[Solved]Porteus Kiosk NTP settings

[rh102801]

Does Porteus Kiosk have the ability to get it's time from a time server in my network or outside?
We are planning to use it as a time keeper for users to clock in a and out and want to make sure the time on the system is synched to our time server.


Thanks

[rh102801]

Unfortunately, I never got any replies on this post and it is still an issue for me. Basically we have several kiosks deployed as time stations where the user only has access to a website where they enter they employee id to clock in and out. This site is displaying a live clock which pulls the time from the local system time, however these are falling behind by a few seconds and I consider it important to have all the kiosks display the same time. In digging some more into this, I came across the following link:
"http://www.filewatcher.com/m/ntp-4.2.6p ... 144-0.html" which displays several links to download a porteus/x86_64/modules/network/ntp-4.2.6p3-x86_64-1.XZM

I am not sure yet but I believe that might be an XZM for the desktop version. Is it possible to copy that XZM and package it with the ISO to make it part of the Kiosk version and be able to sync all my kiosks to an internal NTP server? Would this be considered a security issue to allow NTP on such system?

Thanks

[fanthom]

hi rh102801,

you have to customize kiosk ISO as described in the Kiosk FAQ. you can use our desktop edition to convert ntp txz package from slackware-14.1 (kiosk 3.0 is based on it) to xzm module.
then you have to follow this doc:
http://docs.slackware.com/howtos:network_services:ntp
and start ntp service through /etc/rc.d/rc.local.

good luck!

btw: on the new kiosk website (hoping to have it ready within 2 weeks) i'm going to offer a 'customized kiosk builds' service where i'll be doing such customizations myself for previously negotiated price.
if you are interested and dont want to wait - please send me an email on fanthom@porteus.org

[rh102801]

Thank you for the quick reply fanthom. I started working on this and converted the file to XZM.
One question I have about the XZM file is...Does it matter what name I give it? for instance if I called it 009-ntp.xzm would that be ok? Also would I place this file under the porteus/base along with the other xzm files or would I place it under the modules directory?

Thanks again

[tome]

Does it matter what name I give it?

Yes and no - don't use " " space characters and xzm modules are activated in alphabetical order. In your case 009-ntp.xzm should be OK.

porteus/base or modules directory

It matters little or does't matter, use base because I don't know if Kiosk supports modules directory.

[rh102801]

So I've been working on this following the provided instructions and I think I have done everything on the instructions but I am running into an error when starting the ntp daemon and being the Linux noob that I am, I am not sure what to do to correct it:



root@porteus:/# chmod +x /etc/rc.d/rc.ntpd
root@porteus:/# /etc/rc.d/rc.ntpd start
Starting NTP daemon: /usr/sbin/ntpd -g/usr/sbin/ntpd: line 1: syntax error: unexpected word (expecting ")")

Any pointers would be greatly appreciated.

Thanks

[freestyler]

looks like you need a space after the -g
instead of:

Code: Select all

-g/usr/sbin/ntpd

insert a space:

Code: Select all

-g /usr/sbin/ntpd

[rh102801]

Ok, so I located the rc.ntpd script and this is a copy of it. I don't really understand scripting so I don't know where the error is or why there would be an error since this is not something I've modified:

#!/bin/sh
# Start/stop/restart ntpd.

# Start ntpd:
ntpd_start() {
CMDLINE="/usr/sbin/ntpd -g"
echo -n "Starting NTP daemon: $CMDLINE"
$CMDLINE -p /var/run/ntpd.pid
echo
}

# Stop ntpd:
ntpd_stop() {
echo -n "Stopping NTP daemon..."
if [ -r /var/run/ntpd.pid ]; then
kill -HUP $(cat /var/run/ntpd.pid)
rm -f /var/run/ntpd.pid
else
killall -HUP -q ntpd
fi
echo
}

# Restart ntpd:
ntpd_restart() {
ntpd_stop
sleep 1
ntpd_start
}

# Check if ntpd is running
ntpd_status() {
if [ -e /var/run/ntpd.pid ]; then
echo "ntpd is running."
else
echo "ntpd is stopped."
exit 1
fi
}

case "$1" in
'start')
ntpd_start
;;
'stop')
ntpd_stop
;;
'restart')
ntpd_restart
;;
'status')
ntpd_status
;;
*)
echo "usage $0 start|stop|restart|status"
esac

[rh102801]

Well after reviewing the script and comparing it with other ones, I believe it is correct so I am still hunting for what the problem might have been. Anyhow, I downloaded the file again but this time from a different location:

http://pkgs.org/slackware-14.1/slackwar ... 4.txz.html

I used the txz2xzm tool from the desktop edition and recreatedthe iso. Installed and when I try to start the Daemon this time I get a different problem:

root@porteus:/# chmod +x /etc/rc.d/rc.ntpd
root@porteus:/# /etc/rc.d/rc.ntpd start
Starting NTP daemon: /usr/sbin/ntpd -g/usr/sbin/ntpd: error while loading shared libraries: libcap.so.2: cannot open shared object file: No such file or directory


Can anyone recommend another site to download from?

Thanks

[freestyler]

looks like you are missing libcap package

[rh102801]

Ok, I am making a lot of progress on this but I am not quite there yet. So I downloaded a txz file for Libcap.so.2 converted it to xzm and placed in the porteus/base directory and tested again. At this point it said it was missing a libattr.so.1 so I downloaded, converted and placed int he correct directory. Tested again and this time when trying ntpdate pool.ntp.org I got a new Error: Servname not supported for ai_socktype.
After some searching I came up with this http://www.ducea.com/2006/09/11/error-s ... _socktype/ which basically says I had to modify the /etc/services and include a line for ntp as follow:
ntp 123/tcp
ntp 123/udp
Well when I looked under /etc I could not locate that file so I created one and placed in Rootcopy. Now when I test I get the following:

root@porteus:~# ntpdate pool.ntp.org
14 May 06:56:11 ntpdate[2033]: sendto(bindcat.fhsu.edu): Operation not permitted
14 May 06:56:12 ntpdate[2033]: sendto(jikan.ae7.st): Operation not permitted
14 May 06:56:12 ntpdate[2033]: sendto(clock.trit.net): Operation not permitted
14 May 06:56:12 ntpdate[2033]: sendto(173.44.32.10): Operation not permitted
14 May 06:56:13 ntpdate[2033]: sendto(bindcat.fhsu.edu): Operation not permitted
14 May 06:56:14 ntpdate[2033]: sendto(jikan.ae7.st): Operation not permitted
14 May 06:56:14 ntpdate[2033]: sendto(clock.trit.net): Operation not permitted
14 May 06:56:14 ntpdate[2033]: sendto(173.44.32.10): Operation not permitted
14 May 06:56:15 ntpdate[2033]: sendto(bindcat.fhsu.edu): Operation not permitted
14 May 06:56:16 ntpdate[2033]: sendto(jikan.ae7.st): Operation not permitted
14 May 06:56:16 ntpdate[2033]: sendto(clock.trit.net): Operation not permitted
14 May 06:56:16 ntpdate[2033]: sendto(173.44.32.10): Operation not permitted
14 May 06:56:17 ntpdate[2033]: sendto(bindcat.fhsu.edu): Operation not permitted
14 May 06:56:18 ntpdate[2033]: sendto(jikan.ae7.st): Operation not permitted
14 May 06:56:18 ntpdate[2033]: sendto(clock.trit.net): Operation not permitted
14 May 06:56:18 ntpdate[2033]: sendto(173.44.32.10): Operation not permitted
14 May 06:56:20 ntpdate[2033]: no server suitable for synchronization found


I am able to start the Daemon but it never connects to my ntp server:
root@porteus:~# tail /var/log/ntp.log
root@porteus:~# chmod +x /etc/rc.d/rc.ntpd
root@porteus:~# /etc/rc.d/rc.ntpd start
Starting NTP daemon: /usr/sbin/ntpd -g
root@porteus:~# ntpq -p
ntpq: write to localhost failed: Operation not permitted


Does anyone have any ideas as to what else I might be missing? I have the feeling that I am getting very close to completing this but need that last push to get me thru the finish line.

Thanks

[rh102801]

So after I typed this I realized this is probably a firewall issue as I did not allow port 123.
I will try that and report back.

Thanks

[rh102801]

Ok, some more progress although I think I still have an issue and I believe it has to do with the firewall and incoming ports but I am not 100% sure.

root@porteus:~# ntpdate myntpserver.com
15 May 13:06:56 ntpdate[2065]: step time server 172.X.X.X offset 14426.737712 sec
root@porteus:~# /etc/rc.d/rc.ntpd start
Starting NTP daemon: /usr/sbin/ntpd -g
root@porteus:~# ntpq -p
localhost: timed out, nothing received
***Request timed out


Would my assumption be correct?
This is what I added to the firewall file (rootcopy/etc/rc.d/rc.FireWall)

iptables -A OUTPUT -p udp --dport 123 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 123 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

I can of figured that if the kiosk is the one initiating the connection this would suffice. Is that not the case? any other suggestions?

Also, I am curious about the following:
When I restart the kiosk, I have to manually do the ntpdate command and then start the service (I guess I could start the service without this step 1st), my question is how could I automate the starting of the service? the idea is that id a kiosk loses power and reboots, that when the system comes up, it will automatically update its time if necessary from the ntp server, however if I have to manually start the daemon for this to happen, it kind of defeats the purpose.

Feel free to make any comments, provide ideas or critique what I have done so far, I am sure there is a better way of doing all this but being a Linux noob I am surprised I made it this far to be honest.

Thanks

[rh102801]

So after a few weeks struggling with this I decided to use the paid custom ISO service and Tom had this resolved within a few hours.
He did excellent work and pointed out what he had to change so it helped me understand what I was doing wrong or missing. I highly recommend the custom ISO service. The kiosk is getting better and better and I am very pleased with the functionality and how secure it is.

Thanks for all your hard work

[fanthom]

thanks Raul,

for the record - the main issue was that localhost interface did not exist in kiosk that's why there was:

Code: Select all

root@porteus:~# ntpq -p
localhost: timed out, nothing received
***Request timed out

i had to rise it up and allow in the firewall.
took me a while to figure this out