Chapter 3: Timestamping – NTP and Clock Drift
lunash:>
sysconf ntp status
NOTE
It may take a few minutes to synchronize the NTP server. Checking immediately may
return an error.
Securing Your NTP Connection
NTPv4 supports two types of trusted authentication: symmetric or public-key (AutoKey). Both methods require
access to NTP servers configured to support authentication.
Using Symmetric-Key Authentication
This method uses a shared secret held by both the NTP server and its client to establish a trusted connection.
To connect to a trusted NTP server using symmetric-key authentication:
1.
Obtain the necessary key material from your NTP server administrator. For security purposes, this may be
obtainable through non-electronic means only.
2.
Add the symmetric key information using LunaSH:
lunash:>
sysconf ntp symmetricauth key add -id
<keyID>
-type
<keytype>
-value
<NTPkey>
3.
Add the key ID from step 2 to the list of trusted keys:
lunash:>
sysconf ntp symmetricauth trustedkeys add
<keyID>
4.
Add the trusted NTP server, using the
-key
option to enter the key ID for that server:
lunash:>
sysconf ntp addserver
<NTPserver>
-key
<keyID>
5.
Check the NTP connection:
lunash:>
sysconf ntp status
Using Public-Key (AutoKey) Authentication
This method uses asymmetric keys held by the NTP server and client. An identity scheme is used to prove the
identity of the NTP server.
To connect to a trusted NTP server using public-key (Autokey) authentication:
1.
Obtain an identity scheme from the secure NTP server (IFF, GQ, or MV key). It must be
scp
'd to the
SafeNet Luna Network HSM and installed:
lunash:>
sysconf ntp autokeyAuth install -idscheme
<IDscheme>
-keyfile
<filename>
2.
Restart NTP:
lunash:>
service restart ntp
3.
Generate an AutoKey and set a password:
lunash:>
sysconf ntp autokeyauth generate -password
<password>
4.
Restart NTP again:
lunash:>
service restart ntp
5.
Add the trusted NTP server using the
-autokey
option:
SafeNet Luna Network HSM 7.3 Appliance Administration Guide
007-013576-005 Rev. A 13 December 2019 Copyright 2001-2019 Thales
44
