pfSense

PR has been merged. Thanks!

after configuring ntpd authentication on Debian peer I can see packets with MAC:

Network Time Protocol (NTP Version 4, server)
    Flags: 0x24, Leap Indicator: no warning, Version number: NTP Version 4, Mode: server
    Peer Clock Stratum: secondary reference (3)
    Peer Polling Interval: 6 (64 sec)
    Peer Clock Precision: 0.000015 sec
    Root Delay: 0.0244598388671875 seconds
    Root Dispersion: 0.07177734375 seconds
    Reference ID: 193.182.111.13
    Reference Timestamp: Nov 28, 2020 16:00:20.461789665 UTC
    Origin Timestamp: Nov 28, 2020 16:09:03.511942520 UTC
    Receive Timestamp: Nov 28, 2020 16:09:03.515572186 UTC
    Transmit Timestamp: Nov 28, 2020 16:09:03.515697472 UTC
    Key ID: 00000001
    Message Authentication Code: 5e194bd30f46bb22789f80c8e8964ae7

linux peer 'ntpq -c as' output:

ind assid status  conf reach auth condition  last_event cnt
===========================================================
  1 59188  8811   yes  none  none    reject    mobilize  1
  2 59189  f31a   yes   yes   ok    outlier    sys_peer  1

pfSense 2.5.0.a.20201127.1850

pfSense NTP client still doesn't have authentication support, so I set the target version to 2.5.next

The ntp client auth is yet to be implemented.

Is there any updates on this. I am also using Lamaz patch as it will not use authentication without both key and key value. Similar to Palo Alto

https://forum.netgate.com/topic/162746/authenicated-ntp/

He made a new patch for 23.01

Patch files for review attached.

All that is needed is to add the ntp key variable to be set from /usr/local/www/services_ntpd.php.

See https://forum.netgate.com/topic/162746/authenicated-ntp for details.

-LamaZ

Thanks Matthew and Lamar I have confirmed this works as expected with GUI entry in pfSense Plus also patch needs to strip off /src

Patches have been tested in 23.05.01 (Jonathan Lee's Everything Bagel Version I can't move to 23.09)

I've added a checkbox for each time server called "Authenticated" so that NTP authentication can be enabled/disabled on a per server/peer basis. It also validates that authentication is not enabled for an NTP pool.
Attached is a new patch file.

1. Remove the <timeservers> element entirely and instead store the time servers in <ntpd>. The only reason I can see to keep this around is if there are plans to implement a service such as chrony that actually is a client only.
2. Restructure <ntpd> to have a an element that contains each server as its own individual elements (e.g., <ntpd>/<timeservers>/<timeserver>)
3. Restructure <ntpd>'s authentication details to allow multiple NTP keys (e.g., <ntpd>/<serverauthkeys>/<key>)

I think it would end up looking something like this:

<ntpd>
    <enabled>enabled</enabled>
    <gps></gps>
    <orphan></orphan>
    <ntpminpoll></ntpminpoll>
    <ntpmaxpoll></ntpmaxpoll>
    <dnsresolv>auto</dnsresolv>
    <timeservers>
        <timeserver>
            <type>[server|pool|peer]</type>
            <server>[FQDN|IP]</server>
            (<prefer/>)
            (<noselect/>)
            (<authkey>[#]</authkey>)
        </timeserver>
        ...
    </timeservers>
    <serverauth>[yes|no]</serverauth>
    <serverauthkeys>
        <key>
            <id>[#]</id>
            <key>[keystring]</key>
            <algo>[md5|sha1|sha256]</algo>
        </key>
        ...
    </serverauthkeys>
</ntpd>

I think this is necessary for all the changes to be implemented, but it also expands the scope of this ticket a bit. Do I need to open a separate ticket to suggest this?

Implemented with abdf94d9b09a6378b771a210bd57df65ce038843.

Applied in changeset abdf94d9b09a6378b771a210bd57df65ce038843.