Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can someone good at NTP configuration please share which method is the best/easiest to implement a secure, tamper-proof version of NTP? Here are some difficulties...

  1. I don't have the luxury of having my own stratum 0 time source, so must rely on external time servers.

  2. Should I read up on the AutoKey method or should I try to go the MD5 route?

  3. Based on what I know about symmetric cryptography, it seems that the MD5 method relies on a pre-agreed set of keys (symmetric cryptography) between the client and the server, and, so, is prone to man-in-the-middle attack.

  4. AutoKey, on the other hand, does not appear to work behind a NAT or a masquerading host. Is this still true, by the way? (This reference link is dated 2004, so I'm not sure what is the state of art today.)

    4.1 Are public AutoKey-talking time servers available?

  5. I browsed through the NTP book by David Mills. The book looks excellent in a way (coming from the NTP creator after all), but the information therein is also overwhelming. I just need to first configure a secure version of NTP and then may be later worry about its architectural and engineering underpinnings.

Can someone please wade me through these drowning NTP waters? Don't necessarily need a working config from you, just info on which NTP mode/config to try and may be also a public time server that supports that mode/config.

Many thanks,


share|improve this question
If you're very concerned about security and very accurate time recording, why not use a GPS dongle instead of NTP? – symcbean Nov 8 '10 at 9:30
No, the solution has to be NTP-based. It's not my product or company here that I can make such decisions. :-( But, thanks anyway for taking the time to write. – Harry Nov 8 '10 at 9:33
up vote 2 down vote accepted

The final answer is here.

Thanks actually to David Mills and Danny Mayer for answering the question.

share|improve this answer
Please summarize it here. That's in line with the wishes of this site and it would be helpful for me. – jnm2 May 31 at 14:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.