NTP configuration during and post setup

[AfroThundr3007730]

Version

2.4.110

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc. (unsupported)

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

40

Storage for /nsm

160

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

When deploying SecurityOnion in an airgapped environment without access to external NTP servers, it would be nice to have the ability to change the configured NTP servers during setup of the manager node, then have these values propagated to the other nodes as usual.

Aside from adjusting the list of NTP servers in the advanced configuration post setup, is there a way to set these during the setup process? I see that support for specifying NTP servers during setup was implemented a few years ago (#3053), but only the functions survive, and they're not hooked into the actual setup anymore.

In addition to this, what about specifying other NTP settings in the chrony.conf salt template? Is it safe to adjust this template file, or will Salt complain? Perhaps it should go in the corresponding local equivalent directory instead?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Can you change your NTP servers in SOC like this? https://docs.securityonion.net/en/2.4/ntp.html

[AfroThundr3007730]

Well yes. I was looking for a method to have this set during installation, as was previously implemented in #3053, and was also asking about more advanced NTP configurations. Can I safely overwrite that template chrony.conf and let salt push it out?

[cm-ops]

You could use Administration –> Configuration –> ntp -> advanced to set other NTP configurations.

What other configurations are looking to add?

[AfroThundr3007730]

Basically any config aside from the serers, like setting NTP keys for example. Is there documentation for the ntp.advanced node?