NTP and update-resolv-conf

Pippin

Hi,

Using update-resolv-conf script I just discovered that dhcp-option NTP is not working.
tcpdump shows NTP going to the system configured server instead of the pushed one.
update-resolv-conf

#!/bin/bash
# 
# Parses DHCP options from openvpn to update resolv.conf
# To use set as 'up' and 'down' script in your openvpn *.conf:
# up /etc/openvpn/update-resolv-conf
# down /etc/openvpn/update-resolv-conf
#
# Used snippets of resolvconf script by Thomas Hood and Chris Hanson.
# Licensed under the GNU GPL.  See /usr/share/common-licenses/GPL. 
# 
# Example envs set from openvpn:
#
#     foreign_option_1='dhcp-option DNS 193.43.27.132'
#     foreign_option_2='dhcp-option DNS 193.43.27.133'
#     foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
#

[ -x /sbin/resolvconf ] || exit 0
[ "$script_type" ] || exit 0
[ "$dev" ] || exit 0

split_into_parts()
{
	part1="$1"
	part2="$2"
	part3="$3"
}

case "$script_type" in
  up)
	NMSRVRS=""
	SRCHS=""
	for optionvarname in ${!foreign_option_*} ; do
		option="${!optionvarname}"
		echo "$option"
		split_into_parts $option
		if [ "$part1" = "dhcp-option" ] ; then
			if [ "$part2" = "DNS" ] ; then
				NMSRVRS="${NMSRVRS:+$NMSRVRS }$part3"
			elif [ "$part2" = "DOMAIN" ] ; then
				SRCHS="${SRCHS:+$SRCHS }$part3"
			fi
		fi
	done
	R=""
	[ "$SRCHS" ] && R="search $SRCHS
"
	for NS in $NMSRVRS ; do
        	R="${R}nameserver $NS
"
	done
	echo -n "$R" | /sbin/resolvconf -a "${dev}.openvpn"
	;;
  down)
	/sbin/resolvconf -d "${dev}.openvpn"
	;;
esac

Can see that DNS and DOMAIN is done.
Since I know too little about scripting, someone willing to adjust it too include NTP?

Thanks.

TinCanTech

Now there is a can-o-worms ! :twisted:

I expect the reason it has never been done before is because there is no generic solution ..

For example, what NTP deamon are you running ?

Pippin

I`m on Linux Mint 18.3 Cinnamon as client.
ntpd - NTP daemon program - Ver. 4.2.8p4

NTP service also runs on the server where OpenVPN server runs.
ntpd - NTP daemon program - Ver. 4.2.8p9

TinCanTech

Technically, dhcp-options are Windows specific ..

I would manually add the VPN server IP to the client ntp.conf

As for customising the update-resolv-conf script:

I don't think this a good idea because it has a clear purpose and is maintained.

Instead you could write a wrapper script (e. /etc/openvpn/client-up.sh)
which calls update-resolv-conf and then your custom NTP script.
Sorry, I don't have any examples of what that would look like.

Pippin

Ok thanks, was thinking that way too but thought modifying update-resolv-conf would be a better solution.

Will try following:
1. remove update-resolv-conf from config
2. instead call up script (and down to reverse)
3. call update-resolve-conf and update-ntp-conf from up-script
4. reverse for down script

Files:
1. original ntp.conf
2. new ntp-ovpn.conf - copy of ntp.conf but NTP servers removed and VPN server IP added
update-ntp-conf will:
1. mv (rename) the two files
2. service ntp restart

Somehow looks dirty 🙂

Thanks

TinCanTech

Looks ok to me 😉

P-probably need some error checking and what-not as well

 [ -f $filename ] || die "$filename does not exist!"

:geek:

Pippin

That`s too much for me already :cry:
:mrgreen:

TinCanTech

If you want you can contact me privately : tincanteksup <at> gmail

Pippin

That`s a kind offer but want to struggle first, thanks.

Pippin

It works fine this way:
up.sh

#!/bin/sh

/etc/openvpn/update-resolv-conf

# Update NTP to OpenVPN server
mv /etc/ntp.conf /etc/ntp-bak.conf
mv /etc/ntp-ovpn.conf /etc/ntp.conf
service ntp restart

exit 0

service status ntp

ntp.service - LSB: Start NTP daemon
   Loaded: loaded (/etc/init.d/ntp; enabled; vendor preset: enabled)
   Active: active (running) since vr 2018-01-19 00:27:26 CET; 5s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 12620 ExecStop=/etc/init.d/ntp stop (code=exited, status=0/SUCCESS)
  Process: 12632 ExecStart=/etc/init.d/ntp start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/ntp.service
           └─12650 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 109:116

jan 19 00:27:26 Laptop-1 ntpd[12650]: proto: precision = 0.117 usec (-23)
jan 19 00:27:26 Laptop-1 ntpd[12650]: restrict: ignoring line 38, mask '::' unusable.
jan 19 00:27:26 Laptop-1 ntpd[12650]: Listen and drop on 0 v4wildcard 0.0.0.0:123
jan 19 00:27:26 Laptop-1 ntpd[12650]: Listen normally on 1 lo 127.0.0.1:123
jan 19 00:27:26 Laptop-1 ntpd[12650]: Listen normally on 2 enp0s29u1u2 192.168.42.47:123
jan 19 00:27:26 Laptop-1 ntpd[12650]: Listen normally on 3 tun0 192.168.168.2:123
jan 19 00:27:26 Laptop-1 ntpd[12650]: Listening on routing socket on fd #20 for interface updates
jan 19 00:27:27 Laptop-1 ntpd[12650]: Soliciting pool server 192.168.168.1

down.sh

#!/bin/sh

/etc/openvpn/update-resolv-conf

# Update NTP to previous servers
mv /etc/ntp.conf /etc/ntp-ovpn.conf
mv /etc/ntp-bak.conf /etc/ntp.conf
service ntp restart

exit 0

service status ntp

ntp.service - LSB: Start NTP daemon
   Loaded: loaded (/etc/init.d/ntp; enabled; vendor preset: enabled)
   Active: active (running) since vr 2018-01-19 00:40:21 CET; 2s ago
     Docs: man:systemd-sysv-generator(8)
  Process: 12847 ExecStop=/etc/init.d/ntp stop (code=exited, status=0/SUCCESS)
  Process: 12858 ExecStart=/etc/init.d/ntp start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/ntp.service
           └─12871 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 109:116

jan 19 00:40:21 Laptop-1 systemd[1]: Started LSB: Start NTP daemon.
jan 19 00:40:21 Laptop-1 ntpd[12871]: proto: precision = 0.090 usec (-23)
jan 19 00:40:21 Laptop-1 ntpd[12871]: restrict: ignoring line 37, mask '::' unusable.
jan 19 00:40:21 Laptop-1 ntpd[12871]: Listen and drop on 0 v4wildcard 0.0.0.0:123
jan 19 00:40:21 Laptop-1 ntpd[12871]: Listen normally on 1 lo 127.0.0.1:123
jan 19 00:40:21 Laptop-1 ntpd[12871]: Listen normally on 2 enp0s29u1u2 192.168.42.47:123
jan 19 00:40:21 Laptop-1 ntpd[12871]: Listening on routing socket on fd #19 for interface updates
jan 19 00:40:22 Laptop-1 ntpd[12871]: Soliciting pool server 185.51.192.34

Now the struggle begins 🙂

TinCanTech

Pippin wrote want to struggle first

Pippin wrote It works fine this way

Pippin wrote Now the struggle begins 🙂

I have detailed files :mrgreen:

Pippin

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.