Download Mac OS X Server Network Services Administration

Using NTP on Your Network
Managing DNS Service
Mac OS X Server can act not only as an NTP client, receiving authoritative time from
an Internet time server, but also as an authoritative time server for a network. Your local
clients can query your server to set their clocks. It’s advised that if you set your server to
answer time queries, you should also set it to query an authoritative server on the
Internet.
Mac OS X Server provides a simple interface for starting and stopping DNS service as
well as viewing logs and status. Basic DNS settings can be configured with Server
Admin. More advanced features require configuring BIND from the command-line, and
are not covered here.
Setting Up NTP Service
Starting and Stopping DNS Service
Use this procedure to start or stop DNS service. Remember to restart the DNS service
whenever you make changes to the DNS service in Server Admin.
If you choose to run NTP service on your network, make sure your designated server
can access a higher-authority time server. Apple provides a Stratum 2 time server for
customer use at time.apple.com.
To start or stop DNS service:
1 In Server Admin, choose DNS from the Computers & Services list.
Additionally, you’ll need to make sure your firewall allows NTP queries out to an
authoritative time server on UDP port 123, and incoming queries from local clients on
the same port. See Chapter 3, “IP Firewall Service,” on page 43 for more information on
configuring your firewall.
3 Click Start Service or Stop Service.
To set up NTP service:
1 Make sure your server is configured to “Set Date & Time automatically.”
This setting is in the Date & Time pane of System Preferences, or the Server Admin
Settings pane for the server.
2 Open Server Admin, and select the server you want to act as a time server.
2 Make sure you have at least one Zone and its reverse lookup zone created and fully
configured.
The service may take a moment to start (or stop).
Enabling or Disabling Zone Transfers
In the Domain Name System, zone data is replicated among authoritative DNS servers
by means of the “zone transfer.” Secondary DNS servers (“slaves”) use zone transfers to
acquire their data from primary DNS servers (“masters”). Zone transfers must be
enabled to use secondary DNS servers.
3 Click Settings.
To enable or disable zone transfer:
1 In Server Admin, choose DNS in the Computer & Services list.
4 Select the Advanced tab.
2 Click Settings.
5 Select Enable NTP.
3 Select the General tab.
6 Click Save.
4 Select or deselect Allow Zone Transfers as needed.
Enabling or Disabling Recursion
Recursion is a process to fully resolve domain names into IP addresses. Users’
applications depend on the DNS server to perform this function. Other DNS servers
that query yours don’t have to perform the recursion.
To prevent malicious users from altering the master zone’s records (“cache poisoning”),
or allowing unauthorized use of the server for DNS service, you can disable recursion.
However, if you stop it, your own users won’t be able to use your DNS service to look
up any names outside of your zones.
You should only disable recursion if no clients are using this DNS server for name
resolution and no servers are using it for forwarding.
80
Chapter 6 NTP Service
Chapter 2 DNS Service
21