Mengonfigurasi NTP Menggunakan ntpd

Network Time Protocol (NTP) memungkinkan penyebaran informasi waktu dan tanggal yang akurat untuk menjaga jam pada sistem komputer jaringan disinkronkan ke referensi umum melalui jaringan atau Internet. Banyak badan standar di seluruh dunia memiliki jam atom yang dapat disediakan sebagai referensi. Satelit yang membentuk Global Positioning System mengandung lebih dari satu jam atom, membuat sinyal waktu mereka berpotensi sangat akurat. Sinyal mereka dapat dengan sengaja didegradasi karena alasan militer. Situasi yang ideal adalah di mana setiap situs memiliki server, dengan jam referensinya sendiri terlampir, untuk bertindak sebagai server waktu di seluruh situs. Banyak perangkat yang memperoleh waktu dan tanggal melalui transmisi radio frekuensi rendah atau Global Positioning System (GPS) ada. Namun untuk sebagian besar situasi, berbagai server waktu yang dapat diakses publik yang terhubung ke Internet di lokasi yang tersebar secara geografis dapat digunakan. Server NTP ini menyediakan “Coordinated Universal Time” (UTC). Informasi tentang server waktu ini dapat ditemukan di www.pool.ntp.org.

Penyimpanan waktu yang akurat penting karena sejumlah alasan dalam TI. Dalam jaringan misalnya, stempel waktu yang akurat dalam paket dan log diperlukan. Log digunakan untuk menyelidiki masalah layanan dan keamanan sehingga stempel waktu yang dibuat pada sistem yang berbeda harus dibuat oleh jam yang disinkronkan agar bernilai nyata. Ketika sistem dan jaringan menjadi semakin cepat, ada kebutuhan yang sesuai untuk jam dengan akurasi dan resolusi yang lebih besar. Di beberapa negara ada kewajiban hukum untuk menjaga jam yang disinkronkan secara akurat. Silakan lihat www.ntp.org untuk informasi lebih lanjut. Dalam sistem Linux, NTP diimplementasikan oleh daemon yang berjalan di ruang pengguna. Daemon ruang pengguna NTP baku di Fedora Rawhide adalah chronyd. Itu harus dinonaktifkan jika Anda ingin menggunakan daemon ntpd. Lihat Mengonfigurasi NTP Memakai Keluarga chrony untuk informasi tentang chrony.

Daemon ruang pengguna memperbarui jam sistem, yang merupakan jam perangkat lunak yang berjalan di kernel. Linux menggunakan jam perangkat lunak sebagai jam sistemnya untuk resolusi yang lebih baik daripada jam perangkat keras tertanam biasa yang disebut sebagai “Real Time Clock” (RTC). Lihat halaman manual rtc(4) dan hwclock(8) untuk informasi tentang jam perangkat keras. Jam sistem dapat menjaga waktu dengan menggunakan berbagai sumber jam. Biasanya, Time Stamp Counter (TSC) digunakan. TSC adalah register CPU yang menghitung cacah siklus sejak terakhir kali disetel ulang. Ini sangat cepat, memiliki resolusi tinggi, dan tidak ada interupsi. Pada saat sistem mulai berjalan, jam sistem membaca waktu dan tanggal dari RTC. Waktu yang disimpan oleh RTC akan menjauh dari waktu aktual hingga 5 menit per bulan karena variasi suhu. Oleh karena itu perlunya jam sistem untuk terus disinkronkan dengan referensi waktu eksternal. Ketika jam sistem sedang disinkronkan oleh ntpd, kernel pada gilirannya akan memperbarui RTC setiap 11 menit secara otomatis.

Server NTP diklasifikasikan menurut jarak sinkronisasinya dari jam atom yang merupakan sumber sinyal waktu. Server dianggap diatur berlapis-lapis, atau strata, dari 1 di atas ke bawah hingga 15. Oleh karena itu kata stratum digunakan ketika mengacu pada lapisan tertentu. Jam atom disebut sebagai Stratum 0 karena ini adalah sumbernya, tetapi tidak ada paket Stratum 0 yang dikirim di Internet, semua jam atom stratum 0 melekat pada server yang disebut sebagai stratum 1. Server ini mengirimkan paket yang ditandai sebagai Stratum 1. Server yang disinkronkan melalui paket bertanda stratum n milik strata berikutnya yang lebih rendah, dan akan menandai paketnya sebagai stratum n+1. Server dari strata yang sama dapat bertukar paket satu sama lain tetapi masih ditetapkan sebagai milik hanya satu stratum, stratum satu di bawah referensi terbaik yang disinkronkan. Penunjukan Stratum 16 digunakan untuk menunjukkan bahwa server saat ini tidak disinkronkan ke sumber waktu yang dapat diandalkan.

Perhatikan bahwa secara baku klien NTP bertindak sebagai server untuk sistem dengan strata di bawahnya.

Berikut adalah ringkasan dari Strata NTP:

Proses ini berlanjut hingga Stratum 15 yang merupakan stratum valid terendah. Label Stratum 16 digunakan untuk menunjukkan keadaan yang tidak disinkronkan.

Versi NTP yang digunakan oleh Fedora adalah seperti yang dijelaskan dalam RFC 1305 Network Time Protocol (Versi 3) Specification, Implementation and Analysis dan RFC 5905 Network Time Protocol Version 4: Protocol and Algorithms Specification

Implementasi NTP ini memungkinkan akurasi sub-detik tercapai. Melalui Internet, akurasi hingga puluhan milidetik adalah normal. Pada Jaringan Area Lokal (LAN), akurasi 1 ms dimungkinkan dalam kondisi ideal. Ini karena penyimpangan jam sekarang diperhitungkan dan diperbaiki, yang tidak dilakukan dalam sistem protokol waktu versi lebih awal yang lebih sederhana. Resolusi 233 picoseconds disediakan dengan menggunakan stempel waktu 64-bit. 32-bit pertama dari stempel waktu digunakan untuk detik, 32-bit terakhir digunakan untuk pecahan detik.

NTP represents the time as a count of the number of seconds since 00:00 (midnight) 1 January, 1900 GMT. As 32-bits is used to count the seconds, this means the time will “roll over” in 2036. However NTP works on the difference between time stamps so this does not present the same level of problem as other implementations of time protocols have done. If a hardware clock that is within 68 years of the correct time is available at boot time then NTP will correctly interpret the current date. The NTP4 specification provides for an “Era Number” and an “Era Offset” which can be used to make software more robust when dealing with time lengths of more than 68 years. Note, please do not confuse this with the Unix Year 2038 problem.

The NTP protocol provides additional information to improve accuracy. Four time stamps are used to allow the calculation of round-trip time and server response time. In order for a system in its role as NTP client to synchronize with a reference time server, a packet is sent with an “originate time stamp”. When the packet arrives, the time server adds a “receive time stamp”. After processing the request for time and date information and just before returning the packet, it adds a “transmit time stamp”. When the returning packet arrives at the NTP client, a “receive time stamp” is generated. The client can now calculate the total round trip time and by subtracting the processing time derive the actual traveling time. By assuming the outgoing and return trips take equal time, the single-trip delay in receiving the NTP data is calculated. The full NTP algorithm is much more complex than presented here.

When a packet containing time information is received it is not immediately responded to, but is first subject to validation checks and then processed together with several other time samples to arrive at an estimate of the time. This is then compared to the system clock to determine the time offset, the difference between the system clock’s time and what ntpd has determined the time should be. The system clock is adjusted slowly, at most at a rate of 0.5ms per second, to reduce this offset by changing the frequency of the counter being used. It will take at least 2000 seconds to adjust the clock by 1 second using this method. This slow change is referred to as slewing and cannot go backwards. If the time offset of the clock is more than 128ms (the default setting), ntpd can “step” the clock forwards or backwards. If the time offset at system start is greater than 1000 seconds then the user, or an installation script, should make a manual adjustment. See Configuring the Date and Time. With the -g option to the ntpd command (used by default), any offset at system start will be corrected, but during normal operation only offsets of up to 1000 seconds will be corrected.

Some software may fail or produce an error if the time is changed backwards. For systems that are sensitive to step changes in the time, the threshold can be changed to 600s instead of 128ms using the -x option (unrelated to the -g option). Using the -x option to increase the stepping limit from 0.128s to 600s has a drawback because a different method of controlling the clock has to be used. It disables the kernel clock discipline and may have a negative impact on the clock accuracy. The -x option can be added to the /etc/sysconfig/ntpd configuration file.

The drift file is used to store the frequency offset between the system clock running at its nominal frequency and the frequency required to remain in synchronization with UTC. If present, the value contained in the drift file is read at system start and used to correct the clock source. Use of the drift file reduces the time required to achieve a stable and accurate time. The value is calculated, and the drift file replaced, once per hour by ntpd. The drift file is replaced, rather than just updated, and for this reason the drift file must be in a directory for which the ntpd has write permissions.

As NTP is entirely in UTC (Universal Time, Coordinated), Timezones and DST (Daylight Saving Time) are applied locally by the system. The file /etc/localtime is a copy of, or symlink to, a zone information file from /usr/share/zoneinfo. The RTC may be in localtime or in UTC, as specified by the 3rd line of /etc/adjtime, which will be one of LOCAL or UTC to indicate how the RTC clock has been set. Users can easily change this setting using the checkbox System Clock Uses UTC in the Date and Time graphical configuration tool. See Configuring the Date and Time for information on how to use that tool. Running the RTC in UTC is recommended to avoid various problems when daylight saving time is changed.

The operation of ntpd is explained in more detail in the man page ntpd(8). The resources section lists useful sources of information. See Additional Resources.

NTPv4 added support for the Autokey Security Architecture, which is based on public asymmetric cryptography while retaining support for symmetric key cryptography. The Autokey Security Architecture is described in RFC 5906 Network Time Protocol Version 4: Autokey Specification. The man page ntp_auth(5) describes the authentication options and commands for ntpd.

An attacker on the network can attempt to disrupt a service by sending NTP packets with incorrect time information. On systems using the public pool of NTP servers, this risk is mitigated by having more than three NTP servers in the list of public NTP servers in /etc/ntp.conf. If only one time source is compromised or spoofed, ntpd will ignore that source. You should conduct a risk assessment and consider the impact of incorrect time on your applications and organization. If you have internal time sources you should consider steps to protect the network over which the NTP packets are distributed. If you conduct a risk assessment and conclude that the risk is acceptable, and the impact to your applications minimal, then you can choose not to use authentication.

The broadcast and multicast modes require authentication by default. If you have decided to trust the network then you can disable authentication by using disable auth directive in the ntp.conf file. Alternatively, authentication needs to be configured by using SHA1 or MD5 symmetric keys, or by public (asymmetric) key cryptography using the Autokey scheme. The Autokey scheme for asymmetric cryptography is explained in the ntp_auth(8) man page and the generation of keys is explained in ntp-keygen(8). To implement symmetric key cryptography, see Configuring Symmetric Authentication Using a Key for an explanation of the key option.

Virtual machines cannot access a real hardware clock and a virtual clock is not stable enough as the stability is dependent on the host systems work load. For this reason, para-virtualized clocks should be provided by the virtualization application in use (for more information see Libvirt Managed Timers in the Virtualization Administration Guide). On Fedora with KVM the default clock source is kvm-clock. See the KVM guest timing management chapter of the Virtualization Host Configuration and Guest Installation Guide.

Greenwich Mean Time (GMT) was derived by measuring the solar day, which is dependent on the Earth’s rotation. When atomic clocks were first made, the potential for more accurate definitions of time became possible. In 1958, International Atomic Time (TAI) was introduced based on the more accurate and very stable atomic clocks. A more accurate astronomical time, Universal Time 1 (UT1), was also introduced to replace GMT. The atomic clocks are in fact far more stable than the rotation of the Earth and so the two times began to drift apart. For this reason UTC was introduced as a practical measure. It is kept within one second of UT1 but to avoid making many small trivial adjustments it was decided to introduce the concept of a leap second in order to reconcile the difference in a manageable way. The difference between UT1 and UTC is monitored until they drift apart by more than half a second. Then only is it deemed necessary to introduce a one second adjustment, forward or backward. Due to the erratic nature of the Earth’s rotational speed, the need for an adjustment cannot be predicted far into the future. The decision as to when to make an adjustment is made by the International Earth Rotation and Reference Systems Service (IERS). However, these announcements are important only to administrators of Stratum 1 servers because NTP transmits information about pending leap seconds and applies them automatically.

The daemon, ntpd, reads the configuration file at system start or when the service is restarted. The default location for the file is /etc/ntp.conf and you can view the file by entering the following command:

The configuration commands are explained briefly later in this chapter, see Configure NTP, and more verbosely in the ntp.conf(5) man page.

Here follows a brief explanation of the contents of the default configuration file:

If you change this be certain that the directory is writable by ntpd. The file contains one value used to adjust the system clock frequency after every system or service start. See Understanding the Drift File for more information.

Addresses within the range 127.0.0.0/8 are sometimes required by various processes or applications. As the “restrict default” line above prevents access to everything not explicitly allowed, access to the standard loopback address for IPv4 and IPv6 is permitted by means of the following lines:

Addresses can be added underneath if specifically required by another application.

Hosts on the local network are not permitted because of the “restrict default” line above. To change this, for example to allow hosts from the 192.0.2.0/24 network to query the time and statistics but nothing more, a line in the following format is required:

To allow unrestricted access from a specific host, for example 192.0.2.250/32, a line in the following format is required:

A mask of 255.255.255.255 is applied if none is specified.

The restrict commands are explained in the ntp_acc(5) man page.

The file will be read by the ntpd init script on service start. The default contents is as follows:

The -g option enables ntpd to ignore the offset limit of 1000s and attempt to synchronize the time even if the offset is larger than 1000s, but only on system start. Without that option ntpd will exit if the time offset is greater than 1000s. It will also exit after system start if the service is restarted and the offset is greater than 1000s even with the -g option.

In order to use ntpd the default user space daemon, chronyd, must be stopped and disabled. Issue the following command as root:

To prevent it restarting at system start, issue the following command as root:

To check the status of chronyd, issue the following command:

To check if ntpd is installed, enter the following command as root:

NTP is implemented by means of the daemon or service ntpd, which is contained within the ntp package.

To install ntpd, enter the following command as root:

To enable ntpd at system start, enter the following command as root:

To check if ntpd is running and configured to run at system start, issue the following command:

To obtain a brief status report from ntpd, issue the following command:

The NTP traffic consists of UDP packets on port 123 and needs to be permitted through network and host-based firewalls in order for NTP to function.

Check if the firewall is configured to allow incoming NTP traffic for clients using the graphical Firewall Configuration tool.

To start the graphical firewall-config tool, press the Super key to enter the Activities Overview, type firewall and then press Enter. The Firewall Configuration window opens. You will be prompted for your user password.

To start the graphical firewall configuration tool using the command line, enter the following command as root user:

The Firewall Configuration window opens. Note, this command can be run as normal user but you will then be prompted for the root password from time to time.

Cari kata “Terhubung” di sudut kiri bawah. Ini menunjukkan bahwa alat firewall-config terhubung ke daemon ruang pengguna, firewalld.

The purpose of the ntpdate service is to set the clock during system boot. This was used previously to ensure that the services started after ntpdate would have the correct time and not observe a jump in the clock. The use of ntpdate and the list of step-tickers is considered deprecated and so Fedora uses the -g option to the ntpd command and not ntpdate by default.

The ntpdate service in Fedora is mostly useful only when used alone without ntpd. With systemd, which starts services in parallel, enabling the ntpdate service will not ensure that other services started after it will have correct time unless they specify an ordering dependency on time-sync.target, which is provided by the ntpdate service. The ntp-wait service (in the ntp-perl subpackage) provides the time-sync target for the ntpd service. In order to ensure a service starts with correct time, add After=time-sync.target to the service and enable one of the services which provide the target (ntpdate or sntp, or ntp-wait if ntpd is enabled). Some services on Fedora have the dependency included by default ( for example, dhcpd, dhcpd6, and crond).

To check if the ntpdate service is enabled to run at system start, issue the following command:

To enable the service to run at system start, issue the following command as root:

In Fedora the default /etc/ntp/step-tickers file contains 0.fedora.pool.ntp.org. To configure additional ntpdate servers, using a text editor running as root, edit /etc/ntp/step-tickers. The number of servers listed is not very important as ntpdate will only use this to obtain the date information once when the system is starting. If you have an internal time server then use that host name for the first line. An additional host on the second line as a backup is sensible. The selection of backup servers and whether the second host is internal or external depends on your risk assessment. For example, what is the chance of any problem affecting the first server also affecting the second server? Would connectivity to an external server be more likely to be available than connectivity to internal servers in the event of a network failure disrupting access to the first server?

To change the default configuration of the NTP service, use a text editor running as root user to edit the /etc/ntp.conf file. This file is installed together with ntpd and is configured to use time servers from the Fedora pool by default. The man page ntp.conf(5) describes the command options that can be used in the configuration file apart from the access and rate limiting commands which are explained in the ntp_acc(5) man page.

To configure the system clock to update the hardware clock, also known as the real-time clock (RTC), once after executing ntpdate, add the following line to /etc/sysconfig/ntpdate:

To update the hardware clock from the system clock, issue the following command as root:

When the system clock is being synchronized by ntpd or chronyd, the kernel will in turn update the RTC every 11 minutes automatically.

To list the available clock sources on your system, issue the following commands:

In the above example, the kernel is using kvm-clock. This was selected at boot time as this is a virtual machine.

To override the default clock source, append the clocksource directive to the GRUB_CMDLINE_LINUX line in the /etc/default/grub file and rebuild the grub.cfg file. For example:

The available clock source is architecture dependent.

Bangun kembali berkas grub.cfg sebagai berikut:

Sumber informasi berikut menyediakan sumber daya tambahan mengenai NTP dan ntpd.