2

My FreeIPA server's datetime had drifted about 10 min causing login failures. The ntpd service was functioning up and running. I checked the configuration and noticed that freeIPA had added a local server to synchronize the time in my ntpd.conf file.

This is what was added in ntpd.conf by FreeIPA:

### Added by IPA Installer ###
server 127.127.1.0 iburst
fudge 127.127.1.0 stratum 10

I also have the standard centos pools.

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

However, the ntpd service won't use the public ntp pools and won't correct the drift because it looks at the local ntpd server.

With the lines added from FreeIPA when I try to force ntpd to update its time this is what I get:

service ntpd stop
ntpd -gq
ntpd: time slew +0.000000s
service ntpd start

Removing the lines added to ntpd.conf by FreeIPA allows the update to work properly:

 service ntpd stop
 ntpd -gq
 ntpd: time set -543.065651s
 service ntpd start

So my question is:

  1. How do I make ntpd use the external ntpd clocks correctly?
  2. It seems that FreeIPA also made these changes to my clients (it points the ntp server to my ipa server and then sets a local ntpd server as well). Which also causes none of the clients to update properly, how would I go about properly fixing this?
  3. Can these added configurations of the local server just be removed? It seems that this is just holdover from years past? https://www.redhat.com/archives/freeipa-users/2013-February/msg00260.html

Full configuration:

# For more information about this file, see the man pages
# ntp.conf(5), ntp_acc(5), ntp_auth(5), ntp_clock(5), ntp_misc(5), ntp_mon(5).

driftfile /var/lib/ntp/drift

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default nomodify notrap nopeer noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1
restrict ::1

# Hosts on local network are less restricted.
#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap

# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst

#broadcast 192.168.1.255 autokey        # broadcast server
#broadcastclient                        # broadcast client
#broadcast 224.0.1.1 autokey            # multicast server
#multicastclient 224.0.1.1              # multicast client
#manycastserver 239.255.254.254         # manycast server
#manycastclient 239.255.254.254 autokey # manycast client

# Enable public key cryptography.
#crypto

includefile /etc/ntp/crypto/pw

# Key file containing the keys and key identifiers used when operating
# with symmetric key cryptography.
keys /etc/ntp/keys

# Specify the key identifiers which are trusted.
#trustedkey 4 8 42

# Specify the key identifier to use with the ntpdc utility.
#requestkey 8

# Specify the key identifier to use with the ntpq utility.
#controlkey 8

# Enable writing of statistics records.
#statistics clockstats cryptostats loopstats peerstats

# Disable the monitoring facility to prevent amplification attacks using ntpdc
# monlist command when default restrict does not include the noquery flag. See
# CVE-2013-5211 for more details.
# Note: Monitoring will not be disabled with the limited restriction flag.
disable monitor

### Added by IPA Installer ###

### Added by IPA Installer ###

### Added by IPA Installer ###
server 127.127.1.0 iburst
fudge 127.127.1.0 stratum 10
  • Which version of ntp is this using? That is an old config which you should certainly consider changing out for a newer one if you have a recent enough version. Specifically, removing all references to 127.127.1.0 would be recommended, along with adding restrict source notrap nomodify noquery and changing server to pool for the pool servers. – Paul Gear Nov 1 '18 at 23:08
2

With a fudge of 10, it really shouldn't be choosing the local clock.

You can try the prefer option with one of the server pools to try to force it to pick an internet time source:

server 0.centos.pool.ntp.org iburst prefer

After making the change and restarting the service, you should see an asterisk (*) next to the preferred pool when you run ntpq -pn to query the service's status.

  • Even adding prefer doesn't force it. It still shows after I restarted ntpd ntpq -pn *127.127.1.0 .LOCL. 10 l 1 64 1 0.000 0.000 0.000 – Kevin Vasko Oct 30 '18 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.