NTP with Solaris

mijohnst · 01-24-2007, 03:52 PM

I'm trying to setup an NTP server on one of my sun boxes, but I'm not getting it to work. It seems pretty strait forward but I seem to be missing something. Here is my procedure. Am I doing something wrong?

Code:

NTP Master
1. Create the file /etc/inet/ntp.conf with the following    
   entries:
   server 127.127.1.0
   driftfile /etc/ntp.drift
2. Create the file /etc/ntp.drift with the following entry:
   0.0
3. Bounce NTP service.
   #> /etc/rc2.d/S74xntd stop
   #> /etc/rc2.d/S74xntd start
4. Check Status
   #> ntpq
   ntpq> peers

NTP Clients
1. Create the file /etc/inet/ntp.conf with the following entries:
   server <NTP Master IP [do not use hostname]>
   driftfile /etc/ntp.drift
2. Create the file /etc/ntp.drift with the following entry:
   0.0
3. Bounce NTP service.
   #> /etc/rc2.d/S74xntd stop
   #> /etc/rc2.d/S74xntd start
4. Check Status
   #> ntpq
   ntpq> peers

When I get into ntpq and type peers I'm getting "Read: Connection Refused" when I try this on the server and the client that I'm testing on. Any suggestions would be great!

Mike Johnston

jlliagre · 01-24-2007, 10:58 PM

Are you sure of the 127.127.1.0 IP address ?

mijohnst · 01-24-2007, 11:02 PM

I was thinking it was 127.0.0.1, but according to the manuals I find it's correct. Could it be that the UDP port is blocked or something? Is there a file that you can edit to unblock ports? I know it uses UDP 123 and maybe that's what not being allowed or something...

Thanks for the help!

chort · 01-25-2007, 12:26 AM

After you start the xntpd service, do a netstat -an |grep 123 and see which interfaces it's listening on and what addresses it's bound to.

Personally, I would recommend OpenNTPD as it's much less complex than xntpd and it was designed with security from the ground-up, unlike the other NTP daemons that attempted to get precision accuracy and slapped on security later. Understandably, that's probably not supportable if you have to roll it out to a bunch of clients as a special package, rather than using what's bundled with Solaris, but it might make sense to use OpenNTPD as your daemons and only use xntpd for clients.

bathory · 01-25-2007, 02:12 AM

I suggest you to read this quick howto. If you want more details you can follow the links at the bottom, to the Sun's blueprint series.
I guess you problem is that you don't have a "broadcast 224.0.1.1.." in your conf file.

Dox Systems - Brian · 01-25-2007, 08:46 AM

Well, one thing I would recommend is to use svcadm to restart ntpd rather than bouncing it via the scripts.

The other item of note is that IIRC from my Cisco days... 127.0.0.0/8 is ALL reserved for localhost, but many server platforms only respond on 127.0.0.1.

mijohnst · 01-25-2007, 11:35 AM

Thanks for the suggestions all...

Almost there.

When I do a "netstat -an | grep 123" it doesn't come up with anything. Am I correct to think that that port is being blocked by something or it's disabled?

jlliagre · 01-25-2007, 11:39 AM

That just mean the service doesn't come up.

mijohnst · 01-25-2007, 02:04 PM

Oh... So even though I'm starting the service, it's not running. I don't get an error when I start it using "/etc/init.d/xntpd start" so I wonder what's killing it.

I also forgot to add in the previous post that broadcast 224.0.1.1 is in the ntp.config file. I've even tried it as multicastclient with no effect.

Dox Systems - Brian · 01-25-2007, 03:51 PM

What happens if you do a "svcadm enable xntpd" and then the netstat?

mijohnst · 01-26-2007, 10:26 AM

For some reason I don't have the "svcadm" tool on any of my machines. Is that an addon?

jlliagre · 01-26-2007, 11:02 AM

Yes, upgrade to Solaris 10 or later

mijohnst · 01-26-2007, 11:19 AM

Doh... I can't do that... It's very complicated but the short of it is that all our development is on version 8 so I can't change that... This is driving me crazy, but it should just work and I can't figure out why. From everything that I've read (thanks for the suggestions) I'm setting it up all correctly.

bathory · 01-26-2007, 04:09 PM

Just for reference, here is the /etc/inet/ntp.conf for the Solaris 9 sparc machine we use as ntp server:

Code:

server 127.127.1.0 prefer

broadcast 224.0.1.1 ttl 4

enable auth monitor
driftfile /var/ntp/ntp.drift
statsdir /var/ntp/ntpstats/

Note: driftfile and statsdir are under /var/ntp (I guess that's not a real problem in your case) and my ntp.drift contains "0.000"
Also take a look at /var/adm/messages to see if you find any error.

Hope that helps.

mijohnst · 01-29-2007, 01:24 PM

Well, looking at my configuration file I see that it is almost exactly like what you've posted bathory. The only thing missing was the ttl 4. I added that with the same result of it still not working. I also disabled the "Enable auth monitor" but that didn't help either. What a pain this is.