1

We currently have setting to sync time when spread is more than 5 mins, but it's getting to a point where some applications don't accept it. What is best practice out there to sync time for all windows and unix boxes to sync with time server or domain controller.

Windows time service is not made for high accuracy less then 10 secs. What are alternatives ?

2
  • While time synchronization is important in most networks and critical in some, may I ask why it appears to be so critical in yours?
    – joeqwerty
    Dec 23, 2009 at 2:43
  • @joeqwerty Timestamped authentication tokens with a very short lifetime to prevent replay attacks - if the time is too far out, authentication never succeeds?
    – Andrew
    May 21, 2010 at 0:08

6 Answers 6

9

Network Time Protocol (NTP). If you're a big shop (for some suitable definition of big), set up your own redundant set of ntp servers which sync from some outside source, and the configure the rest of your machines to synchronize against your own ntp server.

For a small shop, just sync directly from pool.ntp.org or somesuch.

For windows, AFAIK the AD domain members out-of-the-box sync against the domain controllers, so the problem reduces to configuring the DC's to sync against some outside source.

Alternatively, you can have your own GPS clock or somesuch as an internal stratum-0 source.

6
  • You meant Stratum-1 or 2 correct?
    – dbasnett
    May 19, 2010 at 20:27
  • @dbasnett: No, I did not.
    – janneb
    May 20, 2010 at 11:16
  • @janneb - The number after Stratum refers to the distance from the reference clock. Stratum 1 means that it is directly attached to a Stratum 0 reference clock. Stratum 0 clocks are expensive and few in number.
    – dbasnett
    May 20, 2010 at 17:41
  • @dbasnett: Yes, I know what stratum means. Which is why I wrote that in case one for some reason don't want to synchronize from some external NTP server(s), one can setup a stratum-0 source for internal use. The price for such a thing can vary from < $100 for a GPS receiver to, well, a lot for a high-precision atomic clock.
    – janneb
    May 20, 2010 at 20:25
  • @janneb - I think we are talking about different things. I am / have been talking about highly accurate time sources. From your perspective, and I think by definition, anything providing time is Stratum 0. NTP doesn't have Stratum 0 messages, so if you have a "Stratum 0" reference clock you will need to take the output directly. Sorry about my confusion.
    – dbasnett
    May 20, 2010 at 20:56
3

As others have said, you need to have a single authoritative source on your network, either externally or internally (which would, in turn, poll externally).

We have a large client who hosts all their servers (DCs, file/print, web etc) out of a datacentre.

The firewall polls externally to some time server (eg time.nist.gov). The ESX hosts poll the firewall The domain controllers (VMs) get their time from the ESX hosts All branch offices (VPN links into the d/c) are on the domain and so sync with the DCs.

I have seen some issues with virtual machines that have their time set to sync from the ESX hosts but are member servers on a domain and also try to sync with the DCs. In this case, the best practise is to disable Windows time sync and just go from the ESX hosts.

2

Set them all up to sync online at a time web service. or you can setup one server in your network to be the time god. Yes NTP is the answer.

0

Your domain controller is an NTP server (unless you've disabled the feature, or your Windows version is old enough that this isn't enabled by default) -- use an NTP client for all operating systems to sync. The standard ntpd included or available for Unix systems is sufficient; Windows includes an NTP client as well.

1
  • Default time spead by windows is 5 mins. Is there a problem if we reduce it to less than 1 min ?
    – ak
    Dec 22, 2009 at 20:07
0

If you're a Cisco-house I'd be tempted to use your routers and switches as your NTP source, not only is the NTPd code really secure and robust but the way we've done it every device's default gateway is also their NTP source - works a treat!

0

From (ANSI/T1.101)

Stratum 1 is defined as a completely autonomous source of timing, which has no other input, other than perhaps a yearly calibration. The usual source of Stratum 1 timing is an atomic standard (Cesium Beam or Hydrogen Maser) or reference oscillator (OCXO). The minimum adjustable range and maximum drift is defined as a fractional frequency offset f/f of 1 x 10-11 or less. At this minimum accuracy, a properly calibrated source will provide bit-stream timing that will not slip relative to an absolute or perfect standard more than once every 4 to 5 months. Atomic standards, such as Cesium clocks, have far better performance.

A Stratum 1 clock is an example of a Primary Reference Source (PRS) as defined in ANSI/T1.101. Alternatively, a PRS source can be a clock system employing direct control from Coordinated Universal Time(UTC) frequency and time services, such as Global Positioning System (GPS) navigational systems. The GPS System may be used to provide high accuracy, low cost timing of Stratum 1 quality.

A Stratum 2 clock system tracks an input under normal operating conditions, and holds to the last best estimate of the input reference frequency during impaired operating conditions. A Stratum 2 clock system requires a minimum adjustment (tracking) range of 1.6 x 10-8. The drift of a Stratum 2 with no input reference is less than 1.6 x 10-8 in one year. The short-term drift of the system is less than 1 x 10-10 in 24 hours. If one interprets this specification as a drift of 1 x 10-10 each 24 hours, this amounts to a frame slip rate of approximately 1 slip in 7 days when the Stratum 2 clock system is in the hold mode. A Stratum 2 clock with a drift of less than 2.5 x 10-11 per day will result in a time to the first frame slip of more than 2 months. Typical examples of Stratum 2 clocks are Rubidium Standards and Double Oven OCXO’s.

etc.

You must log in to answer this question.