6.7. Configuring Autokey

This topic provides a step-by-step guide for setting up NTP Autokey Authentication. See the NTP Authentication specification and the Briefing Slides on the Network Time Synchronization Project page for in-depth information about NTP Authentication.

Links to other Autokey resources are available in 6.7.4. Related Links

There are three Identity Schemes available in the NTP Reference Implemenation: IFF, GQ, and MV. See the Identity Scheme documentation for detailed information about the Identity Schemes. Although examples of server parameter generation and client parameter installation are provided for all available Identity Schemes, it is not necessary to use all of them.

Enforcement of NTP Authentication (with restrict statements) is beyond the scope of this topic.

6.7.1.2.1. Broadcast and Multicast Autokey are configured on the server side. 6.7.2.2.1. Unicast Autokey is configured on the client side.

Perform the server set-up before performing the client set-up.

6.7.1. Server Set-Up

This section pertains only to systems that will be ntp servers for an NTP Trust Group; see 6.7.2. Client Set-Up for systems that will only be ntp clients. Trusted ntp servers which also operate as clients of other ntp servers may need to 6.7.2.4. Install Group/Client Keys.

6.7.1.1. Create the NTP Keys directory

Create a directory for the NTP Keys (e.g /etc/ntp.)

6.7.1.2. Edit ntp.conf

Add the following lines to ntp.conf:

crypto pw serverpassword
keysdir /etc/ntp

6.7.1.2.1. Broadcast and Multicast Autokey

Append autokey to the broadcast line in ntp.conf for the broadcast/multicast address that you want to authenticate with Autokey:

broadcast my.broadcast.or.multicast.address autokey

The assigned NTP Multicast address is 224.0.1.1, but other valid multicast addresses may be used.

6.7.1.3. Generate Server Parameters

This section covers Server Parameter generation for all Identity Schemes. You only need to generate the Server Parameters for the Identity Scheme(s) that you have chosen to use for your NTP Trust Group.

The server key and certificate will be generated if they are missing when a set of parameters are generated. The server certificate will be updated when existing parameters are updated or additional parameters are generated.

When you generate additional sets of parameters you must provide the serverpassword (as shown in 6.7.1.3.4. Multiple Identity Schemes) so that ntp-keygen can access the server key.

The -T option for ntp-keygen should only be used by a Trusted Authority (e.g time-server) for an NTP Trust Group.

6.7.1.3.1. IFF Parameters

The IFF parameter generation process produces a server key which should not be distributed to other members of the NTP Trust Group.

Generate the IFF parameters with the following commands:

cd /etc/ntp
ntp-keygen -T -I -p serverpassword

You must export an IFF Group Key for each client using that client's password. The client password is stored in the client ntp.conf in 6.7.2.2. Edit ntp.conf. You can share a group password with all clients, use individual passwords for each client, or no password at all. This exported IFF Group Key will be used in 6.7.2.4.1. IFF Group Keys

IFF Group Keys may be distributed through a Web Form or even by pasting them across terminal windows.

IFF Group Keys may also be extracted and mailed with the following commands:

cd /etc/ntp
ntp-keygen -e -q serverpassword -p clientpassword | mail timelord@client.domain

6.7.1.3.2. GQ Parameters

The GQ parameter generation process produces a key file which is shared between all members of an NTP Trust Group.

You must use the same crypto password on all members of an NTP Trust Group for the GQ Identity Scheme.

Generate the GQ parameters with the following commands:

cd /etc/ntp
ntp-keygen -T -G -p serverpassword

6.7.1.3.3. MV Parameters

The MV parameter generation process produces a server key, which must not be distributed to other members of the NTP Trust Group, and a number of client keys which are used in 6.7.2.4.3. MV Client Keys

When choosing the number of client keys avoid factors of 512 and don't exceed 30.

Generate the IFF parameters with the following commands (N-1 keys will be generated):

cd /etc/ntp
ntp-keygen -V N -p serverpassword.

6.7.1.3.4. Multiple Identity Schemes

Multiple Identity Schemes may be used simultaneously. Use the -q serverpassword option so that ntp-keygen can access the server key when generating additional sets of parameters as shown in the following example:

cd /etc/ntp
ntp-keygen -T -I -q serverpassword
ntp-keygen -T -G -q serverpassword
ntp-keygen -V 5 -q serverpassword

6.7.1.4. Restart ntpd

Restart ntpd. Watch the output of ntpq -p to make sure that the server is able to start.

6.7.1.5. Server Parameter Update

The server key and certificate are valid only for one year and should be updated periodically (e.g. monthly) with the following command:

cd /etc/ntp
ntp-keygen -T -q `awk '/crypto pw/ { print $3 }' </etc/ntp.conf`

6.7.2. Client Set-Up

This section pertains only to systems that will be clients of an NTP Trust Group.

6.7.2.1. Create the NTP Keys directory

Create a directory for the NTP Keys (e.g. /etc/ntp.)

6.7.2.2. Edit ntp.conf

Add the following lines to ntp.conf:

crypto pw clientpassword
keysdir /etc/ntp

6.7.2.2.1. Unicast Autokey

Append autokey to the server line for the time-server that you want to authenticate with Autokey in a unicast association:

server ntp.i_have_the_key.for autokey

6.7.2.3. Generate Client Parameters

Do not use the -T option for ntp-keygen on systems that are only clients of an NTP Trust Group.

Generate the client key /certificate with the following commands:

cd /etc/ntp
ntp-keygen -H -p clientpassword

6.7.2.4. Install Group/Client Keys

This section covers the installation of Group/Client Keys for all Identity Schemes. You only need to install the Group/Client Keys used by the NTP Trust Group that this client will be joining.

Group/Client Keys, and their associated passwords, should be regarded as confidential and not disseminated to others.

6.7.2.4.1. IFF Group Keys

Obtain the IFF group key, exported in 6.7.1.3.1. IFF Parameters via a secure means (e.g. an SSL Web Form or encrypted e-mail), copy the key file to the keysdir, and create the standard sym-link:

cd /etc/ntp
ln -s ntpkey_IFFkey_server.3301264563 ntpkey_iff_server 

It may be necessary to create the following sym-link:

cd /etc/ntp
ln -s ntpkey_host_client ntpkey_iff_client

6.7.2.4.2. GQ Group Keys

Obtain the GQ group key, generated in 6.7.1.3.2. GQ Parameters via a secure means, copy the key file to the keysdir, and create the standard sym-link:

cd /etc/ntp
ln -s ntpkey_GQpar_server.3301145293 ntpkey_gq_server

6.7.2.4.3. MV Client Keys

Obtain the MV client key, generated in 6.7.1.3.3. MV Parameters, via a secure means, copy the key file to the keysdir, and create the standard sym-link:

cd /etc/ntp
ln -s ntpkey_MVkey1_server.3301144193 ntpkey_mv_server

6.7.2.5. Restart ntpd

Restart ntpd. Watch the output of ntpq -p to make sure that the client is able to start and sync with the server.

6.7.2.6. Client Parameter Update

The client key and certificate are valid only for one year and should be updated periodically (e.g. monthly) with the following command:

cd /etc/ntp
ntp-keygen -q `awk '/crypto pw/ { print $3 }' </etc/ntp.conf`

6.7.3. Monitoring Authentication Status

Use ntpq -c as to the check the authentication status of ntp associations. Authenticated associations display ok in the auth column:

ind assID status  conf reach auth condition  last_event cnt
===========================================================
  1 26132  f694   yes   yes   ok   sys.peer   reachable  9

Use ntpq -c "rv 0 cert" to view the Autokey certificates held by ntpd.

6.7.4. Related Links

• Autokey Helper Script