12.6 Conguration: NTP
Page 69
a) Trusted Host
One or more trusted NTP servers. In order to become a trusted server, a NTP server must own a self-signed
certicate marked as trusted. It is good practice to operate the trusted hosts of a secure group at the lowest
stratum level (of this group).
b) Host
One ore more NTP servers, which do not own a trusted certicate, but only a self-signed certicate without
this trusted mark.
c) Client
One ore more NTP client systems, which in contrast to the above mentioned servers do not provide accurate time
to other systems in the secure group. They only receive time.
All members of this group (trusted hosts, hosts and clients) have to have the same group key. This group
key is generated by a so-called trusted authority (TA) and has to be deployed manually to all members of the
group by secure means (e.g. with the UNIX SCP command). The role of a TA can be fullled by one of the
trusted hosts of the group, but an external TA can be used, too.
The used public keys can be periodically re-created (there are menu functions for this available in the web
interface and also in the CLI setup program, see Generate new NTP public key in section NTP Autokey of the
Security Management page) and then distributed automatically to all members of the secure group. The group
key remains unchanged, therefore the manual update process for crypto keys for the secure group is eliminated.
A LANTIME can be a trusted authority / trusted host combination and also a non-trusted host in such a secure
group.
To congure the LANTIME as a TA / trusted host, enable the AUTOKEY feature and initialise the group
key via the HTTPS web interface (Generate groupkey) or CLI setup program. In order to create such a group
key, a crypto password has to be used in order to encrypt / decrypt the certicate. This crypto password is
shared between all group members and can be entered in the web interface and CLI setup program, too. After
generating the group key, you have to distribute it to all members of your secure group (and setup these systems
to use AUTOKEY, too). In the ntp.conf le of all group members you have to add the following lines (or change
them, if they are already included):
crypto pw cryptosecret
keysdir /etc/ntp/
In the above example cryptosecret is the crypto password, that has been used to create the group key and the
public key. Please note that the crypto password is included as a plain text password in the ntp.conf, therefore
this le should not be world-readable (only root should have read access to it).
On the clients, the server entries must be altered to enable the AUTOKEY feature for the connections to the
NTP servers of the group. This looks like:
server time.meinberg.de autokey version 4
server time2.meinberg.de
You nd the server time.meinberg.de which is using the AUTOKEY feature, while time2.meinberg.de is used
without any authentic checks.
If you want to setup the LANTIME server as a trusted host, but need to use a dierent trusted authority,
please create your own group key with this TA and include it with the web interface of your LANTIME (on page
Security Management see section NTP autokey , function Upload groupkey).
If you want to setup the LANTIME as a non-trusted NTP server, you have to upload the group key of your
secure group ( Security Management / NTP autokey / Upload groupkey) and create your own, self-signed
certicate (without marking it as trusted). Because every certicate which is creating by using the web interface
and/or CLI setup is marked trusted, you have to execute the tool ntp-keygen manually on your LANTIME by
LANTIME M600 MRS
Date: 31st July 2014
69
