I have been tasked with getting an NTP client working on two Linux machines and an OpenBSD machine.

The machines are arranged like this:

    /       \
   /         \
 L1           L2
   \         /
    \       /

I have been told to configure L1 and L2 to route packets from OpenBSD to the NTPServer (ie not to set up a new stratum). The OpenBSD box cannot see the NTPServer (ie the network configuration prohibits this - from the OpenBSD box I can't even ping the IP address of the NTPServer).

Now the bad news: I am a J2EE programmer :) I don't have much of an idea on how to proceed.

Where do I begin? I'm not looking for a full solution as obviously people don't know the network configuration, just a few pointers as to where to start. I know Linux pretty well in terms of the stuff associated with J2EE (installing Tomcat/JBoss, setting them up as services etc) but network routing is really very new to me and has always scared me (ever since I had to write some Java code to detect a BGP flip).


Ok, thanks to Google I have made some progress. All the above is wrong (apart from me being a J2EE programmer)...

With use of ifconfig, routes show, traceroute, and some internal documentation, I now have the following diagram:

    |     \______________
    |                    \ (eth1)     |   
   L1                    | (eth0)       |
    |                    |
    |                    | (pcn1)       |
   OpenBSD               | (pcn0)       |
    |                    |
    |                    | (eth1) (eth0)

I have also checked the time on the three machines, and the Linux ones are correct while the OpenBSD one is wrong, so I think I just need to sort the routing out so that the OpenBSD box can get the time from NTP via either of the Linux boxes.

So, I think I need to add a route to the OpenBSD box to tell it that to get to our NTP server, it needs to go via L1 (it could also go via L2 but the diagram I have seen makes that look incorrect).

  • What exactly are the reasons to NOT set up NTP servers on the linux machines? – DaDaDom Dec 1 '10 at 8:34
  • I've not been given any specific reasons, but these machines are part of my employer's main internet facing servers, and they like to keep things under control (which is obviously why they asked a J2EE programmer to look at them). Therefore, perhaps they feel routing is better than installing more servers/opening more ports on them? – Rich Dec 1 '10 at 8:51
  • 1
    I'm not sure what you mean by "not to set up a new stratum". Does it mean "I may not make L1 and L2 into NTP clients bound to NTPServer, and have OpenBSD in turn bind to them"? If so, then this is a question about turning L1 and L2 into routers or bridges, not about NTP, and it would be helpful to know more about the existing network geometry (ip addresses, subnets, etc.) than the NTP config. By the way, routing's not as scary as you think; if you started with BGP you went in the deep end, most of it's a lot easier than that. – MadHatter Dec 1 '10 at 8:51
  • You are right, it sounds like a routing problem more than anything else. – Rich Dec 1 '10 at 9:35
  • So, could you update the question with some IP information? – MadHatter Dec 1 '10 at 9:50

Your comments above make sense. But if that's so, then I would really strongly advise your employer to reconsider his or her position on NTP on the linux boxes.

I don't think that having those boxes be properly-tied-down NTP clients is less secure than having them be properly-tied-down routers. I'm fairly sure that improperly-tied-down NTP clients are more secure than routers administered by someone who doesn't know how to find an IP address: with badly-tied-down NTP clients you can affect a system clock; with a badly-configured router, you can attack a whole network.

Please don't take that personally. It's not meant to be personal: your employers would be even more at-risk if they had me, a network and firewalls chap, write their J2EE code. I'd be making elementary programming blunders all over the place, introducing potential buffer overflows and handles for SQL injection attacks, and generally ruining their lives. Is it because I'm incompetent per se? No - it's because I'd've been told to do something I have no idea how to do, in a security-critical environment.

There's an old Pope quotation,

For forms of government let fools contest
Whate'er is best administered, is best

which I think also applies to technology. If you are that uncomfortable with networks, this is probably not the best place to start learning from scratch (and a single serverfault answer is not going to substitute for a proper course in IP). At the very least, if your employers insist on you solving this with routing, make them sign something that indemnifies you against any consequences of the routers being mis-configured; see if that focusses their minds on the mistake they're about to make.

| improve this answer | |
  • I've updated the question with some more IP information. Thanks for this answer though, it's reassuring (and not at all being taken personally!) – Rich Dec 1 '10 at 11:00
  • Accepted for your friendly advice! I've actually solved my problems in another question: serverfault.com/questions/208288/… – Rich Dec 2 '10 at 12:28
  • I hope you get the answer you want in the new question, and thanks for your broadmindedness (and the acceptance!). – MadHatter Dec 2 '10 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.