samba - Aug 2023 - samba4.18.5 + debian 12 + ntpsec

09.08.2023 20:26, Elias Pereira via samba ?????:
> hello,
> 
> The wiki configuration for ntp does not work with this
> configuration samba4.18.5 + debian 12 + ntpsec. At least for me, it
didn't
> work.
> 
> I had to remove the "notrap" and "mssntp" options so
that the Windows
> clients could synchronize with the DCs again.
> 
> # Access control
> # Default restriction: Allow clients only to query the time
> restrict default kod nomodify notrap nopeer limited mssntp
> 
> What is the implication regarding security in removing these options?
I think it is best to ask in a ntp-related place.

I'm very glad you made it to work, and thank you very much for
sharing your findings.

BTW, it's interesting that I never had issues with time
syncronisation in our network, - I've set up all machines to
syncronize to a pair of internal servers using ntp
(systemd-timesyncd), including the samba DCs and all
windows machines.  It seems like it just works.

/mjt

09.08.2023 20:41, Michael Tokarev ?????:
> 09.08.2023 20:26, Elias Pereira via samba ?????:
>> hello,
>>
>> The wiki configuration for ntp does not work with this
>> configuration samba4.18.5 + debian 12 + ntpsec. At least for me, it
didn't
>> work.
>>
>> I had to remove the "notrap" and "mssntp" options
so that the Windows
>> clients could synchronize with the DCs again.
>>
>> # Access control
>> # Default restriction: Allow clients only to query the time
>> restrict default kod nomodify notrap nopeer limited mssntp
FWIW, I have:
  restrict default kod nomodify nopeer noquery limited

and it works.  I think it is the config which got copied from
bullseye /etc/ntp.conf.

and there's nothing about [no]trap in man ntp.conf. Hmm.

/mjt