Installing and Administering Internet Services

222 Chapter 7
Configuring NTP
Configuration
servers that use a specified trusted key for encryption, and whose
authenticity is verified by successful decryption, are considered
synchronization candidates.
Figure 7-10 illustrates how authentication works.
Figure 7-10 Authentication Example
In the example in Figure 7-10, authentication is enabled for both
Penelope and Golden. An NTP time request from Penelope to Golden will
include authentication fields—the key ID 10, and a checksum encrypted
with the key corresponding to the key ID 10, “tickle.” When Golden
receives this request, it recomputes the checksum using the packet’s key
ID field (10) to look up the key for ID 10 in its key file (“tickle”) and
compares it to the authentication field in the request.
Golden will send back time information with the key ID 10 and a
checksum encrypted using “tickle.”
In addition, Penelope will only accept time synchronizations that have
used the key ID 10 and the corresponding encryption key “tickle.”
To enable authentication on the local host, include the following
statement in the /etc/ntp.conf configuration file:
authenticate yes
If the above statement is not specified, no authentication is used. When
authentication is enabled, the following keywords and parameters may
also be specified:
Penelope
Golden
/etc/ntp.keys
authenticate yes
/etc/ntp.keys
authenticate yes
NTP Packet
+
Key Num. (10)
+
Encrypted
Checksum
server golden key 10
keys /etc/ntp.keys
keys /etc/ntp.keys
server 127.127.1.1
key# Format Key
10 M tickle
key# Format Key
10 M tickle
trustedkey 10