Securing Windows NT/2000 Servers for the Internet

Time Synchronization Using NTP

Let’s get back to why you’re producing all these log entries and doing all this auditing. You want to make sure that we can detect abnormalities and know if you’re being (or have been) attacked. The most important thing is learning how the intruder broke into your system and fixing it so it doesn’t happen again.

A successful attack against the perimeter often targets more than one of your systems. The attacker most likely tries to continue the attack from a compromised host. Tracing the path of an attacker involves reading logs from several systems in parallel to determine what happened. Comparing system logs is a lot easier if all of the systems have the same time. For this reason, system clock synchronization is crucial.

For the purpose of reading the logs, you don’t necessarily need the correct time. The important thing is that all hosts have the same time. Correct time may, however, be important if you need to compare your logs with logs from another site in an attempt to track down an attacker. Correct time is also important if you need to use the system logs as evidence in a court of law.

The Network Time Protocol (NTP)^[49] is used to synchronize the time of computers with a reference time source, such as a server synchronized to UTC^[50] via a GPS (Global Positioning System) receiver (the GPS satellites have atomic clocks on board). The NTP provides millisecond accuracy within a local network. Almost all platforms, including routers, switches, ...