[SOLVED] NTP Problem

Xsane · 05-04-2014, 11:02 PM

Well, the GRC port scanner only checks tcp connections, so that is not a definitive test, but if you are dropping tcp connections on port 123 there is a good chance you are dropping udp as well. The ntptrace result supports that as possibility. Your ISP may be dropping 123, or your network could be.

You could check /etc/services for udp on port 123. Check your sys logs for information, ntpd does log messages there. Start ntpd from the command line with the -d (debug) option.

Have you tried rebooting your modem, router, and any other network nodes?

eloi · 05-05-2014, 05:17 AM

That grc.com looks for the external IP. It's probably reporting about ports on the ISP machine.

WilliamS · 05-05-2014, 06:33 AM

I always set shorewall to stealth all the incoming ports. AFAIK that's what a firewall is for.
Daemons open incoming ports when they run.

Finally got the time corrected. I think it was by adding this line to /etc/ntp.conf:

Code:

restrict 192.168.100.1 mask 255.255.255.0 nomodify notrap

The first number is the address of my satellite modem.
Then stopped ntpd and did:

Code:

ntpdate 0.ca.pool.ntp.org

but I tried it just now, and got:

Code:

# /etc/rc.d/rc.ntpd stop
Stopping NTP daemon...
bash-4.2# ntpdate 0.ca.pool.ntp.org
 5 May 07:29:42 ntpdate[7876]: no server suitable for synchronization found

eloi · 05-05-2014, 07:06 AM

Quote:

Originally Posted by WilliamS

I always set shorewall to stealth all the incoming ports. AFAIK that's what a firewall is for.
Daemons open incoming ports when they run.

You mean your firewall accepts just prestablished connections.

Quote:

Finally got the time corrected.

Well let's synchronize our clocks to make a toast with champagne!

Quote:

I think it was by adding this line to /etc/ntp.conf:

Code:

restrict 192.168.100.1 mask 255.255.255.0 nomodify notrap

The first number is the address of my satellite modem.

In default Slackware /etc/ntp.conf I have this:

# Don't serve time or stats to anyone else by default (more secure)
restrict default noquery nomodify

Like the comment says you are not serving time to internet. Perhaps that
avoids the need of incoming 123 port opened (just guessing).

Quote:

Then stopped ntpd and did:

Code:

ntpdate 0.ca.pool.ntp.org

but I tried it just now, and got:

Code:

# /etc/rc.d/rc.ntpd stop
Stopping NTP daemon...
bash-4.2# ntpdate 0.ca.pool.ntp.org
 5 May 07:29:42 ntpdate[7876]: no server suitable for synchronization found

Some times it happens. Try with:

ntpdate 1.ca.pool.ntp.org

or

ntpdate 2.ca.pool.ntp.org

or simply

ntpdate pool.ntp.org

WilliamS · 05-05-2014, 08:43 AM

Same as usual - ntpq -p gets the server names but nothing that can update the clock, while ntpdate gets nothing.

Xsane · 05-05-2014, 09:56 AM

Quote:

Originally Posted by eloi

That grc.com looks for the external IP. It's probably reporting about ports on the ISP machine.

It scans the IP you contact it with, which will be his modem's WAN IP.

Quote:

Originally Posted by WilliamS

I always set shorewall to stealth all the incoming ports. AFAIK that's what a firewall is for.

Sure, if you don't want ntpd to work.

Are you using a NAT router, and/or is one built into your modem? If yes, you will need to forward port 123 the machine you are running ntpd on. ntpd has no port configuration and requires unrestricted access to port 123 in both directions.

ntpdate can use unrestricted ports, that is why it works for you.

I believe Chrony and OpenNTPD are configurable to use unrestricted ports (above 1024), you could go that way also.

Google "+NAT +NTP", and you will find other people having the same problem you are.

michaelk · 05-05-2014, 10:30 AM

Quote:

Are you using a NAT router, and/or is one built into your modem? If yes, you will need to forward port 123 the machine you are running ntpd on.

As a general statement I disagree. Typically since the ntp traffic is outgoing first the router's firewall should "label" it as an established connection. However, like you stated there are others with similar problems. In an earlier post the OP ran ntpdate with the -d option which seemed to worked but uses an unprivileged port but does not update the system clock which is why the difference was still ~8 seconds. Have you tried just running:

ntpdate -u ca.pool.ntp.org

WilliamS · 05-05-2014, 10:40 AM

I reinstalled slackware-14.1 and tried to keep this as simple as possible unselected kde.

Put the servers in /etc/ntp.conf and did touch /etc/ntp/conf/drift.

Tried to start ntpd, was refused permission!

Please, someone with 14.1 and a working ntp tell me the correct permissions for all the parts of ntp.

BTW the BIOS clock is now showing UTC.
First time I've seen that, and don't know how to change it.

WilliamS · 05-05-2014, 10:52 AM

Code:

# /etc/rc.d/rc.ntpd stop
Stopping NTP daemon...
bash-4.2# ntpdate -u ca.pool.ntp.org
 5 May 11:45:44 ntpdate[1446]: step time server 206.108.0.132 offset -14400.750105 sec

...and the time on gkrellm changed from UTC to local time.

No firewall now, iptables are whatever the slackware installer set.
No LAN, no wifi, no router, and no port forwarding required in slackware-14.0

brianL · 05-05-2014, 10:52 AM

Quote:

Originally Posted by WilliamS

Tried to start ntpd, was refused permission!

What? As root?

Code:

su -

then:

Code:

/etc/rc.d/rc.ntpd start

Is that what you did?

WilliamS · 05-05-2014, 10:57 AM

Quote:

Originally Posted by brianL

What? As root?

Code:

su -

then:

Code:

/etc/rc.d/rc.ntpd start

Is that what you did?

Yes, as root, and that's what I did. This was first attempt to access after installation of slackware.
So I did chmod 755, but not sure if that is the right permission.

michaelk · 05-05-2014, 10:57 AM

Now try ntpdate without the -u.

If it does not work the problem could be caused by your ISP.

brianL · 05-05-2014, 11:02 AM

Ah, I missed a command out, between those two I used, I ran:

Code:

chmod +x /etc/rc.d/rc.ntpd

WilliamS · 05-05-2014, 11:09 AM

Quote:

Originally Posted by michaelk

Now try ntpdate without the -u.

If it does not work the problem could be caused by your ISP.

Code:

# /etc/rc.d/rc.ntpd stop 
Stopping NTP daemon...
bash-4.2# ntpdate ca.pool.ntp.org
 5 May 12:06:09 ntpdate[1736]: no server suitable for synchronization found

Will try ISP tech support.

tronayne · 05-05-2014, 11:10 AM

You need to do NTP stuff as root (or su -). In console, you can log in as root (and be really careful); if X is running and you use a terminal, make sure you're using a log in terminal (so you don't have just a $ prompt). You can "source" a non log in terminal:

Code:

# . /etc/profile

Here's everything:

Code:

ls -al /etc/ntp.conf /etc/rc.d/rc.ntpd /etc/ntp
-rw-r--r-- 1 root root 2613 May  1 11:25 /etc/ntp.conf
-rwxr-xr-x 1 root root 1481 Feb 13 17:45 /etc/rc.d/rc.ntpd*

/etc/ntp:
total 24
drwxr-xr-x   2 root root  4096 May  5 11:40 ./
drwxr-xr-x 102 root root 12288 May  3 11:27 ../
-rw-r--r--   1 root root     8 May  5 11:40 drift
-rw-------   1 root root    22 Feb 13 17:45 ntp.keys
-rw-r--r--   1 root root     0 Feb 13 17:45 step-tickers