6 ms·

Absolutely. I have a maxim - "Time and DNS - come back when both are fixed" Nowadays good sources of time are "free" - use them. If you can't manage your DNS

Absolutely. I have a maxim - "Time and DNS - come back when both are fixed" Nowadays good sources of time are "free" - use them. If you can't manage your DNS then hand in your nerd card. You should have A->PTR->A record sorted. The Windows DNS and DHCP make this embarrassingly easy to get right. Be careful about using OpenDNS and co which will happily respond to incorrect queries with their own IP addresses. For docs on using krb and Samba and co. see Gentoo and Arch wikis - lots of info there.

toomuchtodo 9y ago
Life Pro Tip: Never user virtual machines as NTP servers. https://serverfault.com/a/106509 https://serverfault.com/a/106509
- sk5t 9y ago
  I wouldn't shy away from serving SNTP from virtualized Windows domain controllers nowadays--it's okay for its designed purpose, although "good" time probably involves appliances / GPS or somesuch radio devices.
  - toomuchtodo 9y ago
    You can do it with a GPS receiver and a Raspberry Pi for ~$80. https://www.ntpsec.org/white-papers/stratum-1-microserver-howto/ https://www.ntpsec.org/white-papers/stratum-1-microserver-ho... http://www.satsignal.eu/ntp/Raspberry-Pi-NTP.html http://www.satsignal.eu/ntp/Raspberry-Pi-NTP.html https://hackaday.io/project/15137/instructions https://hackaday.io/project/15137/instructions Otherwise, if you're not interested in running your own hard, just use the NTP Pool service: http://www.pool.ntp.org/en/ http://www.pool.ntp.org/en/
    - sk5t 9y ago
      Aye, all good and worthy things. A Windows domain, however, typically establishes its own hierarchical time system (PDCe -> RWDCs (+ clients) -> RODCs (+ clients)), with only the PDCe relying on external time sources. Windows SNTP is not really designed for high precision/high accuracy anyway, so, you just kinda go "meh good enough" not too far into the adventure. Also the time management CLI tools stink.
      - deleted 9y ago
        [deleted]
      - hug 9y ago
        Whoever was responsible for naming the service "w32time" and naming the command to manage the configuration of that service "w32tm" should be fired out of a cannon into the sun.
    - asdfaoeu 9y ago
      I feel like the subset of computing applications that require accurate time doesn't intersect with the amount of applications where you want to rely on a raspberry pi and can get signals directly from a satellite (i.e. not in a DC). A more practical example would probably just be to find a professionally hosted stratum 1 server to sync off.
    - Already__Taken 9y ago
      Does this still work ok if GPS goes off?
      - toomuchtodo 9y ago
        You'll have drift if GPS is down. Then again, if GPS is down, your time server's drift is probably the least of your concerns.
        wbl 9y ago
        GPS reception can vary for reasons short of thermonuclear war. TXCO slaves are not that expensive.
        Already__Taken 9y ago
        These things do happen albeit fairly targeted https://www.ofcom.org.uk/spectrum/information/gps-jamming-exercises https://www.ofcom.org.uk/spectrum/information/gps-jamming-ex...
  - xenophonf 9y ago
    w32time supports proper NTP (albeit NTPv3), and Windows Server 2016/Windows 10 Anniversary is capable of 1-millisecond accuracy: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/windows-time-service/windows-2016-accurate-time https://docs.microsoft.com/en-us/windows-server/identity/ad-... But if that isn't good enough for you, you can easily replace w32time with the reference NTP implementation, which is what I do to all of my Hyper-V hosts and physical forest root PDCs: https://www.meinbergglobal.com/english/sw/ntp.htm https://www.meinbergglobal.com/english/sw/ntp.htm
- lstamour 9y ago
  Counterexample (somewhat): http://engineering.pivotal.io/post/ntp-costs-500/#adequate http://engineering.pivotal.io/post/ntp-costs-500/#adequate
  - toomuchtodo 9y ago
    "Disclaimer: we cherry-picked our best NTP server; our other servers aren’t as accurate. Our Hetzner server, via IPv6, is typically +4ms/-4ms, and via IPv4 is typically +10ms/-10ms, our AWS server +20ms/-20ms, and so is our Microsoft Azure server."
sk5t 9y ago
FWIW, I'm not aware of any Windows krb5 cases that rely on PTR records. In short: the client decides on the name of the service it wants to access, and then it asks the KDC for a ticket to talk to that service. I cut my teeth on Kerberos at CMU (sparc, old MacOS), then Solaris and Linux in the age where you might run into Heimdal, and then digging into it on Windows and AD revealed a lot of surprises, although not all of them were bad... er, that is to say, the errors were not more inscrutable than other implementations'. Most of the problems in Windows AD land revolved around bad time, and ignorant sysadmins butchering servicePrincipalName/userPrincipalName values.
TeMPOraL 9y ago
> If you can't manage your DNS then hand in your nerd card. Here you go :(. +---------------------------------------------------+ | NERD CARD | | ISSUED: 1988 LOCATION: INTERWEBZ | | | | This is to certify the card holder, | | | | TeMPOraL | | _____________________________________________ | | | | is a certified Nerd of | | | | [x] space [ ] cryptography | | [x] programming [ ] literature | | [ ] networking [ ] language | | | +---------------------------------------------------+ I do intend to take it back though. Any hints on good sources to grok DNS?
- chousuke 9y ago
  At what level do you want to understand things? I feel that getting the basics is best done by trying it out yourself, though a badly configured public server can be used to attack other people, so be mindful of who has access to your server when you're trying things out. If you just want the theory, Wikipedia is a pretty good resource for technical things. If you just want to see how DNS works, set up a server yourself. You could start with a simple caching one like unbound, and then get yourself a domain and set up a real server (eg. nsd or bind) for that. You could for example use Hurricane Electric's free DNS service as your main nameservers and make use of zone transfers and notifications to keep things up-to-date from your local server, giving you a small-scale "real-world" DNS setup.
  - TeMPOraL 9y ago
    > At what level do you want to understand things? What I know: DNS is a server that translates domains to IP addresses. A DNS entry maps domain name to some various properties like "A entry", "AAA entry", "CNAME entry", etc., most of which I don't know what they do. DNS servers are linked together by magic, to provide a somewhat-eventually-consistent global domain->IP mapping. What I want to know: How the whole thing works, what DNS properties ("entries") mean exactly and why, and eventually how to run my own DNS server. Thanks for the tips, sounds like a good starting point.

toomuchtodo 9y ago

Life Pro Tip: Never user virtual machines as NTP servers. https://serverfault.com/a/106509 https://serverfault.com/a/106509

sk5t 9y ago
I wouldn't shy away from serving SNTP from virtualized Windows domain controllers nowadays--it's okay for its designed purpose, although "good" time probably involves appliances / GPS or somesuch radio devices.
- toomuchtodo 9y ago
  You can do it with a GPS receiver and a Raspberry Pi for ~$80. https://www.ntpsec.org/white-papers/stratum-1-microserver-howto/ https://www.ntpsec.org/white-papers/stratum-1-microserver-ho... http://www.satsignal.eu/ntp/Raspberry-Pi-NTP.html http://www.satsignal.eu/ntp/Raspberry-Pi-NTP.html https://hackaday.io/project/15137/instructions https://hackaday.io/project/15137/instructions Otherwise, if you're not interested in running your own hard, just use the NTP Pool service: http://www.pool.ntp.org/en/ http://www.pool.ntp.org/en/
  - sk5t 9y ago
    Aye, all good and worthy things. A Windows domain, however, typically establishes its own hierarchical time system (PDCe -> RWDCs (+ clients) -> RODCs (+ clients)), with only the PDCe relying on external time sources. Windows SNTP is not really designed for high precision/high accuracy anyway, so, you just kinda go "meh good enough" not too far into the adventure. Also the time management CLI tools stink.
    - deleted 9y ago
      [deleted]
    - hug 9y ago
      Whoever was responsible for naming the service "w32time" and naming the command to manage the configuration of that service "w32tm" should be fired out of a cannon into the sun.
  - asdfaoeu 9y ago
    I feel like the subset of computing applications that require accurate time doesn't intersect with the amount of applications where you want to rely on a raspberry pi and can get signals directly from a satellite (i.e. not in a DC). A more practical example would probably just be to find a professionally hosted stratum 1 server to sync off.
  - Already__Taken 9y ago
    Does this still work ok if GPS goes off?
    - toomuchtodo 9y ago
      You'll have drift if GPS is down. Then again, if GPS is down, your time server's drift is probably the least of your concerns.
      - wbl 9y ago
        GPS reception can vary for reasons short of thermonuclear war. TXCO slaves are not that expensive.
      - Already__Taken 9y ago
        These things do happen albeit fairly targeted https://www.ofcom.org.uk/spectrum/information/gps-jamming-exercises https://www.ofcom.org.uk/spectrum/information/gps-jamming-ex...
- xenophonf 9y ago
  w32time supports proper NTP (albeit NTPv3), and Windows Server 2016/Windows 10 Anniversary is capable of 1-millisecond accuracy: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/windows-time-service/windows-2016-accurate-time https://docs.microsoft.com/en-us/windows-server/identity/ad-... But if that isn't good enough for you, you can easily replace w32time with the reference NTP implementation, which is what I do to all of my Hyper-V hosts and physical forest root PDCs: https://www.meinbergglobal.com/english/sw/ntp.htm https://www.meinbergglobal.com/english/sw/ntp.htm
lstamour 9y ago
Counterexample (somewhat): http://engineering.pivotal.io/post/ntp-costs-500/#adequate http://engineering.pivotal.io/post/ntp-costs-500/#adequate
- toomuchtodo 9y ago
  "Disclaimer: we cherry-picked our best NTP server; our other servers aren’t as accurate. Our Hetzner server, via IPv6, is typically +4ms/-4ms, and via IPv4 is typically +10ms/-10ms, our AWS server +20ms/-20ms, and so is our Microsoft Azure server."

sk5t 9y ago

FWIW, I'm not aware of any Windows krb5 cases that rely on PTR records. In short: the client decides on the name of the service it wants to access, and then it asks the KDC for a ticket to talk to that service. I cut my teeth on Kerberos at CMU (sparc, old MacOS), then Solaris and Linux in the age where you might run into Heimdal, and then digging into it on Windows and AD revealed a lot of surprises, although not all of them were bad... er, that is to say, the errors were not more inscrutable than other implementations'. Most of the problems in Windows AD land revolved around bad time, and ignorant sysadmins butchering servicePrincipalName/userPrincipalName values.

TeMPOraL 9y ago

> If you can't manage your DNS then hand in your nerd card. Here you go :(. +---------------------------------------------------+ | NERD CARD | | ISSUED: 1988 LOCATION: INTERWEBZ | | | | This is to certify the card holder, | | | | TeMPOraL | | _____________________________________________ | | | | is a certified Nerd of | | | | [x] space [ ] cryptography | | [x] programming [ ] literature | | [ ] networking [ ] language | | | +---------------------------------------------------+ I do intend to take it back though. Any hints on good sources to grok DNS?

chousuke 9y ago
At what level do you want to understand things? I feel that getting the basics is best done by trying it out yourself, though a badly configured public server can be used to attack other people, so be mindful of who has access to your server when you're trying things out. If you just want the theory, Wikipedia is a pretty good resource for technical things. If you just want to see how DNS works, set up a server yourself. You could start with a simple caching one like unbound, and then get yourself a domain and set up a real server (eg. nsd or bind) for that. You could for example use Hurricane Electric's free DNS service as your main nameservers and make use of zone transfers and notifications to keep things up-to-date from your local server, giving you a small-scale "real-world" DNS setup.
- TeMPOraL 9y ago
  > At what level do you want to understand things? What I know: DNS is a server that translates domains to IP addresses. A DNS entry maps domain name to some various properties like "A entry", "AAA entry", "CNAME entry", etc., most of which I don't know what they do. DNS servers are linked together by magic, to provide a somewhat-eventually-consistent global domain->IP mapping. What I want to know: How the whole thing works, what DNS properties ("entries") mean exactly and why, and eventually how to run my own DNS server. Thanks for the tips, sounds like a good starting point.