0

I'm struggling in regards of a proper practice for server setup for LDAP/AD authentication and NTP. I was thinking if asking two separate questions will be better but I think being a common problem here for two types of services would be a good reason to ask.

So, I have three domain controllers:

  • dc1.test.internal (on 192.168.0.2/24)
  • dc2.test.internal (on 192.168.0.3/24)
  • dc3.test.internal (on 192.168.0.4/24)

I want to use all of them for authentication and NTP synchronisation. Let's say I want to set up AD-based authentication on iLO (integrated Lights Out). I have to specify these servers and iLO lets me to do it one by one. This case is simple. Same goes for chronyd, I can specify multiple hosts, no problem.

What if a service does not let you to do so, for instance by letting you enter only one DC or NTP server? Can i make a set of A DNS entries named dcs.test.internal and point each of them to 192.168.0.2, 192.168.0.3 and 192.168.0.4? And set dcs.test.internal as a Directory Server in iLO settings? What about NTP? I've read something about Anycast NTP but I am not sure where to go with it.

Improve this question

3 Answers 3

Reset to default
2

Anycast is not needed or recommended for use with NTP - see the NTP Best Current Practice RFC. (I actually think the RFC does not go far enough and should explicitly recommend against anycast NTP if an all-active design is feasible.)

It's a common misconception about NTP that it should only have one source at a time and be able to fail over to another if that source is unavailable. Failover architectures for NTP are both suboptimal and unneccessary. Instead, you should use a design where all NTP sources are active all the time. I've written a summary of this in my blog, and you get more detailed info in the NTP docs.

The setup you suggested for DNS where the same name (in your case dcs.test.internal, or as Greg Askew suggested, the domain itself: test.internal) returns all the IP addresses of every available NTP server is the preferred way to configure NTP clients. This is what the NTP pool uses. Modern versions of chrony and ntpd (and various other client implementations) will automatically use all of the NTP servers and thus achieve greater accuracy as well as resilience.

Improve this answer
1

You already have a name. The domain name. You can create your own CNAMEs if you want. But if any DC DNS record is present but does not answer or an IP for a DC that is having issues, it is the responsibility of the client to make those adjustments and select a domain controller that is operational.

Improve this answer
2
  • Technically yes, but the problem is that the client doesn't always offer such option, hence i'm asking what to do in such situations.
    – Radosław Serba
    Mar 25 at 11:02
  • @suprovsky: What to do is the client must handle selection of an operation domain controller themselves.
    – Greg Askew
    Mar 25 at 12:24
0

There might be quite some sysadmins who would have faced this issue. who could have a better answer than me but here is my thought.

You could create a failover architecture between your windows servers base on the TCP/IP stack.

you would create a cluster of windows server with DC and NTP services enable. And you would have a single FQDN pointing to a single IP address (let's say 192.168.0.10).

With the 3 servers Online, dc1 would listen and answer when a packet inbound with 192.168.0.10 as destination Ip Address.

if dc1 would fail dc2 would take over and start answering when a packet arrive in the broadcast domain with 192.168.0.10 as destination Ip Address.

Microsoft describe two method :

https://learn.microsoft.com/en-us/windows-server/networking/technologies/network-load-balancing

https://learn.microsoft.com/en-us/windows-server/failover-clustering/failover-clustering-overview

Improve this answer
2
  • 2
    Failover designs for NTP are not the best way to configure it; see the links in my answer for more details.
    – Paul Gear
    Mar 25 at 1:10
  • 1
    Clustering and load balancers may work with NTP. They do not work with and aren't supported with Active Directory domain controllers for authentication/LDAP. In an Active Directory environment, consuming applications are responsible for managing the availability to domain controllers. This is why products such as iLO and VMare provide for the selection of two domain controllers. If one is unavailable, they try the other.
    – Greg Askew
    Mar 25 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.