NTP Clients not sync

karlochacon · October 13, 2011, 8:51pm

hi guys

I have several Red Hat 5.7(7) all of them sync time with two NTP Servers based on Windows but the issue is I configure the NTP service, I start the ntp service and use ntpdate -u to set the time the first time

This is what I do

Configure /etc/ntp.conf

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

restrict 127.0.0.1
restrict -6 ::1

# Use public servers from the pool.ntp.org project.
server 101.122.3.111
server 101.122.6.112

broadcastdelay  0.008
authenticate no

server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10

keys /etc/ntp/keys

set the date

ntpdate -u NTP1 NTP2

Start the NTP daemon

service ntpd start

Add ntpd to bootup

chkconfig ntpd on

but today servers are one hour ahead of the ahead of the NTP Servers...

any idea why?
I configured NTP Server and Clients with no problem but in Linux-Linux Configuration now this time NTP Server are Windows servers but I don't think thats the issue since we have other Windows Servers that sync with these 2 NTP Servers and time is fine.

Am I missing something here?

thanks a lot

---------- Post updated at 08:51 PM ---------- Previous update was at 01:35 PM ----------

hi guys

I went onsite.

Some stuff I discovered today. First of all these Linux are Virtual Machines running on Hyper-V in case this is relevant I am mentioning.

Second these are 7 server.

1 Red Hat 5.7 x64 - Sync with external NTPs since it has internet access 0.rhel.pool.ntp.org - 1.rhel.pool.ntp.org This server is working just fine time is always OK. But at this time I don't why is that. I mean
is it because RH 5.7 has better time sync than RH 5.5? or is it because is using this public NTPs?

6 Red Hat 5.5 x64 - These are in a DMZ so they synchronize with 2 Windows Servers which are synchronizing with another NTP Servers in USA and these servers which are in USA are synchronizing with public NTPs like the ones above.

now let me show you some output of the ntpq -pn command

RH 5.7
As you can see NTP 38.229.71.1 is being used as NTP Server

remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
+184.22.51.42    128.118.25.5     2 u   57   64   37   36.844   -8.795  26.897
*38.229.71.1     172.16.65.22     2 u   52   64   37   91.484  -12.876  28.096
+71.252.219.43   69.25.96.13      2 u   47   64   37   84.564   -3.186  28.744
 127.127.1.0     .LOCL.          10 l   25   64   77    0.000    0.000   0.001

Now output from the servers where time goes fast
As you can see I waited for about 30-45 minutes and 127.127.1.0 always was the source
you know the 10.x.x.x should be elected in order to be an external NTP server to sync with but these 2 servers never got sync with the NTP servers configured in its ntp.conf

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 10.122.2.198    10.124.50.52     4 u  197 1024  377    1.079  -55406. 30150.0
 10.122.5.177    10.124.50.52     4 u  209 1024  377    0.849  -55135. 30095.1
*127.127.1.0     .LOCL.          10 l    1   64  377    0.000    0.000   0.001

    remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 10.122.2.198    10.124.50.52     4 u   20   64   37    1.011  -7434.2 3958.52
 10.122.5.177    10.124.50.52     4 u   20   64   37    1.205  -3130.6 2773.80
*127.127.1.0     .LOCL.          10 l   15   64   37    0.000    0.000   0.001

now /etc/ntp.conf is identical for RH 5.7 and RH 5.5 obviously NTP Servers changes.

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

restrict 127.0.0.1
restrict -6 ::1

RH 5.7
server 0.rhel.pool.ntp.org
server 1.rhel.pool.ntp.org

RH 5.5
server 10.122.2.198
server 10.122.5.177

server  127.127.1.0     # local clock
fudge   127.127.1.0 stratum 10

driftfile /var/lib/ntp/drift

keys /etc/ntp/keys

Final no errors in messages...
and iptables and ip6tables are stopped

any input or ideas guys?

thanks a lot

otheus · October 17, 2011, 11:50am

Redhat's default ntpd.conf configuration is pure shit. Don't use it. Don't even think about basing your config on it. Notably, remove the "server 127.127...." and fudge lines.
You're Windows NT time server is essentially a "tier 2" server. That server (and its mirror/failover) really sohuld be the only "server" lines you need here.
You're "restrict" lines may be in fact restricting your server from being modified by the time servers you want to in fact synchronize to. That's how you've set your default, and then you are permissive only with the localhost. So that wouldn't work.
If your server is not behnid a firewall which blocks incoming NTP from unknown servers, having the authentication enabled would be a smart idea. Having said that, it might be easier to config the firewall than to figure out ntp's very confusing authentication scheme.

fpmurphy · October 17, 2011, 5:09pm

Have to agree with you, Otheus. By the way, Red Hat will probably be switching from ntp to Chrony in some future release. Fedora 16 has switched to Chrony.