Network Time Protocol is utilised by NTP server systems to distribute accurate time around a computer network. NTP is an Internet protocol solely used for the dissemination of time. By utilising a GPS or radio external reference clock, you can build a highly precise stratum 1 NTP Server for your network.
This article describes how to build and configure your very own stratum one NTP Server. By adding a relatively cheap GPS or radio time standards receiver to your Linux box, you can have your own precise NTP server. Your NTP server can be used to synchronize all the machines on your network to the precise time.
NTP is available as source code for compilation and configuration on a Linux machine. The source code freely downloadable from the NTP.org website. Many Linux distributions, such as Redhat and Debian have a pre-installed version of NTP. Many other Linux disto's provide NTP as a RPM.
In order to build a stratum one NTP server, you need an accurate external timing reference. Many timing references are available, most utilise GPS or national time and frequency radio sources such as WWVB, DCF77 and MSF. The Global Positioning System (GPS) is a great timing reference, since it is available worldwide and the equipment required for receiving time and positioning information is very low-cost.
Many GPS systems provide a serial port that can be connected to a PC serial port. The receiver generally provides continuous time and positioning information in a standard format known as NMEA. An NTP server can utilise the timing information provided by a NMEA receiver as an accurate timing reference. Some GPS receivers also provide a highly precise pulse per second (PPS) output that can be used as a highly accurate timing reference. Any timing pulse generated by a GPS receiver may need to be converted into a usable RS232 signal level. A TTL level pulse output can be converted to RS232 levels by feeding it into a RS232 driver.
Many radio based reference clocks are available that utilise national time and frequency standards. WWVB is a US radio time and frequency transmission, DCF77 is transmitted from Germany, MSF is available throughout the UK. The advantage of a radio signal as a reference clock for your NTP server is that you can usually pick up a good signal indoors, close to the NTP server. In contrast, GPS requires an antenna with a good view of the sky.
Once you have your NTP server external reference clock set-up and installed, you need to configure the clock in the NTP configuration file 'ntp.conf'. This usually involves finding and specifying the reference clock code for your timing reference. Once configured, your NTP server will act as an accurate source of time for your network time clients.
Many modern operating systems can use the Network Time Protocol to synchronize time. Linux and Unix machines can utilise the NTP distribution itself. Modern Windows operating systems such as XP and 2003 have pre-installed SNTP clients that can point to the IP address or DNS name of a NTP server for synchronisation. Many network devices such as routers and switches can also utilise your NTP server for synchronization.
Network Time Protocol (NTP) is used to advertise time to network time clients on an IP network. NTP is a UDP based protocol that is used to synchronise system time on network devices. This article describes how to utilise NTP authentication to authenticate a time reference when synchronising network time clients to a NTP server.
NTP Server Authentication
NTP is used to provide an accurate time reference for time critical processes. Therefore, NTP can pose a security risk if malicious users attempt to modify or replicate a timestamp to create a false time on a network device.
NTP authentication is intended to overcome security risks by ensuring that any response received from an NTP server has actually come from the intended reference. The client sends a request for time to a NTP server. The NTP server responds to the client with a timestamp along with one of a number of agreed encrypted keys. On receipt of the timestamp, the client un-encrypts the key and verifies it against a list of trusted keys. The client can then be sure that the received timestamp was indeed transmitted from the intended NTP server. NTP utilises MD5 encryption (Message Digest Encryption 5), which is a 128-bit cryptographic hash function, which outputs a fingerprint of the key. MD5 is a highly secure encryption, widely used on forums and by online communities for authentication purposes.
NTP Keys
NTP keys are codes that are encrypted on both the server and client that are used to identify the NTP server. NTP keys are stored in a file usually called ?ntp.keys'. Each key consists of a key number, an encryption code and the key itself.
E.g. NTP server keys:
1 M secret 5 M SeRvEr 7 M TiMeLy 10 M MYKEY 11 M TroPical 14 M MaGic
The key number acts as a reference to the specified key. The encryption code specifies the type of encryption to be utilised, e.g. ?M' for MD5 encryption. The actual keys must be identical on both the client and the NTP server. The client may utilise a sub-set of the keys specified on the NTP Server. The keys are case sensitive.
E.g. client keys:
5 M SeRvEr 7 M TiMeLy 10 M MYKEY 14 M MaGic
Trusted Keys
Trusted keys are specified in the NTP configuration file, ?ntp.conf'. Trusted keys specify which subset of keys are currently activeand can be used by the NTP server. This allows a sub-set of trusted keys to be selected from a potentially large keys file. Trusted keys are selected using the ?trusted-keys' configuration command.
E.g.
trusted-keys 5 7 14
This specifies that keys with the key references of 5, 7 and 14 are currently trusted and can be used by the NTP installation.
Summary
Essentially, authentication is used by the client to authenticate that the NTP server is who he says he is, and that no rogue server intervenes. The key is encrypted and sent to the client by the server where it is unencrypted and checked against the client keys to ensure a match.
David Evans has sinced written about articles on various topics from Computers and The Internet, Personal Desktop and Computers and The Internet. David Evans has been involved in the telecommunications and computer timing industry for a number of years. David is a technical author with a long history of involvement in installing and configuring NTP server systems. David has also provided a technica. David Evans's top article generates over 18100 views. to your Favourites.