NTP client in Solaris 9

jlevie,

Thanks for the information. However I have tried that, as soon as I restart the ntpxd, the daemon will do the same thing. I never had same problem with Solaris 8 environment.

I'll have to play with this on one of my Solaris 9 boxes.

If you don't need to serve as  UTC reference for other hosts you could use "ntpdate"  running periodically from cron instead.
(1-2 hour interval)
Note that you would still want to use several references to avoid being fooled by a really insane ntp server.
ntpdate will set the system time regardless.. whereas xntpd won't  do anything if the system time differs enough from the UTC.

/b

..or you could perhaps use SunScreen to block access to port 123  on the other interfaces (?)
(I can't find anything in the man page of xntpd that enables binding to a specific interface)

Bummerlord,

Yes. I am using ntpdate to sync the time for now but I would like to find a correct way to implement the ntp client. I hope.

The correct way would be the way that keeps your system time ~correct.
Do you often loose connectivity to the Internet for long periods (dialup connection?), and you want to rely on the drift estimation maintained by ntpd rather then steping the time in larger chunks when ntpdate reaches a server again?
Or do you need to provide UTC for other internal hosts via this server as well (bypassing the firewall or whatever)?
I see no other real reason for using ntpd instead of ntpdate..  unless of course you are running a Sun cluster.

Anyway, the options you have seems to be
a) Filter the ports using a firewall software (e.g SunScreen or IPfilter)
b) Accept that port 123/udp accepts packets, and configure ntpd to _not_ send packets to _all_ IP addresses on the "other" interfaces.
(it's all in the man page about interface restrictions)
c) continue using ntpdate

To keep my servers time in sync, I use the following:
     /usr/sbin/ntpdate nist1.datum.com time.nist.gov time-a.nist.gov

you can add this to cron and have it run every hour:
     0 * * * *             /usr/sbin/ntpdate nist1.datum.com time.nist.gov time-a.nist.gov > /dev/null 2>&1

it works just as good and there is no need to open up your firewall.

Here is a good website for all the NIST atomic clocks you can add on the list
     http://www.boulder.nist.gov/timefreq/service/time-servers.html

they say the more servers you query, the more accurate your clock will be.

Hope this helps.

Yes, it's the way Coordinated Universal Time (UTC) protocol works. The more the merrier...

All reasonable correct servers are used to calculate an average time (network latency is taken into account).
If using ntpd to synch the clock you may use ntpq to query and set parameters for the local daemon.
E.g to list the configured peers with some status indications, you would issue the command "peers" in ntpq interactive mode, or say "ntpq -c peers"  in the shell prompt.
There will be a sign in the left margin (+,-,*,x) that tell if the peers reference is being used to calculate the time in your server or not.
+ means the server is included, * is for the prefered choice (best  offset in relation to network latency I think), - and x is for peers out of synch or with bad network connectivity (at least they're not used for some reason or another)

You'd defenately have better control over the situation using the daemon considering you can make some checks using ntpq.

Also, remeber to notify the admin of the servers you intend to use, and don't use the server unless you have got an OK back.
Heavily loaded servers have less chance of providing accurate reference, thus weakening the entrie idea of NTP... keep the admin informed so he/she can scale the service as appropriate (or tell you  to go elsewhere)

Thanks for all the ideas and recommendations. I am using the ntpdate to sync the time on the server before I came to here for help. I would like to close this issue but I do not know if I should accept any of these comments since I really did not use any of them. Please advise.

Im not sure I understand your question.

ntp is working, right, clock is adjusting  ?

But you say "it listens on ALL interfaces on port 123",
that´s not true.
Running as a multicastclient it listens on address
224.0.1.1 and this adressclass is only assigned to
the primary interface.
Run netstat -rn to see the routingtable.

When running as a broadcastclient it listens for the
hosts net.255 address which also are on the primary
interface.

I have a mixed env. with Solaris 7,8,9 Linux, XP, Me
and BSD  and it works pretty well, hm, forget Me and XP.
Why bother trying.

If your sysadm is that focused on security, make sure you
use encryption on clients. See man xntpd


HTH

Post a 0 point question into "community support" asking to have the points refunded.
Though if you use any of the information provided in the future, remember to buy be a beer ;-)
/b

No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

PAQ and refund

Please leave any comments here within the next four days.

PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

liddler
EE Cleanup Volunteer