Model: MTS200 (1U)
Doc. Ref. no. : - m08/om/201
Issue no.: 03
Page 123 of 195
User’s Manual
User have to do below changes in client ntp.conf file for receiving ntp broadcast packets.
# disable auth
crypto pw password
#Autokey
keysdir /etc/ntp
# public keys directory path
crypto randfile /dev/urandom
multicastclient
224.0.1.1 autokey
FUNCTIONALITY
NTP Broadcast or multicast should always be used with authentication to
avoid accidental or malicious disruption in this mode. Also, if there are
multiple MTS200 devices connected in same LAN, use any of the
MTS200 for ntp broadcast/multicast.
After changes to NTP broadcast parameters are done, NTP service need
to be restarted in order to changes to be in effect. User can check the
configuration by using “show ntp.conf” file option in webserver or option
“1” in NTP main menu in console based configuration utility.
For MTS200 dual Ethernet output operating in different network domain,
ntp driver will enable broadcast on second Ethernet output on broadcast
address as xxx.xxx.xxx.255 automatically if broadcast feature is not
disabled in configuration. Broadcast interval seconds and security
feature will be same as configured.
Multi
cast address always will be IP address “224.0.1.1” which is fixed
and reserved for NTP by IANA. If user configures any other reserved
multicast address other than mention, ntp driver will not start NTP
multicast considering this as fault address.
FF08::101 is the NTP Ipv6 Multicast address. User can configure
FF05::101, FF02::101. These are the IPv6 multicast address reserved for
Ipv6.
User need to take special care while configuring ntp clients operating in
NTP unicast and NTP broadcast mode at a time considering timing
accuracy requirement at ntp clients internal clock.
11.3.3.4 NTP Authentication
Authentication support allows the NTP client to verify that the server is in fact known and trusted and not
an intruder intending accidentally or on purpose to masquerade as that server. The NTPv3 specification
RFC-1305 defines an scheme which provides cryptographic authentication of received NTP packets.
Originally, this was done using the Data Encryption Standard (DES) algorithm operating in Cipher Block
Chaining (CBC) mode, commonly called DES-CBC. Subsequently, this was augmented by the RSA
Message Digest 5 (MD5) algorithm using a private key, commonly called keyed-MD5.
11.3.3.4.1 Symmetric Key Mechanism
The original RFC-1305 specification allows any one of possibly 65,534 keys, each distinguished by a 32-
bit key identifier, to authenticate an association. The servers and clients involved must agree on the key
and key identifier to authenticate their messages. Keys and related information are specified in a key file,
usually called ntp.keys, which should be exchanged and stored using secure procedures beyond the
scope of the NTP protocol itself. When ntpd is first started, it reads the key file specified int
he keys command and installs the keys in the key cache. However, the keys must be activated with
the trusted command before use.
