0:00–0:10
Recap
0:10–0:35
Lecture
0:35–1:50
Lab 2C
1:50–2:00
Debrief
0:00 – 0:10Recap · 10 min
From network control to invisible infrastructure
- Quick check: "You DROP a packet vs. REJECT it — what does the sender experience in each case?" Review briefly.
- Frame today: "S1's auth.log shows a failed SSH attempt at 14:32. S2's syslog shows the same IP connecting at 14:28. Are these related?" — you can't tell if the clocks aren't synchronised. Today we fix that, in a single day: server and clients both.
0:10 – 0:35Lecture · 25 min
Why time matters, the stratum hierarchy, and reading ntpq -p
- Why it matters (6 min): log correlation across servers, TLS certificate validity windows, Kerberos's 5-minute skew tolerance, scheduled tasks (cron, logrotate) relying on the system clock.
- timesyncd vs. ntpd (4 min): Ubuntu's default systemd-timesyncd is a lightweight SNTP client — fine for a consumer, but it can't serve time to others. Today S1 gets the full
ntp daemon (server + client); S2 and S3 stay on timesyncd, pointed at S1 instead of the internet.
- Stratum hierarchy (8 min): Stratum 0 = reference clocks (GPS, atomic — not directly reachable). Stratum 1 = directly connected to stratum 0. Stratum 2 = our S1, syncing to Canadian pool servers. Stratum 3 = S2/S3, syncing to S1. Stratum 16 = unsynchronised. Add one to the upstream stratum, every time.
- ntp.conf and ntpq -p (7 min):
pool entries resolve to multiple servers (better resilience) vs. a fixed server. restrict lines are ACLs. ntpq -p columns: remote (prefix *=selected, +=candidate, -/x=rejected), refid, st (stratum), t (type), when/poll/reach (377 octal = all 8 polls succeeded), delay/offset/jitter.
Instructor note: draw the stratum chain on the board — atomic clock → stratum 1 → S1 (2) → S2/S3 (3). Students who get this mental model understand immediately why centralising NTP on S1 makes sense.
0:35 – 1:50Lab 2C · 75 min
Lab 2C — Server on S1, clients on S2/S3, verified with ntpq -p and tcpdump
Part 1 — S1 as the NTP server (35 min)
- Set timezone (
sudo timedatectl set-timezone America/Winnipeg), disable timesyncd (sudo timedatectl set-ntp no), install ntp.
- Back up
/etc/ntp.conf, remove default pool/server lines, add the four Canadian pool entries with iburst: pool 0.ca.pool.ntp.org iburst (and 1/2/3). Review the default restrict lines already present.
- Restart NTP, wait, and run
ntpq -p — interpret all 10 columns per the lab sheet reference table until at least one server shows a * prefix.
Part 2 — S2/S3 as clients and restrict ACLs (40 min)
- On S2 and S3, edit
/etc/systemd/timesyncd.conf: NTP=[S1-IP], FallbackNTP=0.ca.pool.ntp.org. Restart timesyncd, verify with timedatectl timesync-status — should show stratum 3.
- Verify with tcpdump on S1:
sudo tcpdump -i eth1 -n udp port 123 and src host [S2-IP] while restarting timesyncd on S2 to force an immediate poll.
- Add restrict ACLs on S1 limiting queries to the LAN1 and LAN2 subnets:
restrict 192.168.50.0 mask 255.255.255.0 nomodify notrap (and the .51.0 equivalent for LAN2). Restart NTP and confirm both S2 and S3 still sync.
Optional take-home extension (on the handout): the host-specific restrict experiment (temporarily limiting S1 to S2 only and observing S3 fall back to FallbackNTP), and the written comparison of NTP restrict ACLs vs. firewall rules as layered defence. Good practice, not required today.
1:50 – 2:00Debrief · 10 min
- Confirm all three servers show consistent time. Ask: "S1 is stratum 2 — what stratum are S2 and S3?" — stratum 3.
- Preview Thursday: now that timestamps are reliable, we look at what gets written to the log files that use them — rsyslog, end to end, in a single day.
Learning outcomes — by end of Day 3, students can…
Build an NTP serverInstall and configure ntpd on S1 with Canadian pool servers, verified via ntpq -p
Configure NTP clientsPoint S2/S3 at S1 via timesyncd and verify stratum 3 with timedatectl timesync-status
Interpret ntpq -p outputExplain all 10 columns and identify the currently selected source
Write NTP restrict ACLsLimit query access to specific subnets
What you need ready before class
Lab 2C handout printed
Confirm ntp package available in apt