Some guides I use when setting up NTP networks:
- It is a very good idea to configure at least two time-servers on your network. Set them up as peers (the line "peer [ipaddress]" in the ntp.conf), and if possible give them different external NTP hosts to sync from.
- Configure your clients to use all of your time-servers. In case one goes away, they'll still have good time and won't go out of sync during the outage of the one.
- Use either Autokey or symmetric key crypto between your peer servers.
- Set up appropriate acl lines in your ntp.conf file, allowing the peers to talk to each other, but all other clients only get NTP information and no control data.
The first point is to give your network resilience in the face of internet outages. When the internet connection goes out, your peer servers will maintain a consensual time between themselves and never go out-of-sync. Which means that your clients will not go out-of-sync. If time is important to you, this is a very good thing.
As for the ACL options, setting reasonable defaults will help prevent evil happening:
restrict default ignore #deny access to general internet, just 'cause
restrict 192.168.0.0 255.255.0.0 nomodify nopeer # allow restricted access to internal
restrict 192.168.202.202 #allow TimeHost1 full access
restrict 192.168.202.203 #allow TimeHost2 full access
restrict 192.168.200.158 nopeer #allow the admin workstation to make changes
This will allow clients the ability to use tools like ntpq to diagnose NTP problems, but won't allow it to change anything.
As for autokey vs. symmetric key, that depends on how robust you want your network. Setting appropriate ACL values should provide resistance to evil, but this would provide an added layer of protection against spoofing. Of the two, autokey is easier to set up, but symmetric is newer and more robust.