Configurate RedHat 6.2 as NTP client ???

[Patrick Chim]

Hi,

Does anyone know the steps in configurating a RedHat 6.2 Server as a NTP client which point to a NTP Server runs on WinNT 4.0 ?

Regards,
Patrick

[I_M · Accepted solution]

Hi

Install xntp RPM from RedHat web.
Don't use the one in the CD-ROM.
It has security hole.

http://rhn.redhat.com/errata/RHSA-2001-045.html

Then find the IP of the NTP Server.

Sett the ip address into /etc/ntp.conf

server your-ntp-server
driftfile /etc/ntp/drift

Before you start to run xntp, use "ntpdate your-ntp-server" to set your TIME.
(You can't exec ntpdate when you are running xntp.)

# /etc/rc.d/init.d/xntp start

Set it auto-run at boot,
# /sbin/chkconfig --add xntp

Check current xntp status,
# ntpq
ntp> peer

to see the status.
Also check /var/log/messages to see "sync to your-ntp-server" or "sync lost to your-ntp-server" message.

Good luck

[Patrick Chim]

Hi,

When I run 'ntpdate my-NT-server-IP', it show

26 Aug 11:38:34 ntpdate[30656]: no server suitable for synchronization found

What does it mean ??

Regards,
Patrick

[I_M]

Hi

I don't know the reason why ntpdate return such a message.

I suggest to try another NTP server which is refered by your NT box.

The reason why you need ntpdate "before" you run xntp is, xntp required the max difference between ntp server and your local clock should be less than 180sec.
If you confirm the time difference is less than 180, you may skip ntpdate.

Good luck

[Mark Fenton]

If ntpdate returns "no server found..." it probably means that it couldn't establish a connection to port 123 on the NT 4.0 server, so one or more of the following:

1) NT 4.0 box isn't configured to allow ntp connection from your linux box,

2) the server isn't really running ntp.

3) firewall prevents connection on port 123.

hth.

Mark

[Steven E. Protter]

HP-UX will not accept time from a stock Windows NT 4 ntp server. It does not conform to the ntp spec.

The same has been true of Red Hat 6 back when I tested.

If your firewall is ipchains, the following entires in ipchains will let your server get time, based on xntpd running and /etc/ntp.conf pointing to a valid time server.



-A input -s 192.168.0.10/0 -d 0/0 123 -p tcp -y -j ACCEPT
-A input -s 192.168.0.10/0 -d 0/0 123 -p udp -j ACCEPT

The numbered address should be changed to the actual time server. I don't know whether time uses tcp or udp, so I configured for both to save time.

Why specify one source, instead of any?

Why open yourself up. You point ntp to a specific time server, why would you accept data from a different one, without making a conscious decision.

I don't care how much work it takes and how big ipchains gets, I always try and specify source and destination to minimize my security exposure.

/etc/init.d/ipchains restart restarts the firewall.

Obviously this is a root only deal.