrict statement that only has the client network defined without any keywords. The configuration line that works with other NTP versions has been commented out. # -- CLIENT NETWORK ------- #restrict 172.16.1.0 mask 255.255.255.0 notrust nomodify notrap restrict 172.16.1.0 mask 255.255.255.0 NTP servers communicate with one another using UDP with a destination port of 123. Unlike most UDP protocols, the source port isn't a high port (ie. greater than 1023), but 123 also. You'll have to allow UDP traffic on source/destination port 123 between your server and the Stratum 1/2 server with which you are synchronizing.

Fedora / RedHat File Permissions The /etc/ntpd catalog must have correct owner and group This catalog holds the drift file and network delay correction! chown ntp:ntp /etc/ntp All the Fedora / RedHat NTP daemons write temporary files to the /etc/ntp directory. Unfortunately, in Fedora Core 2, the permissions on this directory don't allow this to be done. You will have to set the group and owner of the directory to be "ntp” You'll get errors like this in the /var/log/messages file if you don't change permissions. Sep 7 00:29:45 smallfry ntpd[2097]: can't open /etc/ntp/drift.TEMP: Permission denied

Configuring Cisco Devices To Use An NTP Server Cisco IOS ntp server: Forms a server association with another system. ntp update-calendar: Configures the system to update its hardware clock from the software clock at periodic intervals. ciscorouter> enable password: ********* ciscorouter# config t ciscorouter(config)# ntp update-calendar ciscorouter(config)# ntp server 192.168.0.10 ciscorouter(config)# ntp server 192.168.1.201 ciscorouter(config)# exit ciscorouter# wr mem Here are the commands you would use to make your router synchronize with NTP servers with IP addresses 192.168.0.10 and 192.168.1.201. An explanation of the commands used follows.

Configuring Cisco Devices To Use An NTP Server CAT OS ntp server: Forms a server association with another system. set ntp client enable: Activate the NTP client ciscoswitch> enable password: ********* ciscoswitch# set ntp client enable ciscoswitch# ntp server 192.168.0.10 ciscoswitch# ntp server 192.168.1.201 ciscoswitch# exit Here are the commands you would use to make your router synchronize with NTP servers with IP addresses 192.168.0.10 and 192.168.1.201. An explanation of the commands used follows.

Summary NTP server is adjust time and date on nodes Configuration sit in /etc/ntpd.conf Calibration files sit in /etc/ntpd/ Strata levels tells system accuracy Strata level 1 is most accurate Stratalevel 2 is next accurate Many applications rely on exact time NTPD is the name of client and server demon Show ntp status with ntpq –p Update time manually: ntpdate –u ntp.research.gov Most routers/Switches has NTP timesettings