|
Home > |
|---|
Network Time Protocol (NTP) corrects clock drift by synchronizing the appliance's internal clock with a reliable, consistent, and accurate time data server. This is the recommended method of keeping an accurate date and time on the appliance. SafeNet Network HSM uses NTPv4.
Note: This feature is not currently supported for use with IPv6 networks.
NTP is available from a variety of public servers. We recommend using a more secure NTP server that supports symmetric or public-key authentication, as described in Securing Your NTP Connection. Alternatively, your organization might have established its own NTP server(s). Contact your IT manager or security officer for details. For more information about NTP authentication, see References.
NTP will automatically synchronize with the highest-stratum server you add. If none of these servers are accessible, NTP will synchronize with the local clock, and may be subject to drift. To make manual drift corrections, see Correcting Clock Drift.
For command syntax, see sysconf ntp in the LunaSH Command Reference Guide.
Connections to public NTP servers are unauthenticated and therefore less secure. See Securing Your NTP Connection for authenticated NTP procedures.
1.Ensure that NTP is enabled on the appliance.
lunash:>sysconf ntp enable
2.Add an NTP server.
lunash:>sysconf ntp addserver <NTPserver>
3.Check the NTP connection.
lunash:>sysconf ntp status
Note: It may take a few minutes to synchronize the NTP server. Checking immediately may return an error.
NTPv4 supports two types of trusted authentication: symmetric or public-key (AutoKey). Both methods require access to NTP servers configured to support authentication.
This method uses a shared secret held by both the NTP server and its client to establish a trusted connection.
1.Obtain the necessary key material from your NTP server administrator. For security purposes, this may be obtainable through non-electronic means only.
2.Add the symmetric key information using LunaSH:
lunash:>sysconf ntp symmetricauth key add -id <keyID> -type <keytype> -value <NTPkey>
3.Add the key ID from step 2 to the list of trusted keys:
lunash:>sysconf ntp symmetricauth trustedkeys add <keyID>
4.Add the trusted NTP server, using the -key option to enter the key ID for that server:
lunash:>sysconf ntp addserver <NTPserver> -key <keyID>
5.Check the NTP connection:
lunash:>sysconf ntp status
This method uses asymmetric keys held by the NTP server and client. An identity scheme is used to prove the identity of the NTP server.
1.Obtain an identity scheme from the secure NTP server (IFF, GQ, or MV key). It must be scp'd to the SafeNet Network HSM and installed:
lunash:>sysconf ntp autokeyAuth install -idscheme <IDscheme> -keyfile <filename>
2.Restart NTP:
lunash:>service restart ntp
3.Generate an AutoKey and set a password:
lunash:>sysconf ntp autokeyauth generate -password <password>
4.Restart NTP again:
lunash:>service restart ntp
5.Add the trusted NTP server using the -autokey option:
lunash:>sysconf ntp addserver <NTPserver> -autokey
6.Check the NTP connection:
lunash:>sysconf ntp status
[1] NTP Documentation Page: http://www.ntp.org/documentation.html
[2] NTP FAQ: Authentication http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm#S-CONFIG-ADV-AUTH
[3] NTP Public-Key Authentication: http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm#Q-CONFIG-ADV-AUTH-AUTOKEY
[4] Autokey Identity Schemes: http://www.eecis.udel.edu/~mills/ident.html
[5] ntp-keygen tool: http://doc.ntp.org/4.2.6/keygen.html
[6] NTP Server configuration options http://doc.ntp.org/4.2.6/confopt.html