[Samba] help with chrony time synchronisation

[Kacper Wirski]

Hello,

It came to my attention, that recently time synchronisation has stopped 
working properly in my environment, and I can't wrap my head around it, 
maybe someone here can give me some ideas.

I'm running latest samba 4 on debian bookworm (backports) as an AD DC. 
Schema/functionality upgraded.

As time service is chrony. Service is running, I checked with wiki's 
entry, I re-checked permissions on /var/lib/samba/ntp_signd, proper 
entry is there in chrony.conf

Windows clients, domain joined, differend OS's (windows server 2012, 
windows server 2016, windows 11) all show similiar issue:

1) if i set from client the manualpeerlist (w32tm /config 
/manualpeerlist:<FQDN> /syncfromflags:MANUAL /update)and direct them 
precisely at DC1 (that is my samba server with PDC FSMO), it works fine, 
I see windows setting with "w32tm /query /source" dc1 and I see it 
actively syncing

2) If I use the default on the client or re-set it (w32tm /config 
/syncfromflags:DOMHIER /update) and then "w32tm /resync /rediscover" or 
"w32tm /resync /force")

I see two things:

- first client tries to use different DC (one that is not the owner of 
PDC FSMO) - it fails, server receives request, but doesn't respond

- dc2 (the one that is preferred on most clients) has the same chrony 
setup, /var/lib/samba/ntp_signd has valid owner/chmod settings and on 
startup chrony logs

- eventually client tries using dc1 but somehow fails too (even though 
with /manualpeerlist - it doesn't)


I have kerberos normally working fine, gpo, logins work fine across all 
windows platforms that are joined to the AD, DNS is working properly 
(from client side even w32tm /monitor lists proper DC entries with dc1 
as PDC fsmo). On startup i see the "MS-SNTP authentication enabled".

Firewall isn't blocking, because example 1) works fine. When running 
w32tm /resync /rediscover client.


I read long thread on this mailing list from january about chrony 
issues, I found the information, which helped, that on the wiki page in 
the example config:

"keys" directive is uncommented which, should, as far as I understand, 
be commented out.

My questions first are:

1) should non-PDC role owners respond to windows clients?

2) if only PDC should,  why windows clients decide to use on-PDC one 
their first time source, even though they can lookup, which DC is 
carrying the PDC fsmo role?

3) what else I might be missing?


Regards,

Kacper Wirski


-- 
Ta wiadomość e-mail została sprawdzona pod kątem wirusów przez oprogramowanie antywirusowe Avast.
www.avast.com