Network Time Protocol Server Configuration

Proper time synchronization on the CipherTrust Manager appliance is crucial for correct functioning of the following features:

• Configuring a Hardware Security Module (HSM) as Root of Trust

• Clustering multiple CipherTrust Managers

• Adding external connections to Connection Manager

• External user management protocols such as OpenID Connect (OIDC) or Lightweight Directory Access Protocol (LDAP).

• Client connector applications such as Data Discovery and Classification.

• Integrations with external clouds such as Google.

We strongly recommend configuring at least one Network Time Protocol (NTP) Server for the CipherTrust Manager immediately after deployment to ensure accurate time synchronization. In general, NTP Server configuration ensures that communications between a CipherTrust Manager and any external entity will work.

Add an NTP Server

For authenticated NTP servers, you must provide an encryption key. The supported key type digest algorithms are are MD5, SHA-1, SHA-256, SHA-384, or SHA-512. SHA-256 is the default value applied if you provide an encryption key but do not specify a key type digest algorithm.

If the NTP server is unauthenticated, the IP address or hostname is sufficient.

Add an NTP Server with ksctl CLI

Use the following command to add an NTP server:

ksctl ntp servers add --host <NTP_server_host_or_IP_address> [--key <encryption_key_material> --key-type <key_type _digest_algorithm> ]

For authenticated NTP servers, provide --key. You must additionally specify the key-type if the encryption key type digest algorithm is not SHA-256.

Add an NTP Server with CipherTrust Web UI

1. Navigate to Admin Settings > NTP.

2. Enter in an NTP Server hostname.

3. For an authenticated NTP Server, enter the following values:

   • In the NTP Key field, provide the symmetric key material.

   • Select the Key Type Digest Algorithm value from the drop-down list. The available algorithms are MD5, SHA-1, SHA-256, SHA-384, or SHA-512. SHA-256 is the default value applied if you do not make a selection.

4. Click the +Add NTP Server button.

Delete an NTP Server

In the CLI:

ksctl ntp servers add --host <NTP_server_host_or_IP_address>

In the UI:

1. Navigate to Admin Settings > NTP.

2. View the Configured NTP Servers, and find the server you wish to delete.

3. Click the trash can icon to the right of the server hostname or IP address.