Problem: NTP Queries Fail After Upgrade to UCS 5.2 - "Request timed out"

Knowledge Base Community
, , ,
1

Problem

After upgrading to UCS 5.2, the NTP server cannot be queried on either Domain Controller (DC) using ntpq -p.

When attempting to use ntpdate, the command fails with the following error:

***Request timed out

Root Cause

The issue is caused by missing localhost restriction entries in /etc/ntpsec/ntp.conf:

restrict 127.0.0.1
restrict ::1

With UCS 5.2, the standard NTP daemon was replaced by ntpsec. By default, ntpsec disables the ntpq control channel unless an explicit restriction policy is defined to permit localhost access.

Investigation

First, verify that the required packages are correctly installed on your system using the following command:

dpkg -l | grep ntp

The expected output should look like this:

ii  ntp                                  1:4.2.8p15+dfsg-2~1.2.3-1          all          Network Time Protocol daemon/utilities (transitional package)
rc  ntpdate                              1:4.2.8p15+dfsg-2~1.2.3-1          all          Network Time Protocol client (transitional package)
ii  ntpsec                               1.2.3-1                            amd64        Network Time Protocol daemon and utility programs
ii  ntpsec-ntpdate                       1.2.3-1                            amd64        client for setting system time from NTP servers
ii  ntpsec-ntpdig                        1.2.3-1                            amd64        ntpdig SNTP client
ii  python3-elementpath                  2.5.3-1                            all          Providing XPath selectors for Python's XML data structures
ii  python3-ntp                          1.2.3-1                            amd64        Python 3 NTP Helper Classes

Note: If the transitional ntp package is not installed (e.g., showing a status of rc for removed/configured), you can reinstall it by running:

univention-install ntp

Next, check the current status of the time synchronization services:

systemctl status ntp.service
systemctl status ntpd.service

Verify the contents of the configuration file at /etc/ntpsec/ntp.conf. Ensure that it contains the expected local restriction policies:

# Warning: This file is auto-generated and might be overwritten by
#          univention-config-registry.
#          Please edit the following file(s) instead:
#  
#       /etc/univention/templates/files/etc/ntpsec/ntp.conf
#  

# /etc/ntpsec/ntp.conf, configuration for ntpd; see ntp.conf(5) for help

driftfile /var/lib/ntpsec/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list

# To enable Network Time Security support as a server, obtain a certificate
# (e.g. with Let's Encrypt), configure the paths below, and uncomment:
# nts cert CERT_FILE
# nts key KEY_FILE
# nts enable

# You must create /var/log/ntpsec (owned by ntpsec:ntpsec) to enable logging.
statsdir /var/log/ntpsec
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

server 192.168.0.XXX burst
server univention.de burst
server univention.de burst
ntpsigndsocket /var/lib/samba/ntp_signd
restrict default mssntp noquery
restrict 127.0.0.1
restrict ::1
tinker panic 0


### Synchronize with local server, if no other
### could be reached

server 127.127.1.0
fudge 127.127.1.0 stratum 5

Reproducibility

The issue can be reproduced consistently by commenting out the localhost restriction lines and restarting the service:

<skip>
ntpsigndsocket /var/lib/samba/ntp_signd
restrict default mssntp noquery
#restrict 127.0.0.1
#restrict ::1
tinker panic 0
<skip>

Running the query command afterwards will trigger the timeout:

root@ucs5primary:~# ntpq -p
***Request timed out

Solution

To resolve the issue, perform a UCR commit to regenerate the configuration file from the official Univention templates. This ensures the correct configuration block is written permanently.

  1. Regenerate the configuration file:
ucr commit /etc/ntpsec/ntp.conf
  1. Verify that the configuration now includes the required parameters:
<skip>
ntpsigndsocket /var/lib/samba/ntp_signd
restrict default mssntp noquery
restrict 127.0.0.1
restrict ::1
<skip>
  1. Restart the NTP services to apply the changes:
systemctl restart ntp.service ntpsec.service
  1. Verify the NTP server status:
ntpq -p
  1. Expected Output:
root@ucs5primary:~# ntpq -p
     remote           refid      st t when poll reach   delay    offset    jitter
=======================================================================================================
 192.168.0.XXX   79.133.44.XXX    2 u    1   64    1   0.4129   0.2603   0.0000
 10.208.1.XXX    130.162.220.XXX  2 u    -   64    1  15.5582   3.6463   0.0000
 univention.de   .DNS.           16 u    -   64    0   0.0000   0.0000   0.0002
 LOCAL(0)        .LOCL.           5 l    -   64    0   0.0000   0.0000   0.0002
1 Like