Spectracom NetClock 9400 Series, User Reference Manual

Page: 128 / 467

Note: When you configure NTP Autokey, you must first disable the
NTP service in the NTP Services panel, then re- enable it after
Autokey configuration is completed.
Mark as Preferred : Check this box to prefer this NTP Peer over other NTP Peers
("NTP Peer Preference"). This will result in NetClock synchronizing more fre
quently with this Peer. For additional information on NTP Preferences, see "Con
figuring "NTP Stratum 1" Operation" on page 103.
Note:
Please note that it is not advisable to mark more than one NTP
Peer as Preferred , even though NetClock will not prevent you from
doing so.
5.
Click Submit, or press Enter.
2.15.9 NTP Authentication
Since NTP information is distributed across entire networks, NTP poses a security risk: Falsified
NTP time stamps or other NTP-related information can be exploited by an attacker. NTP authen
tication keys are used to authenticate time synchronization, thus detecting a fake time source
before it can do harm.
2.15.9.1 NTP Autokey
The NTP version installed on NetClock supports the Autokey Protocol. The Autokey Protocol uses
the OpenSSL library which provides security capabilities including message digests, digital sig
natures and encryption schemes. The Autokey Protocol provides a means for NTP to authen
ticate and establish a chain of trusted NTP servers.
NTP Autokey: Support & Limitations
Currently, NetClock supports only the IFF (Identify Friend or Foe) Autokey Identity Scheme. The
NetClock product web interface automates the configuration of the IFF using the MD5 digests
and RSA keys and certificates. At this time the configuration of other key types or other digests
is not supported.
Note: When you configure NTP Autokey, you must disable the NTP service first,
and then re-enable it after Autokey configuration is completed.
112
CHAPTER
2
•
NetClock User Reference Guide Rev. 16
2.15 Configuring NTP