Can't Get NTP to work

caps_phisto · 11-09-2006, 12:41 PM

Hello,

I have been trying to get NTP to work on a local server of mine to allow Time Sync between my server and some workstations. The workstations are a mix of Slackware 11 machines and Windows XP SP2 machines.

Here is my /etc/ntp.conf

Code:

server pool.ntp.org
driftfile /etc/ntp/drift
multicastclient
broadcastdelay  0.008
restrict pool.ntp.org mask 255.255.255.255 nomodify notrap noquery   
restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap nopeer
restrict 127.0.0.1

On the Slackware machines when I run the following command

Code:

ntpdate -u <my server's ip>

I get the following error

Quote:

no server suitable for synchronization found

On the Windows XP SP2 machines I get the following error:

Quote:

The time sample has been rejected because: The peer's stratum is higher than the host's stratum

Firewalls have been turned off on both the NTP server and all clients to make sure that isn't an issue.

The NTP server can sync up with pool.ntp.org and the clients can all reach the Internet and ping my NTP server, so it doesn't seem to be a communications issue.

Any suggestions?

Thanks in advance.

fordeck · 11-09-2006, 01:23 PM

Have you checked to see if your ntp server is listening on port 123?

I think you should be able to telnet to your ntp server on port 123 and be able to get the time.

Code:

telnet <ntp_server> 123

This should echo back the time to you.

caps_phisto · 11-09-2006, 01:30 PM

Interesting. That didn't work but it made me wonder. I ran NMap against the box and curiously enough, port 123 is closed. even though NTPD is running and there is not firewall.

Thanks again.

fordeck · 11-09-2006, 02:53 PM

Just curious what your client's ntp.conf files look like? Perhaps you could post them.

caps_phisto · 11-15-2006, 02:08 PM

Well here is a quandry. I guess my server was really never working in the first place! It seems I used the ntpdate command to sync up then my config file was still setup to fudge my local clock and that is what my Slackware machines where using.

Anyways, as it turns out I can't get my server to sync up at all to any public NTP server. I get stratums of 16 and jitters of 4000 with the ntpq -p command. Although I can force my clock to match by using ntpdate as I stated earlier.

Here is my server's ntp.conf

Code:

server 0.pool.ntp.org
server 1.pool.ntp.org
server 2.pool.ntp.org

driftfile /etc/ntp/drift
multicastclient                 # listen on default 224.0.1.1
broadcastdelay  0.008

logfile /var/log/ntp/ntp.log

#  Restrict NTP Pools
restrict 0.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 1.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 2.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery

#  restrict Clients
restrict <my internal IP network> mask <Internal Mask to Match> nomodify notrap

restrict 127.0.0.1

Now the only problem I can see there is that my server is also in the pool of addresses for the clients, and perhaps it is being restricted because of the "nomodify" keyword. But I get the same results even if I comment that line out.

Thanks again!

fordeck · 11-15-2006, 04:48 PM

Here is something that might work.

Make sure the ntp daemon is not running.

/etc/init.d/ntpd stop ( or what ever you use on your distro )

check that your system is reasonably close by manually setting the date using the date command. That way there won't be a big difference between timeserver and your machine.

Try this configuration /etc/ntp.conf file:

Code:

## Default rules for all connections
restrict default nomodify notrap noquery

## Allow full access to the local host
restrict 127.0.0.1

## Your Client subnet
restrict <my internal IP network> mask <Internal Mask to Match> nomodify notrap

## Your time servers
server 0.north-america.pool.ntp.org
server 1.north-america.pool.ntp.org
server 2.north-america.pool.ntp.org

Now that you have the above configuration and ntpd is not running lets run the following command.

ntpdate us.pool.ntp.org

ntpdate will not run if ntpd is running.

Now start ntpd

/etc/init.d/ntpd start ( or what ever you use on your distro )

Let me know if that worked?

Regards,

Fordeck

caps_phisto · 11-16-2006, 03:01 PM

Sorry for the late reply.

As it turns out my configuration was setup correctly. Where I am there are technically 4 different groups who manage the network. I had put in a request to get NTP ports opened for my server. As it turned out the ports were put in initially. But whomever put them in forgot one simple command "copy run start". There was a different issue with a different group that caused them to reboot the router, and hence I lost my NTP openings. I didn't find out about it until today when the group that managed the firewall began complaining that a bunch of their changes weren't there.

Anywho thanks again!

---
Too many cooks spoil the broth