change in /etc/hosts

[Venkat_28]

Hello,

Is /etc/hosts change dynamic? If I change anything in it do I have to restart any service to confirm the change? Thanks

[Victor BERRIDGE · Accepted solution]

Hi Venkat,

No nothing else to do...

All the best
Victor

[Rick Garland]

No - changes in /etc/hosts are immediate once you write the file.

[Sanjay_6]

Hi,

Just remember to save the file once you have edited it.

regds

[HGN]

Hi

Like others mentioned the changes are effective after the file has been saved.

Rgds

HGN

[Venkat_28]

Hello All,

Thank you. I added a timeserver to /etc/hosts: timeserver

I noticed although timeserver is added, it's still not noticed by ex: ping. I wonder if DNS/NIS is necessary for ping to work.

Secondly, I added "server timeserver version 3" to /etc/ntp.conf. Next, I did
/sbin/init.d/xntpd stop /usr/sbin/ntpdate -d timeserver (It didn't work). So, I tried ipaddress instead of name:

/usr/sbin/ntpdate -d

Output:

# /usr/sbin/ntpdate -d
23 May 08:44:13 ntpdate[14389]: ntpdate version 3.5f: Fri Dec 10 18:32:44 GMT 1999 PHNE_19711
transmit()
transmit()
transmit()
transmit()
transmit()
server , port 123
stratum 0, precision 0, leap 00, trust 000
refid [0.0.0.0], delay 0.00000, dispersion 64.00000
transmitted 4, in filter 4
reference time: 00000000.00000000 Thu, Feb 7 2036 1:28:16.000
originate timestamp: 00000000.00000000 Thu, Feb 7 2036 1:28:16.000
transmit timestamp: c63c4ea1.08983000 Mon, May 23 2005 8:44:17.033
filter delay: 0.00000 0.00000 0.00000 0.00000
0.00000 0.00000 0.00000 0.00000
filter offset: 0.000000 0.000000 0.000000 0.000000
0.000000 0.000000 0.000000 0.000000
delay 0.00000, dispersion 64.00000
offset 0.000000

23 May 08:44:18 ntpdate[14389]: no server suitable for synchronization found

Then I /sbin/init.d/xntpd start ... ntp service started however, there's no resolution to time problem. We have incorrect time and even after all this the machine is not able to synchronize with timeserver. I wonder if it's due to a firewall between this machine and timeserver

Any ideas? Thank you

[Rick Garland]

Could very well be a firewall issue. The port 123 (I believe) could be blocked. That is my 1st guess.

Also make sure you have the /etc/rc.config.d./netdaemons configured with a 1 to start ntp.
(If not netdaemons, do a 'grep -i ntp *' in the /etc/rc.config.d directory)

How far off is the time from your system to correct time? If a long way off it may not sync automatically.

[Venkat_28]

Thanks. It is off by 5 hrs.

Here's the netdaemons file with comments excluded.

netdaemons
export INETD_ARGS=

START_RBOOTD=1
export RBOOTD_DEVICES=


export NTPDATE_SERVER=
XNTPD=1
export XNTPD_ARGS=


export MROUTED=0
export MROUTED_ARGS=""

export RWHOD=0


export DDFA=0

[Rick Garland]

I also have the NTPDATE_SERVER equal to the value of the NTP server. Not really necessary but I do it.

You may want to adjust the initial time yourself - but be careful, especially if going backwards. Check you databases as well!

Look into the ntpdate command. May be able to help as well.

[Bill Hassell]

/etc/hosts usage (effectiveness) depends entirely on the /etc/nsswich.conf file as well as the /etc/resolv.conf file. All command like ping, telnet ftp, etc will call the hostname-to-IP resolver routines which in turn will follow the directions in the two files. If you do not have /etc/resolv.conf, then use nslookup to verify that the hostname is known in /etc/hosts. If you do have /etc/resolv.conf, then resolver behavior is more complicated:

1. No /etc/nsswitch.conf but /etc/resolv.conf exists, then use the DNS server(s) listed in the resolv.conf file.

2. If /etc/nsswitch.conf exists, then follow the rules in the line: hosts

The most commonly expected behavior is to look in /etc/hosts first and then try the DNS server(s), but this isn't the default in nsswitch.conf. Change the hosts: line to read:

hosts: files[NOTFOUND=continue UNAVAIL=continue] dns [NOTFOUND=return UNAVAIL=continue TRYAGAIN=return]

Now use nslookup to find various hostnames. nslookup will report where it was able to locate an IP for a given name. The two files mentioned are dynamic and examined on every lookup.

As far as NTP, don't try to configure NTP until you test the ability to reach your time servers (notice plural? always use 3 to 6 different time servers). Use the ntpq program to test the connection:

ntpq -p clock1.unc.edu

You will get two possible responses: failure to reach the target computer (almost always due to your firewall that has locked out port 123), or a list of the time servers used by this NTP server. If your network administrators won't allow port 123, ask them to configure NTP on the firewall so you can point your systems to the firewall for NTP service.

Once you have a working ntpq, edit the netdaemons file to reflect the default NTP server used to set the time at bootup:

export NTPDATE_SERVER=clock1.unc.edu
XNTPD=1
export XNTPD_ARGS=

Whern your system boots, clock1.unc.edu will set your time to the current time. Now being off by 5 hours is very unusual, so don't make any manual changes to the current date/time until you verify the timezone setting:

echo $TZ

This translates the only time kept on the system, GMT or UTC/Zulu time. If your TZ value does not your primary timezone, set it in the file /etc/TIMEZONE after looking at the manpage for tztab and the comments in tztab.

Now NTP will NOT change the time at all if the difference between your GMT/UTC setting is off by more than 1024 seconds (17 minutes). You can use the ntpdate command to force the date/time but make sure no programs are running that will get confused by the time change. A reboot eliminates this problem once you configure netdaemons with a valid NTP server.

Note that ping is no longer a dependable tool for Internet queries. Way too many hackers use ping to discover potential targets for destruction so prudent network administrators turn off ping responses, especially on specialized sites like NTP. ntpq is the query tool of choice.

[Venkat_28]

Rick .. Thanks. I was told port 123 on firewall is confg'd according to NTP requirements ... Is there a way I could check whether the firewall is causing any problem

[Bill Hassell]

Just a note about NTPDATE_SERVER. It is always recomnmended to configure this server because the best time to make a big change to the time is at reboot when nothing is running. Be very careful with ntpdate as it has the ability to jump the timne of day many minutes in either direction. There is a -B option to slowly change the time so that every second will exist but the time between seconds it decreased or increased slightly. For a 10 minute change, it will take 3-4 hours to accomplish with ntpdate -B. If your manpage for ntpdate does not have -B (-b is not the same as -B), then you're out of date with NTP patches.

[Venkat_28]

Hi, Thanks. This server has no /etc/nsswitch.conf but has /etc/resolv.conf. So, I used all 3 dns servers mentioned in it as shown below and all three list one server (say server a. No particulars about it at this time) that has association shown (an asterisk).

/usr/sbin/ntpq -p

Does that mean I should use that as timeserver? In case, I have xntpd -d show a synchronization with firewall could I then use either the firewall or server a as timeserver?

[Bill Hassell]

With no /etc/nsswitch.conf file, your /etc/hosts file is ignored. That's why you don't see any changes. Create your nsswitch.conf by:

cp /etc/nsswitch.files /etc/nsswitch.conf

Now edit the line hosts: and make it match the one listed previously. Now, your hosts file is checked first, then your DNS servers.

Now for NTP servers, DNS and NTP are unrelated, but it's possible that a DNS server might have NTP available. I wouldn't assume that, just use the server I listed above as a starting point:

ntpq -p clock1.unc.edu

and if you see some lines on information, you have now verified that port 123 is open and your computer can see Internet NTP servers. If you just get an error message and no server list, then stop, NTP is not getting through.

Once ntpq can see a remote server, edit netdaemons as mentioned above, then replace the entire /etc/ntp.conf file with:

server clock1.unc.edu # Univ. NoCarolina
server rolex.usg.edu # Georgia State Univ
server ntp-2.mcs.anl.gov # Argonne National Lab (Illinois)
server 127.127.1.0 # local clock
fudge 127.127.1.0 stratum 10 # backup clock (internal)
driftfile /etc/ntp.drift # path for drift file

(the default ntp.conf file has lots of comments--they can be deleted) This example uses 3 external NTP sites plus a fail-soft mechanism that uses the local clock when the external sites are dead. Once this is done, reboot and you'll have your time set to within 1/10 sec accuracy and will maintain that accuracy as long as you can see the Internet.

As far as xntpd -d, this isn't necessary once ntpq is working. If you want to stop and restart NTP services, use the start/stop script, not kill and run-command. As far as using your firewall as an NTP server, check to see that it will always be maintained and checked once in a while and if true, then replace all those server names in ntp.conf with your firewall IP address and you're done.

To check your NTP health, just run:

ntpq -p

and you'll see how well your NTP services are running. man ntpq for details.

[Venkat_28]

Hi Bill,

Thanks for your patience and all the answers. Could you look into this one last thing ... Server a and server b are two machines located remotely on company n/w.


This machine server b is configured as peer to server a in /etc/ntp.conf

Now,

# ntpq -p servera

remote refid st t when poll reach delay offset disp
==============================================================================
timeserver 0.0.0.0 16 - - 64 0 0.00 0.000 16000.0

Server a is configured with timeserver but with no association.

However,

ntpq -p clock1.unc.edu
***Can't find host clock1.unc.edu

I wonder why server a is able to reach server b but not an external clock. Does it mean the firewall is doing ok? Could it be firewall issue at server b?

One surprising thing is that server a doesn't have an /etc/switch.conf and still ntpq -p is able to identify various remote hosts on the n/w with just the hostname

Thanks again for all the help.

[Muthukumar_5]

What is your /etc/resolv.conf file contains in server A. Depends upon routing, connectivity is made.

Firewall is configured to allow internal servers to get connective with network machines not the external machines. or server A may not have the rouing entry for external machine.

hth.

[Venkat_28]

Hi Muthu,

Could you tell what specifically /etc/resolv.conf should have to access external systems (such as any gateway)? I recollect I've once dealt with an smtp issue and made a change to include smtp server and I believe this is somewhat a similar issue ...

[Bill Hassell]

> servera: The ntpq response for servera indicates that NTP is running but the values indicate that it is not setup completely. If you use servera as a timesource, your server will just drift around with serverb. To access servera, you don't have to go through the firewall which is why it works OK.

> ntpq -p clock1.unc.edu
> ***Can't find host clock1.unc.edu

This is a DNS problem. When you specify a hostname, it is useless to the networking system. The hostname must be translated to an IP address in order for networking to work. The error message says: I never heard of this server. You can verify that your system cannot find this computer with nslookup:

nslookup clock1.unc.edu
looking up FILES
Trying DNS
Non-authoritative answer:
Name: ns3.oit.unc.edu
Address: 152.2.21.1
Aliases: clock1.unc.edu

That is what you should see. Ig not, your DNS server(s) are not setup correctly. Now you can always use the IP address (hostnames are just for us humans that can't remember numbers):

ntpq -p 152.2.21.1
remote refid st t when poll reach delay offset disp
==============================================================================
LOCAL(0) LOCAL(0) 5 l 46 64 377 0.00 0.000 0.92
+orpheus.oit.unc time-b.nist.gov 2 u 80 1024 376 0.00 -0.618 30.03
+time.nist.gov .ACTS. 1 u 611 1024 375 58.39 -0.097 22.46
+tick.usnogps.na .USNO. 1 u 451 1024 377 109.17 -12.462 14.82
*time-a.nist.gov .ACTS. 1 u 394 1024 377 13.60 -4.735 14.82

(the report is messed up in alignment due to space compression in the ITRC code) This is the expected result (the numbers may vary and that is normal) which shows the NTP servers that clock1.unc.edu is using. This also verifies that you can reach clock1.unc.edu through your firewall. If instead, you get a long delay followed by:

ntpq -p 152.2.21.2
152.2.21.2: timed out, nothing received
***Request timed out

Then your firewall is blocking port 123 and you can't access Internet timeservers.

> One surprising thing is that server a doesn't have an /etc/switch.conf and still ntpq -p is able to identify various remote hosts on the n/w with just the hostname

As I mentioned, a missing nsswitch.conf file means /etc/hosts is never used for hostname lookup. If servera can resolve hostnames, it is because the DNS server(s) listed in /etc/resolv.conf are working and permit servera queries to be answered. If serverb is failing to locate the same hostnames (using nsswitch.conf), nslookup will tell you what is not working correctly. Just use nslookup on both systems, first to lookup local hosts and then to lookup Internet hosts like itrc.hp.com

[Bill Hassell]

And to answer your DNS question: resolv.conf must have working DNS server IP addresses in it. Since DNS is probably setup by someone else, you'll have to ask them why they do not allow external (Internet) addresses to be returned. The proper way to handle DNS servers is to add every server name on your local network into the internal DNS servers, (both A records as well as PTR records) and forward requests for other networks to your ISP's DNS servers.