Page 68
12 The WEB Interface
controlkey 15
# key (mode 7) for accessing server variables
The keys parameter indicates the location of the le, in which all symmetric keys are stored. The trustedkey
line identies all key IDs, which have to be considered trusted or uncompromised. All other keys dened in the
keyle are considered compromised. This allows to re-use already owned keys by just adding their respective key
ID to the trustedkey parameter. If a key needs to be switched o, it can be removed from this line without
actually removing it from the system. This ensures an easy way to re-activate it later without actually transferring
the key again.
The line requestkey 15 declares the key ID for mode-6 control messages (as described in RFC-1305), which
are used by the ntpq utility for example. The controlkey parameter is specifying the key used for mode-7 private
control messages, for example used by the ntpdc utility. These keys protect the ntpd variables against unautho-
rised modication.
The ntp.keys le mentioned above holds a list of all keys and their respective ID known by the server. This
le should not be world-readable (only root should be able to look into this) and it may look like this:
# ntp keys le (ntp.keys)
1
N 29233E0461ECD6AE
# des key in NTP format
2
M RIrop8KPPvQvYotM
# md5 key as an ASCII random string
14
M sundial
# md5 key as an ASCII string
15
A sundial
# des key as an ASCII string
# the following 3 keys are identical
10
A SeCReT
10
N d3e54352e5548080
10
S a7cb86a4cba80101
The rst column holds the key ID (used in the ntp.conf le), the second column denes the format of the key,
which is following in column three. There are four dierent key formats:
•
A means DES key with up to eight 7-bit ASCII characters, where each character is standing for a key
octet (this is used by Unix passwords, too).
•
S is a DES key written in hexadecimal notation, where the lowest bit (LSB) of each octet is used as the
odd parity bit.
•
If the key format is specied as N, it also consists of a hexadecimal string, but in NTP standard format
by using the highest bit (HSB) of each octet used as the odd parity bit.
•
A key dened as M is a MD5 key with up to 31 ASCII characters.
•
The LANTIME supports MD5 authentication only.
•
Please be aware of the following restrictions: No #, t (tab), n (newline) and 0 (null) are allowed
in a DES or MD5 ASCII key. The key ID 0 is reserved for special purposes and should not appear in the
keys le.
12.6.2 NTP AUTOKEY
NTP Version 4 supports symmetric keys and additionally provides the so-called AUTOKEY feature. The authentic
of received time at the NTP clients is suciently ensured by the symmetric key technique. In order to achieve a
higher security, e.g. against so-called replay attacks, it is important to change the used crypto keys from time to
time.
In networks with a lot of clients, this can lead to a logistic problem, because the server key has to be changed
on every single client. To help the administrator to reduce this work (or even eliminate it completely), the NTP
developers invented the AUTOKEY feature, which works with a combination of group keys and public keys. All
NTP clients are able to verify the authentic of the time they received from the NTP servers of their own AU-
TOKEY group by using this AUTOKEY technique.
The AUTOKEY features works by creating so-called secure groups, in which NTP servers and clients are com-
bined. There are three dierent kinds of members in such a group:
68
Date: 31st July 2014
LANTIME M600 MRS
