How to: NTP Client
#### Why

Many security protocols leverage the time. If your system time is incorrect, it could have negative impacts to your server. An NTP client can solve that problem by keeping your system time in-sync with [global NTP servers](https://en.wikipedia.org/wiki/Network_Time_Protocol)

#### How It Works

NTP stands for Network Time Protocol. In the context of this guide, an NTP client on the server is used to update the server time with the official time pulled from official servers. Check https://www.pool.ntp.org/en/ for all of the public NTP servers.

#### Goals

- NTP client installed and keeping server time in-sync

#### References

- https://cloudpro.zone/index.php/2018/01/27/debian-9-3-server-setup-guide-part-4/
- https://en.wikipedia.org/wiki/Network_Time_Protocol
- https://www.pool.ntp.org/en/
- https://serverfault.com/questions/957302/securing-hardening-ntp-client-on-linux-servers-config-file/957450#957450
- https://tf.nist.gov/tf-cgi/servers.cgi

#### Steps

1. Install ntp.

    On Debian based systems:

    ``` bash
    sudo apt install ntp
    ```
    
1. Make a backup of the NTP client's configuration file `/etc/ntp.conf`:

    ``` bash
    sudo cp --archive /etc/ntpsec/ntp.conf /etc/ntpsec/ntp.conf-COPY-$(date +"%Y%m%d%H%M%S")
    ```

1. The default configuration, at least on Debian, is already pretty secure. The only thing we'll want to make sure is we're the `pool` directive and not any `server` directives. The `pool` directive allows the NTP client to stop using a server if it is unresponsive or serving bad time. Do this by commenting out all `server` directives and adding the below to `/etc/ntp.conf`.
	
    ```
    pool pool.ntp.org iburst
    ```
    
    [For the lazy](#editing-configuration-files---for-the-lazy):
    
    ``` bash
    sudo sed -i -r -e "s/^((server|pool).*)/# \1         # commented by $(whoami) on $(date +"%Y-%m-%d @ %H:%M:%S")/" /etc/ntp.conf
    echo -e "\npool pool.ntp.org iburst         # added by $(whoami) on $(date +"%Y-%m-%d @ %H:%M:%S")" | sudo tee -a /etc/ntp.conf
    ```

    **Example `/etc/ntp.conf`**:
    
    > ```
    > driftfile /var/lib/ntp/ntp.drift
    > statistics loopstats peerstats clockstats
    > filegen loopstats file loopstats type day enable
    > filegen peerstats file peerstats type day enable
    > filegen clockstats file clockstats type day enable
    > restrict -4 default kod notrap nomodify nopeer noquery limited
    > restrict -6 default kod notrap nomodify nopeer noquery limited
    > restrict 127.0.0.1
    > restrict ::1
    > restrict source notrap nomodify noquery
    > pool pool.ntp.org iburst         # added by user on 2019-03-09 @ 10:23:35
    > ```
    
1. Restart ntp:

    ``` bash
    sudo service ntp restart
    ```

1. Check the status of the ntp service:

    ``` bash
    sudo systemctl status ntp
    ```

    > ```
    > ● ntp.service - LSB: Start NTP daemon
    >    Loaded: loaded (/etc/init.d/ntp; generated; vendor preset: enabled)
    >    Active: active (running) since Sat 2019-03-09 15:19:46 EST; 4s ago
    >      Docs: man:systemd-sysv-generator(8)
    >   Process: 1016 ExecStop=/etc/init.d/ntp stop (code=exited, status=0/SUCCESS)
    >   Process: 1028 ExecStart=/etc/init.d/ntp start (code=exited, status=0/SUCCESS)
    >     Tasks: 2 (limit: 4915)
    >    CGroup: /system.slice/ntp.service
    >            └─1038 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 108:113
    > 
    > Mar 09 15:19:46 host ntpd[1038]: Listen and drop on 0 v6wildcard [::]:123
    > Mar 09 15:19:46 host ntpd[1038]: Listen and drop on 1 v4wildcard 0.0.0.0:123
    > Mar 09 15:19:46 host ntpd[1038]: Listen normally on 2 lo 127.0.0.1:123
    > Mar 09 15:19:46 host ntpd[1038]: Listen normally on 3 enp0s3 10.10.20.96:123
    > Mar 09 15:19:46 host ntpd[1038]: Listen normally on 4 lo [::1]:123
    > Mar 09 15:19:46 host ntpd[1038]: Listen normally on 5 enp0s3 [fe80::a00:27ff:feb6:ed8e%2]:123
    > Mar 09 15:19:46 host ntpd[1038]: Listening on routing socket on fd #22 for interface updates
    > Mar 09 15:19:47 host ntpd[1038]: Soliciting pool server 108.61.56.35
    > Mar 09 15:19:48 host ntpd[1038]: Soliciting pool server 69.89.207.199
    > Mar 09 15:19:49 host ntpd[1038]: Soliciting pool server 45.79.111.114
    > ```

1. Check ntp's status:

    ``` bash
    sudo ntpq -p
    ```

    > ```
    >      remote           refid      st t when poll reach   delay   offset  jitter
    > ==============================================================================
    >  pool.ntp.org    .POOL.          16 p    -   64    0    0.000    0.000   0.000
    > *lithium.constan 198.30.92.2      2 u    -   64    1   19.900    4.894   3.951
    >  ntp2.wiktel.com 212.215.1.157    2 u    2   64    1   48.061   -0.431   0.104
    > ```

([Table of Contents](#table-of-contents))