6

I am trying to setup the NTP server on Ubuntu machine. Am breaking my head in this particular issue.

Getting an error ntpdate[5005]: no server suitable for synchronization found when doing the command ntpdate.

Can anyone please help me out in this?


/etc/ntp.conf:

server 0.ubuntu.pool.ntp.org 
server 1.ubuntu.pool.ntp.org 
server 2.ubuntu.pool.ntp.org 
server 3.ubuntu.pool.ntp.org

Also when I gave command netstat -anltp | grep "LISTEN"

tcp    0   0 127.0.0.1:53            0.0.0.0:*         LISTEN   1816/dnsmasq
tcp    0   0 0.0.0.0:22              0.0.0.0:*         LISTEN   939/sshd
tcp    0   0 127.0.0.1:631           0.0.0.0:*         LISTEN   1013/cupsd
tcp    0   0 127.0.0.1:39558         0.0.0.0:*         LISTEN   5529/rsession
tcp    0   0 0.0.0.0:902             0.0.0.0:*         LISTEN   1275/vmware-authdla
tcp    0   0 127.0.0.1:47304         0.0.0.0:*         LISTEN   5822/rsession
tcp6   0   0 :::80                   :::*              LISTEN   1400/apache2
tcp6   0   0 :::22                   :::*              LISTEN   939/sshd
tcp6   0   0 ::1:631                 :::*              LISTEN   1013/cupsd

So what should I do so that it listens on 123?

If I get output as

PORT    STATE SERVICE
123/udp open  ntp

If I give command nmap -p 123 -sU -P0 192.168.36.198, it means UDP is open right? Then why doesn't it show in the command to to show listening ports?

9
  • 1
    Possible helpful topics on AU: askubuntu.com/questions/49401/… Also: NTP uses UDP. Can you check that your firewall allows outbound UDP packets on port 123?
    – Rinzwind
    Aug 27 '12 at 6:39
  • 2
    Can you add both to your question and remove the comments? :) netstat -anltp | grep "LISTEN" should show which ports are open.
    – Rinzwind
    Aug 27 '12 at 7:57
  • 1
    I gave command "sudo ufw allow 123/udp" to allow the udp access to port 123 ,but it still didnt work ..
    – Anups
    Aug 27 '12 at 8:42
  • 1
    Have you looked at: askubuntu.com/questions/148187/…
    – david6
    Aug 27 '12 at 9:22
  • 1
    Post output from 'ntpq -c rl'.
    – david6
    Aug 27 '12 at 10:10
3

The problem was coming from network default restrictions given in /etc/ntp.conf. You may have to uncomment the following lines in ntp server configuration file:

# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
#restrict 192.168.123.0 mask 255.255.255.0 notrust

to

# Clients from this (example!) subnet have unlimited access, but only if
# cryptographically authenticated.
restrict 192.168.123.0 mask 255.255.255.0
1

You may be being blocked from reaching ubuntu.pool.ntp.org


Try a different NTP server pool.

Ask your ISP (or Network Administrator) for a local NTP server (or cluster).

1

If you want to sync with external time ref you don't have to "listen".

Check if you can reach 0.ubuntu.pool.ntp.org (ping and nmap -p 123 -sU 0.ubuntu.pool.ntp.org)

0

This error appears when the ntp server tries to syncronize the local time using remote servers.

Check if your machine has Internet access and the port 123/UDP is not blocked:

If you want a ntp server without internet access you must not define servers at your ntp.conf file, you can comment it adding a # at the start of the line:

#server 0.ubuntu.pool.ntp.org 
#server 1.ubuntu.pool.ntp.org 
#server 2.ubuntu.pool.ntp.org 
#server 3.ubuntu.pool.ntp.org

You can get more info at: http://support.ntp.org/bin/view/Support/WebHome

0

I have give a detailed answer from top to bottom. You might want to skip to middle of my answer or just refer the screenshots below for understanding it in a glance.

You need to configure ntp with servers as follows:

You should at least set following parameter in /etc/ntp.conf config file: server

For example, open /etc/ntp.conf file using nano text editor:

  sudo nano /etc/ntp.conf

Locate server parameter and if it is empty set it as follows:

  server pool.ntp.org

But usually In ubuntu already some servers are prewritten which might be

server 0.ubuntu.pool.ntp.org
server 1.ubuntu.pool.ntp.org
server 2.ubuntu.pool.ntp.org
server 3.ubuntu.pool.ntp.org

enter image description here

Save the file and restart the ntpd service:

   /etc/init.d/ntpd start

You can synchronize the system clock to an NTP server immediately with following command:

   sudo ntpdate pool.ntp.org

or just run already servers are defined

sudo ntpdate 0.ubuntu.pool.ntp.org

or other servers that are defined using server

generally

sudo ntpdate <one of the servername in /etc/ntp.conf>

BUT after that there is a chance you get the Error NTP socket in use as shown below:

enter image description here

In that case just run

ntpdate -u pool.ntp.org 

to update when ntp deamon is running

OR just stop the deamon,update and start it again as follows:

$ sudo ntpdate pool.ntp.org
$ sudo service ntp stop
$ sudo ntpdate pool.ntp.org
$ sudo service ntp start

and you will get

enter image description here

0

I have a setup with a host and a client which had that error.

The host used to work, it's a VM and somehow it break on my last reboot. Now it has a hard time to keep time in the "Default" paravirtualization. Instead I have to use the "Minimal" version which doesn't work as well (it takes forever to reboot because it has issues with time...)

The issue is that if the NTP server is not able to properly synchronize, then it gives up and "disconnect" itself.

Here is an example of a well behaved NTP server:

$ ntpq -pn
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 1.ubuntu.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.008
 2.ubuntu.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.008
 3.ubuntu.pool.n .POOL.          16 p    -   64    0    0.000    0.000   0.008
 ntp.ubuntu.com  .POOL.          16 p    -   64    0    0.000    0.000   0.008
+23.175.208.10   239.9.71.195     2 u  845 1024  377   83.321   -1.074   2.255
+66.220.9.122    .CDMA.           1 u    4 1024  377   15.626   -1.183   2.644
+50.205.244.107  50.205.244.27    2 u  980 1024  377   65.114   -1.463   3.575
+173.255.215.209 80.72.67.48      3 u 1012 1024  377   16.956   -0.740   1.862
*163.237.218.19  .GPS.            1 u 1016 1024  377   63.002   -1.160   3.213
-91.189.89.198   17.253.34.253    2 u  616 1024  377  150.713    1.133   2.524

What we notice is an entry marked .GPS. which has an asterisk (*) in the first column. That means that time server is the used currently used to adjust your computer's time.

If there are no line with the *, then the NTP server is either not yet ready (it takes about 20 seconds on startup) or it tried to synchronize and wasn't able to. The ntpdate tests will fail with:

ntpdate[1234]: no server suitable for synchronization found

whenever either of these states are found.

In case of a VM, you are not really supposed to use an NTP server. I have to because I'm virtualizing a system which uses an NTP server and it's very important in that simulation. You can have very similar issues with a VM as with a normal host, but the VM added the VirtualBox extra code... (additional details).

In case of a Host, there are three main issues:

  1. In most cases, you have a firewall which blocks port 123. Note that this is UDP so the data has to go out and come back in.
  2. The name of the time servers is invalid (unlikely if you kept the default).
  3. Your hardware clock is defective (I never had such a problem, but I've heard of such--so it is really rare).

To test my firewall, I add LOG entries to tell me whether a hit is blocked. So before a DROP or REJECT rule, I place a LOG rule with the same parameters. That allows me to look at the logs and see whether certain hits are blocked.

As a side note, on my end I send the iptables logs to a separate file

# /etc/rsyslog.d/01-iptables.conf
:msg,contains,"[iptables] " /var/log/iptables/iptables.log
& stop

This way I can avoid the clutter in the /var/log/syslog and quickly find issues. The "[iptables] " works because I prefix my LOG messages with that string:

-A INPUT -i lo -j LOG --log-prefix "[iptables] reject_lo(in): " --log-uid
-A INPUT -i lo -j REJECT

If you can test without a firewall first, great, because that would be a lot faster to determine whether your firewall is the culprit. If you're not running any services on your computer, then that's safe:

$ sudo iptables -F

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.