This article provides steps for configuring symmetric authentication for NTP time synchronization on ESXi hosts.
Please follow the steps mentioned below to configure symmetric authentication for NTP time synchronization on ESXi hosts:
To configure symmetric authentication using a key, the ESXi NTP '/etc/ntp.conf' file should include the following settings:
keys /etc/ntp.keys
trustedkey <keyno>
server ... key <keyno>
The keys need to be stored in the '/etc/ntp.keys' file in the format: <keyno> <type> <key>. Here, 'keyno' should be a positive integer (between 1 and 65535), 'type' should be the message digest or cipher algorithm, and 'key' should be the key itself.(Collect the key details from your Organization internal team)
To add or remove keys, the ESXi '/etc/ntp.keys' file needs to be edited directly using a text editor, such as vi.
5 MD5 abcdxxxxxxxxxxx
keys /etc/ntp.keys
trustedkey <keyno>
server ... key <keyno>
... <snip>
keys /etc/ntp.keys
trustedkey <keyno>
server ... key <keyno>
server <ntp.server1.ip>
server <ntp.server2.ip>
keys <path-to-server-keys-file>
trustedkey <keyno>
Please note that the client and server key files must both contain identical copies of the line specified by keyno.
To ensure that authenticated NTP is connecting successfully, please check that the 'auth' value for the server in the 'ntpq -c associations' output is 'ok'.
Example:
root@localhost:~] ntpq -c as
ind assid status conf reach auth condition last_event cnt
===========================================================
1 52115 f61a yes yes ok sys.peer sys_peer 1
2 52116 c011 yes no bad reject mobilize 1
3 52117 9014 yes yes none reject reachable 1