Network Time Protocol
Files that will be discussed
* /etc/ntp.conf * /etc/ntp.drift * /var/log/ntp.log * /etc/rc.d/ntpd * /usr/bin/ntpdate
* http://www.ntp.org/ * http://twiki.ntp.org/bin/view/Main/WebHome * http://www.eecis.udel.edu/~mills/ntp/html/index.html
The very first line of your ntp.conf file should contain a line such as the following:
restrict default noquery notrust nomodify
This essentially restricts everyone from modifying anything. Following this, you need to let ntpd know what you want to let through into your NTP server. Here is where you would specify any other ip addresses you would like to synchronize on your NTP server. For example:
restrict 18.104.22.168 restrict 192.168.0.0 mask 255.255.255.0 nomodify
This tells ntpd that 22.214.171.124 and all ip addresses from the 192.168.0.0 range will be allowed to synchronize on this server, but they will not be allowed to modify anything. All other IP addresses in the world will still obey the default restrictions (the first line in the ntp.conf).
Now, is where the stratum 2 servers that our server will synchronize with come into play. The lines in ntp.conf will be used to tell ntpd what servers we would like to use for synchronizing (these are just examples; use ntp servers that are closest to your location).
server ntp1.cs.wisc.edu server ntp3.cs.wisc.edu server ntp3.sf-bay.org
If we left it alone right now, we would never connect to a server because the response from any of the three servers listed above would never be allowed back into our server due to the fact that our default restrict statement would be in use (since we did not add the servers to our lesser restrictions (like we did with 127.0.0.1 and the subnet of 192.168.0.0).
To correct this, enter the following lines in ntp.conf:
restrict ntp1.cs.wisc.edu noquery nomodify restrict ntp3.cs.wisc.edu noquery nomodify restrict ntp3.sf-bay.org noquery nomodify
This will allow the response from the above servers into our system so our local clock can be synchronized. The noquery restriction will not allow any of the above three servers to query for information from our server. The nomodify restriction will not allow the three servers to modify anything (synchronization will still take place).
The only thing left to do is add the drift file (which keeps track of yours clocks time deviation). and the log file location:
driftfile /etc/ntp.drift logfile /var/log/ntp.log
The complete file will look like this:
# default restrictions restrict default noquery notrust nomodify # override the default restrictions here restrict 10.1.1.0 mask 255.255.255.0 nomodify # public NTP servers to sync with (all stratum 2) server ntp1.cs.wisc.edu server ntp3.cs.wisc.edu server ntp3.sf-bay.org restrict ntp1.cs.wisc.edu noquery nomodify restrict ntp3.cs.wisc.edu noquery nomodify restrict ntp3.sf-bay.org noquery nomodify # NTP drift file - used to keep track of your system clocks # time deviation driftfile /etc/ntp.drift # NTP log file logfile /var/log/ntp.log
Take note that this is for a client and a server ntp.conf configuration. If you just want to synchronize with a stratum server and are not concerned with other PCs synchronizing with your ntp server, then you can do something like the following (note that only 127.0.0.1 is allowed to be synchronized):
# default restrictions restrict default noquery notrust nomodify # Permit all access over the loopback interface restrict 127.0.0.1 # public NTP servers to sync with (all stratum 2) server ntp1.cs.wisc.edu server ntp3.cs.wisc.edu server ntp3.sf-bay.org restrict ntp1.cs.wisc.edu noquery nomodify restrict ntp3.cs.wisc.edu noquery nomodify restrict ntp3.sf-bay.org noquery nomodify # NTP drift file - used to keep track of your system clocks # time deviation driftfile /etc/ntp.drift # NTP log file logfile /var/log/ntp.log
... or if you don't care about restrictions at all, something like this (note there are no restrictions, thus no need to reduce restrictions for 127.0.0.1 to allow your local clock to synchronize):
# public NTP servers to sync with (all stratum 2) server ntp1.cs.wisc.edu server ntp3.cs.wisc.edu server ntp3.sf-bay.org # NTP drift file - used to keep track of your system clocks # time deviation driftfile /etc/ntp.drift # NTP log file logfile /var/log/ntp.log
A Note about Security
You may wonder about all of the restrict lines. The reason for them is security. If you don't want a secure NTP server, don't add any restrict lines to your ntp.conf file. If you want a secure NTP server, start out by adding a default restrict that doesn't allow anything to contact your server, then add more (less restrictive) restrict lines - allowing certain addresses various access privilages.
/etc.rc.d/network file modification
One more thing that you may want to do. In some cases, your /etc/ntp.conf file may be overwritten by dhcp. To avoid this, edit the /etc/conf.d/dhcpcd file and add -N to the line that starts with 'dhcpcd -t 10'.
Updating your system immediately using ntpdate
It is recommended to add a line like the following to your /etc/rc.local file so when you boot your system, your time will be correct (use an NTP server close to your location).
Running ntpdate when you boot up is a good idea because ntpd may take a long time to synchronize your local clock depending on how far off the time is. If your clock is synchronized when ntpd starts, then it's sole purpose is to keep it synchronized. To run ntpd at startup, add ntpd to the daemons section of the /etc/rc.conf file.
ntpd will work well if you have a connection to the internet all the time. If you are using dialup, you may just want to stick with using ntpdate via the command line.
Querying your NTP server using ntpq
There is a default restrict statement for the localhost that includes an ignore flag. Without overriding it (adding the line restrict 127.0.0.1) you will not be able to query your NTP server. If that's not a concern to you, then leave out the restrict line for your localhost. You will still be able to synchronize with your stratum 2 servers.
Using OpenNTPD instead of ntpd
OpenNTPD is a FREE, easy to use implementation of the Network Time Protocol. It provides the ability to sync the local clock to remote NTP servers and can act as NTP server itself, redistributing the local clock.
OpenNTPD is primarily developed by Henning Brauer as part of the OpenBSD Project.
OpenNTPD is a brand new implementation of the ntp protocol. It is much easier to configure and use than ntpd.
First, the OpenNTPD package must be installed. It is available in the archlinux incoming directory. ftp://ftp.archlinux.org/incoming/openntpd-3.6p1-7.src.tar.gz
This file must be extracted and then the package must be installed:
tar zxvf openntpd-3.6p1-6.src.tar.gz cd openntpd/ pacman -A openntpd-3.6p1-6.pkg.tar.gz
Once installed, the /etc/ntpd.conf file must be edited. This is much easier than with ntpd.
The default configuration is actually usable if all you want is to sync the local computer.
# $OpenBSD: ntpd.conf,v 1.7 2004/07/20 17:38:35 henning Exp $ # sample ntpd configuration file, see ntpd.conf(5) # Addresses to listen on (ntpd does not listen by default) #listen on * #listen on 127.0.0.1 #listen on ::1 # sync to a single server #server ntp.example.org # use a random selection of 8 public stratum 2 servers # see http://twiki.ntp.org/bin/view/Servers/NTPPoolServers servers pool.ntp.org
To sync to a particular server, uncomment and edit the "server" directive.
The "servers" directive works the same as the "server" directive, however, if the dns name resolves to multiple IP address, ALL of them will be synched to. The default, "pool.ntp.org" is working and should be acceptible in most cases.
Any number of "server" or "servers" directives may be used.
If you want the computer you run OpenNTPD on to also be a time server, simply uncomment and edit the "listen" directive.
listen on *
will listen on all interfaces.
listen on 127.0.0.1
will only listen on the loopback interface.
If you would like to run OpenNTPD at boot, add openntpd the DAEMONS variable in your /etc/rc.conf.
If you want to see the status of of your syncing, look at /var/log/daemon.log