Synchronizing Clocks Between KDCs and Kerberos Clients
All hosts that participate in the Kerberos authentication system must have their internal
clocks synchronized within a specified maximum amount of time (known as clock skew).
This requirement provides another Kerberos security check. If the clock skew is exceeded
between any of the participating hosts, client requests are rejected.
The clock skew also determines how long application servers must keep track of
all Kerberos protocol messages, in order to recognize and reject replayed requests. So,
the longer the clock skew value, the more information that application servers have
The default value for the maximum clock skew is 300 seconds (five
minutes). You can change this default in the libdefaults section of the krb5.conf
Note - For security reasons, do not increase the clock skew beyond 300 seconds.
Because maintaining synchronized clocks between the KDCs and Kerberos clients is important, you
should use the Network Time Protocol (NTP) software to synchronize them. NTP public
domain software from the University of Delaware is included in the Solaris software,
starting with the Solaris 2.6 release.
Note - Another way to synchronize clocks is to use the rdate command and cron
jobs, a process that can be less involved than using NTP. However, this
section focuses on using NTP. And, if you use the network to synchronize
the clocks, the clock synchronization protocol must itself be secure.
NTP enables you to manage precise time or network clock synchronization, or both,
in a network environment. NTP is basically a server-client implementation. You pick
one system to be the master clock (the NTP server). Then, you
set up all your other systems (the NTP clients) to synchronize their clocks
with the master clock.
To synchronize the clocks, NTP uses the xntpd daemon, which sets and maintains
a UNIX system time-of-day in agreement with Internet standard time servers. The following
shows an example of this server-client NTP implementation.
Figure 23-1 Synchronizing Clocks by Using NTP
Ensuring that the KDCs and Kerberos clients maintain synchronized clocks involves implementing the
Setting up an NTP server on your network. This server can be any system, except the master KDC. See Managing Network Time Protocol (Tasks) in System Administration Guide: Network Services to find the NTP server task.
As you configure the KDCs and Kerberos clients on the network, setting them up to be NTP clients of the NTP server. See Managing Network Time Protocol (Tasks) in System Administration Guide: Network Services to find the NTP client task.