+ -

NTP’s Configuration File User Manual ¶

NTP’s Configuration File User Manual

This document describes the configuration file for the NTP Project’s -ntpd program. +ntpd program.

This document applies to version 4.2.8p17 of ntp.conf. +

This document applies to version 4.2.8p18-RC1 of ntp.conf.

- - -

Short Table of Contents

1 Description

1 Description

+ + + + + + +

+ -

1 Description ¶

1 Description

The behavior of ntpd can be changed by a configuration file, -by default ntp.conf. +

The behavior of ntpd can be changed by a configuration file, +by default ntp.conf.

Notes about ntp.conf

+ + + +

+ -

1.1 Notes about ntp.conf ¶

- - +

1.1 Notes about ntp.conf

+ +

The -ntp.conf +ntp.conf configuration file is read at initial startup by the -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) daemon in order to specify the synchronization sources, modes and other related information. Usually, it is installed in the -/etc +/etc directory, but could be installed elsewhere (see the daemon’s --c +-c command line option).

The file format is similar to other -UNIX +UNIX configuration files. Comments begin with a ‘#’ @@ -120,52 +131,63 @@ The page (available as part of the HTML documentation provided in -/usr/share/doc/ntp) +/usr/share/doc/ntp) contains an extended discussion of these options. In addition to the discussion of general ‘Configuration Options’, there are sections describing the following supported functionality and the options used to control it: -

Authentication Support -
Monitoring Support -
Access Control Support -
Automatic NTP Configuration Options -
Reference Clock Support -

Miscellaneous Options +

Authentication Support +
Monitoring Support +
Access Control Support +
Automatic NTP Configuration Options +
Reference Clock Support +
Miscellaneous Options

Following these is a section describing -Miscellaneous Options. +Miscellaneous Options. While there is a rich set of options available, the only required option is one or more -pool, -server, -peer, -broadcast +pool, +server, +peer, +broadcast or -manycastclient +manycastclient commands. -

Configuration Support
Authentication Support
Monitoring Support
Access Control Support
Automatic NTP Configuration Options
Reference Clock Support
Miscellaneous Options
ntp.conf Files
ntp.conf See Also
ntp.conf Bugs
ntp.conf Notes

+ + + + + + + + + + + + +

+ -

1.1.1 Configuration Support ¶

1.1.1 Configuration Support

Following is a description of the configuration commands in NTPv4. These commands have the same basic functions as in NTPv3 and @@ -175,12 +197,7 @@ classes of commands, configuration commands that configure a persistent association with a remote server or peer or reference clock, and auxiliary commands that specify environmental variables that control various related operations. -

Configuration Commands
Auxiliary Commands

1.1.1.1 Configuration Commands ¶

1.1.1.1 Configuration Commands

The various modes are determined by the command keyword and the type of the required IP address. Addresses are classed by type as @@ -197,12 +214,12 @@ in some weird and even destructive behavior. is detected, support for the IPv6 address family is generated in addition to the default support of the IPv4 address family. In a few cases, including the -reslist +reslist billboard generated by -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) or -ntpdc(1ntpdcmdoc), +ntpdc(1ntpdcmdoc), IPv6 addresses are automatically generated. IPv6 addresses can be identified by the presence of colons “:” @@ -213,26 +230,26 @@ with the exception of reference clock addresses, which are always IPv4.

Note that in contexts where a host name is expected, a --4 +-4 qualifier preceding the host name forces DNS resolution to the IPv4 namespace, while a --6 +-6 qualifier forces DNS resolution to the IPv6 namespace. See IPv6 references for the equivalent classes for that address family. -

pool address [burst] [iburst] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [xmtnonce]
server address [key key | autokey] [burst] [iburst] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [true] [xmtnonce]
peer address [key key | autokey] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [true] [xleave]
broadcast address [key key | autokey] [version version] [prefer] [minpoll minpoll] [ttl ttl] [xleave]
manycastclient address [key key | autokey] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [ttl ttl]

1.1.1.2 Auxiliary Commands ¶

broadcastclient

+ -

1.1.2 Authentication Support ¶

1.1.2 Authentication Support

Authentication support allows the NTP client to verify that the server is in fact known and trusted and not an intruder intending accidentally or on purpose to masquerade as that server. @@ -560,15 +572,15 @@ are on the Building and Installing the Distribution page.

Authentication is configured separately for each association using the -key +key or -autokey +autokey subcommand on the -peer, -server, -broadcast +peer, +server, +broadcast and -manycastclient +manycastclient configuration commands as described in ‘Configuration Options’ page. @@ -597,16 +609,16 @@ the server certificate, verify its credentials and initialize the protocol

The -auth +auth flag controls whether new associations or remote configuration commands require cryptographic authentication. This flag can be set or reset by the -enable +enable and -disable +disable commands and also by remote configuration commands sent by a -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) program running on another machine. If this flag is enabled, which is the default @@ -619,7 +631,7 @@ even if not cryptographic authenticated. It should be understood that operating with the -auth +auth flag disabled invites a significant vulnerability where a rogue hacker can masquerade as a falseticker and seriously @@ -636,7 +648,7 @@ the authentication process itself.

An attractive alternative where multicast support is available is manycast mode, in which clients periodically troll for servers as described in the -Automatic NTP Configuration Options +Automatic NTP Configuration Options page. Either symmetric key or public key cryptographic authentication can be used in this mode. @@ -652,18 +664,8 @@ both symmetric key and public key cryptography are summarized below; further details are in the briefings, papers and reports at the NTP project page linked from -http://www.ntp.org/. -

Symmetric-Key Cryptography
Public Key Cryptography
Naming and Addressing
Operation
Key Management
Authentication Commands
Error Codes

1.1.2.1 Symmetric-Key Cryptography ¶

+http://www.ntp.org/. +

1.1.2.1 Symmetric-Key Cryptography

The original RFC-1305 specification allows any one of possibly 65,535 keys, each distinguished by a 32-bit key identifier, to authenticate an association. @@ -673,47 +675,45 @@ authenticate NTP packets. Keys and related information are specified in a key file, usually called -ntp.keys, +ntp.keys, which must be distributed and stored using secure means beyond the scope of the NTP protocol itself. Besides the keys used for ordinary NTP associations, additional keys can be used as passwords for the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) and -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility programs.

When -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) is first started, it reads the key file specified in the -keys +keys configuration command and installs the keys in the key cache. However, individual keys must be activated with the -trusted +trusted command before use. This allows, for instance, the installation of possibly several batches of keys and then activating or deactivating each batch remotely using -ntpdc(1ntpdcmdoc). +ntpdc(1ntpdcmdoc). This also provides a revocation capability that can be used if a key becomes compromised. The -requestkey +requestkey command selects the key used as the password for the -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility, while the -controlkey +controlkey command selects the key used as the password for the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) utility. -

1.1.2.2 Public Key Cryptography ¶

1.1.2.2 Public Key Cryptography

NTPv4 supports the original NTPv3 symmetric key scheme described in RFC-1305 and in addition the Autokey protocol, which is based on public key cryptography. @@ -744,7 +744,7 @@ page.

The specific cryptographic environment used by Autokey servers and clients is determined by a set of files and soft links generated by the -ntp-keygen(1ntpkeygenmdoc) +ntp-keygen(1ntpkeygenmdoc) program. This includes a required host key file, required certificate file and optional sign key file, @@ -755,7 +755,7 @@ along with the matching sign key. There are several schemes available in the OpenSSL software library, each identified by a specific string such as -md5WithRSAEncryption, +md5WithRSAEncryption, which stands for the MD5 message digest with RSA encryption scheme. The current NTP distribution supports @@ -774,9 +774,7 @@ This requires the configuration file in all hosts to be engineered so that, even under anticipated failure conditions, the NTP subnet will form such that every group host can find a trail to at least one trusted host. -

1.1.2.3 Naming and Addressing ¶

1.1.2.3 Naming and Addressing

It is important to note that Autokey does not use DNS to resolve addresses, since DNS can’t be completely trusted until the name servers have synchronized clocks. @@ -789,7 +787,7 @@ DNS compromise is essential.

By convention, the name of an Autokey host is the name returned by the Unix -gethostname(2) +gethostname(2) system call or equivalent in other systems. By the system design model, there are no provisions to allow alternate names or aliases. @@ -808,9 +806,7 @@ For this reason operation with network address translation schemes is not possible. This reflects the intended robust security model where government and corporate NTP servers are operated outside firewall perimeters. -

1.1.2.4 Operation ¶

1.1.2.4 Operation

A specific combination of authentication scheme (none, symmetric key, public key) and identity scheme is called a cryptotype, although not all combinations are compatible. @@ -827,19 +823,19 @@ but may not represent good security practice. of mobilization, either at configuration time or some time later when a message of appropriate cryptotype arrives. When mobilized by a -server +server or -peer +peer configuration command and no -key +key or -autokey +autokey subcommands are present, the association is not authenticated; if the -key +key subcommand is present, the association is authenticated using the symmetric key ID specified; if the -autokey +autokey subcommand is present, the association is authenticated using Autokey.

@@ -881,7 +877,7 @@ If verification fails, Bob sends Cathy a thing called a crypto-NAK, which tells her something broke. She can see the evidence using the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) program.

Denise has rolled her own host key and certificate. @@ -899,12 +895,10 @@ servers (or the same server, although that might not be useful). But, wise security policy might preclude some cryptotype combinations; for instance, running an identity scheme with one server and no authentication with another might not be wise. -

1.1.2.5 Key Management ¶

1.1.2.5 Key Management

The cryptographic values used by the Autokey protocol are incorporated as a set of files generated by the -ntp-keygen(1ntpkeygenmdoc) +ntp-keygen(1ntpkeygenmdoc) utility program, including symmetric key, host key and public certificate files, as well as sign key, identity parameters and leapseconds files. @@ -913,9 +907,9 @@ certificate files can be generated by the OpenSSL utilities and certificates can be imported from public certificate authorities. Note that symmetric keys are necessary for the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) and -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility programs. The remaining files are necessary only for the Autokey protocol. @@ -934,13 +928,11 @@ The certificate extension fields must not contain either a subject key identifier or a issuer key identifier field; however, an extended key usage field for a trusted host must contain the value -trustRoot;. +trustRoot;. Other extension fields are ignored. -

1.1.2.6 Authentication Commands ¶

autokey [logsec]

1.1.2.7 Error Codes ¶

1.1.2.7 Error Codes

The following error codes are reported via the NTP control and monitoring protocol trap mechanism. -

101: (bad field format or length) The packet has invalid version, length or format. @@ -1158,51 +1148,44 @@ The identity key is missing, corrupt or bogus.

+ -

1.1.3 Monitoring Support ¶

ntpd(1ntpdmdoc) +

1.1.3 Monitoring Support

ntpd(1ntpdmdoc) includes a comprehensive monitoring facility suitable for continuous, long term recording of server and client timekeeping performance. See the -statistics +statistics command below for a listing and example of each type of statistics currently supported. Statistic files are managed using file generation sets and scripts in the -./scripts +./scripts directory of the source code distribution. Using these facilities and -UNIX -cron(8) +UNIX +cron(8) jobs, the data can be automatically summarized and archived for retrospective analysis. -

Monitoring Commands

1.1.3.1 Monitoring Commands ¶

statistics name ...

+ -

1.1.4 Access Control Support ¶

1.1.4 Access Control Support

The -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) daemon implements a general purpose address/mask based restriction list. The list contains address/match entries sorted first @@ -1571,7 +1551,7 @@ Additional information and examples can be found in the page (available as part of the HTML documentation provided in -/usr/share/doc/ntp). +/usr/share/doc/ntp).

The restriction facility was implemented in conformance with the access policies for the original NSFnet backbone @@ -1587,7 +1567,7 @@ by a determined cracker.

Clients can be denied service because they are explicitly included in the restrict list created by the -restrict +restrict command or implicitly as the result of cryptographic or rate limit violations. @@ -1602,12 +1582,7 @@ an indefinite period. When a client or network is denied access for an indefinite period, the only way at present to remove the restrictions is by restarting the server. -

The Kiss-of-Death Packet
Access Control Commands

1.1.4.1 The Kiss-of-Death Packet ¶

1.1.4.1 The Kiss-of-Death Packet

Ordinarily, packets denied service are simply dropped with no further action except incrementing statistics counters. Sometimes a @@ -1620,12 +1595,12 @@ KoD packets have the leap bits set unsynchronized and stratum set to zero and the reference identifier field set to a four-byte ASCII code. If the -noserve +noserve or -notrust +notrust flag of the matching restrict list entry is set, the code is "DENY"; if the -limited +limited flag is set and the rate limit is exceeded, the code is "RATE". Finally, if a cryptographic violation occurs, the code is "CRYP". @@ -1642,33 +1617,31 @@ to restart the protocol at both the client and server. This happens automatically at the client when the association times out. It will happen at the server only if the server operator cooperates. -

1.1.4.2 Access Control Commands ¶

discard [average avg] [minimum min] [monitor prob]

+ -

1.1.5 Automatic NTP Configuration Options ¶

Manycasting
Manycast Interactions with Autokey
Broadcast Options
Manycast Options

1.1.5.1 Manycasting ¶

1.1.5 Automatic NTP Configuration Options

1.1.5.1 Manycasting

Manycasting is a automatic discovery and configuration paradigm new to NTPv4. It is intended as a means for a multicast client @@ -1928,19 +1891,19 @@ and is generally considered stronger, at least with relatively large key sizes. It is implemented using the Autokey protocol and the OpenSSL cryptographic library available from -http://www.openssl.org/. +http://www.openssl.org/. The library can also be used with other NTPv4 modes as well and is highly recommended, especially for broadcast modes.

A persistent manycast client association is configured using the -manycastclient +manycastclient command, which is similar to the -server +server command but with a multicast (IPv4 class -D +D or IPv6 prefix -FF) +FF) group address. The IANA has designated IPv4 address 224.1.1.1 and IPv6 address FF05::101 (site local) for NTP. @@ -1953,7 +1916,7 @@ as different group address, each one serving as a template for a future ephemeral unicast client/server association.

Manycast servers configured with the -manycastserver +manycastserver command listen on the specified group address for manycast client messages. Note the distinction between manycast client, @@ -1992,23 +1955,23 @@ as much as possible the volume of manycast client messages and the effects of implosion due to near-simultaneous arrival of manycast server messages. The strategy is determined by the -manycastclient, -tos +manycastclient, +tos and -ttl +ttl configuration commands. The manycast poll interval is normally eight times the system poll interval, which starts out at the -minpoll +minpoll value specified in the -manycastclient, +manycastclient, command and, under normal circumstances, increments to the -maxpolll +maxpolll value specified in this command. Initially, the TTL is set at the minimum hops specified by the -ttl +ttl command. At each retransmission the TTL is increased until reaching the maximum hops specified by this command or a sufficient @@ -2018,43 +1981,43 @@ Further retransmissions use the same TTL.

The quality and reliability of the suite of associations discovered by the manycast client is determined by the NTP mitigation algorithms and the -minclock +minclock and -minsane +minsane values specified in the -tos +tos configuration command. At least -minsane +minsane candidate servers must be available and the mitigation algorithms produce at least -minclock +minclock survivors in order to synchronize the clock. Byzantine agreement principles require at least four candidates in order to correctly discard a single falseticker. For legacy purposes, -minsane +minsane defaults to 1 and -minclock +minclock defaults to 3. For manycast service -minsane +minsane should be explicitly set to 4, assuming at least that number of servers are available.

If at least -minclock +minclock servers are found, the manycast poll interval is immediately set to eight times -maxpoll. +maxpoll. If less than -minclock +minclock servers are found when the TTL has reached the maximum hops, the manycast poll interval is doubled. For each transmission after that, the poll interval is doubled again until reaching the maximum of eight times -maxpoll. +maxpoll. Further transmissions use the same poll interval and TTL values. Note that while all this is going on, @@ -2066,7 +2029,7 @@ specified by the network router configuration and, in the case of IPv6, the link/site scope prefix. By default, the increment for TTL hops is 32 starting from 31; however, the -ttl +ttl configuration command can be used to modify the values to match the scope rules.

@@ -2081,19 +2044,19 @@ in TTL range will eventually find all primary servers in TTL range, which is probably not the most common objective in large networks. The -tos +tos command can be used to modify this behavior. Servers with stratum below -floor +floor or above -ceiling +ceiling specified in the -tos +tos command are strongly discouraged during the selection process; however, these servers may be temporally accepted if the number of servers within TTL range is less than -minclock. +minclock.

The above actions occur for each manycast client message, which repeats at the designated poll interval. @@ -2102,7 +2065,7 @@ subsequent manycast server replies are discarded, since that would result in a duplicate association. If during a poll interval the number of client associations falls below -minclock, +minclock, all manycast client prototype associations are reset to the initial poll interval and TTL hops and operation resumes from the beginning. @@ -2112,7 +2075,7 @@ all manycast servers in TTL range to respond. The result could well be an implosion, either minor or major, depending on the number of servers in range. The recommended value for -maxpoll +maxpoll is 12 (4,096 s).

It is possible and frequently useful to configure a host @@ -2126,9 +2089,9 @@ subnet of two primary servers and a hundred or more dependent clients. With two exceptions, all servers and clients have identical configuration files including both -multicastclient +multicastclient and -multicastserver +multicastserver commands using, for instance, multicast group address 239.1.1.1. The only exception is that each primary server @@ -2137,12 +2100,12 @@ reference source such as a GPS receiver.

The remaining configuration files for all secondary servers and clients have the same contents, except for the -tos +tos command, which is specific for each stratum level. For stratum 1 and stratum 2 servers, that command is not necessary. For stratum 3 and above servers the -floor +floor value is set to the intended stratum number. Thus, all stratum 3 configuration files are identical, all stratum 4 files are identical and so forth. @@ -2160,29 +2123,27 @@ will time out the corresponding association and re-associate accordingly.

Some administrators prefer to avoid running -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) continuously and run either -sntp(1sntpmdoc) +sntp(1sntpmdoc) or -ntpd(1ntpdmdoc) --q +ntpd(1ntpdmdoc) +-q as a cron job. In either case the servers must be configured in advance and the program fails if none are available when the cron job runs. A really slick application of manycast is with -ntpd(1ntpdmdoc) --q. +ntpd(1ntpdmdoc) +-q. The program wakes up, scans the local landscape looking for the usual suspects, selects the best from among the rascals, sets the clock and then departs. Servers do not have to be configured in advance and all clients throughout the network can have the same configuration file. -

1.1.5.2 Manycast Interactions with Autokey ¶

1.1.5.2 Manycast Interactions with Autokey

Each time a manycast client sends a client mode packet to a multicast group address, all manycast servers in scope generate a reply including the host name @@ -2212,11 +2173,9 @@ At the same time, the manycast scheme starts all over from the beginning and the expanding ring shrinks to the minimum and increments from there while collecting all servers in scope. -

1.1.5.3 Broadcast Options ¶

tos [bcpollbstep gate]

1.1.5.4 Manycast Options ¶

tos [ceiling ceiling | cohort { 0 | 1 } | floor floor | minclock minclock | minsane minsane]

+ -

1.1.6 Reference Clock Support ¶

1.1.6 Reference Clock Support

The NTP Version 4 daemon supports some three dozen different radio, satellite and modem reference clocks plus a special pseudo-clock used for backup or when no other clock source is available. @@ -2323,7 +2277,7 @@ be found in the page (available as part of the HTML documentation provided in -/usr/share/doc/ntp). +/usr/share/doc/ntp). Additional information can be found in the pages linked there, including the "Debugging Hints for Reference Clock Drivers" @@ -2332,14 +2286,14 @@ and pages (available as part of the HTML documentation provided in -/usr/share/doc/ntp). +/usr/share/doc/ntp). In addition, support for a PPS signal is available as described in the "Pulse-per-second (PPS) Signal Interfacing" page (available as part of the HTML documentation provided in -/usr/share/doc/ntp). +/usr/share/doc/ntp). Many drivers support special line discipline/streams modules which can significantly improve the accuracy using the driver. @@ -2349,7 +2303,7 @@ described in the page (available as part of the HTML documentation provided in -/usr/share/doc/ntp). +/usr/share/doc/ntp).

A reference clock will generally (though not always) be a radio timecode receiver which is synchronized to a source of standard @@ -2368,7 +2322,7 @@ in a scalding remark to the system log file, but is otherwise non hazardous.

For the purposes of configuration, -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) treats reference clocks in a manner analogous to normal NTP peers as much as possible. @@ -2376,12 +2330,12 @@ Reference clocks are identified by a syntactically correct but invalid IP address, in order to distinguish them from normal NTP peers. Reference clock addresses are of the form -127.127.t.u, +127.127.t.u, where -t +t is an integer denoting the clock type and -u +u indicates the unit number in the range 0-3. While it may seem overkill, it is in fact @@ -2389,24 +2343,24 @@ sometimes useful to configure multiple reference clocks of the same type, in which case the unit numbers must be unique.

The -server +server command is used to configure a reference clock, where the -address +address argument in that command is the clock address. The -key, -version +key, +version and -ttl +ttl options are not used for reference clock support. The -mode +mode option is added for reference clock support, as described below. The -prefer +prefer option can be useful to persuade the server to cherish a reference clock with somewhat more enthusiasm than other reference clocks or peers. @@ -2415,71 +2369,67 @@ information on this option can be found in the "Mitigation Rules and the prefer Keyword" (available as part of the HTML documentation provided in -/usr/share/doc/ntp) +/usr/share/doc/ntp) page. The -minpoll +minpoll and -maxpoll +maxpoll options have meaning only for selected clock drivers. See the individual clock driver document pages for additional information.

The -fudge +fudge command is used to provide additional information for individual clock drivers and normally follows immediately after the -server +server command. The -address +address argument specifies the clock address. The -refid +refid and -stratum +stratum options can be used to override the defaults for the device. There are two optional device-dependent time offsets and four flags that can be included in the -fudge +fudge command as well.

The stratum number of a reference clock is by default zero. Since the -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) daemon adds one to the stratum of each peer, a primary server ordinarily displays an external stratum of one. In order to provide engineered backups, it is often useful to specify the reference clock stratum as greater than zero. The -stratum +stratum option is used for this purpose. Also, in cases involving both a reference clock and a pulse-per-second (PPS) discipline signal, it is useful to specify the reference clock identifier as other than the default, depending on the driver. The -refid +refid option is used for this purpose. Except where noted, these options apply to all clock drivers. -

Reference Clock Commands

1.1.6.1 Reference Clock Commands ¶

server 127.127.t.u [prefer] [mode int] [minpoll int] [maxpoll int]

+ -

1.1.7 Miscellaneous Options ¶

broadcastdelay seconds

+ -

1.1.8 ntp.conf Files ¶

/etc/ntp.conf

+ -

1.1.9 ntp.conf See Also ¶

ntpd(1ntpdmdoc), -ntpdc(1ntpdcmdoc), -ntpq(1ntpqmdoc) +

1.1.9 ntp.conf See Also

ntpd(1ntpdmdoc), +ntpdc(1ntpdcmdoc), +ntpq(1ntpqmdoc)

In addition to the manual pages provided, comprehensive documentation is available on the world wide web at -http://www.ntp.org/. +http://www.ntp.org/. A snapshot of this documentation is available in HTML format in -/usr/share/doc/ntp. +/usr/share/doc/ntp.

David L. Mills, Network Time Protocol (Version 4), RFC5905 +

David L. Mills, Network Time Protocol (Version 4), RFC5905

+ -

1.1.10 ntp.conf Bugs ¶

1.1.10 ntp.conf Bugs

The syntax checking is not picky; some combinations of ridiculous and even hilarious options and modes may not be detected.

The -ntpkey_host +ntpkey_host files are really digital certificates. These should be obtained via secure directory services when they become universally available.

+ -

1.1.11 ntp.conf Notes ¶

1.1.11 ntp.conf Notes

This document was derived from FreeBSD. -

diff --git a/ntpd/ntp.conf.man.in b/ntpd/ntp.conf.man.in index 49ee85b5a..db365dbee 100644 --- a/ntpd/ntp.conf.man.in +++ b/ntpd/ntp.conf.man.in @@ -10,11 +10,11 @@ .ds B-Font B .ds I-Font I .ds R-Font R -.TH ntp.conf 5 "07 Jan 2024" "4.2.8p17" "File Formats" +.TH ntp.conf 5 "07 May 2024" "4.2.8p18-RC1" "File Formats" .\" .\" EDIT THIS FILE WITH CAUTION (in-mem file) .\" -.\" It has been AutoGen-ed January 7, 2024 at 12:34:31 AM by AutoGen 5.18.16 +.\" It has been AutoGen-ed May 7, 2024 at 05:29:41 AM by AutoGen 5.18.16 .\" From the definitions ntp.conf.def .\" and the template file agman-cmd.tpl .SH NAME diff --git a/ntpd/ntp.conf.mdoc.in b/ntpd/ntp.conf.mdoc.in index e0b5dce55..9430c8720 100644 --- a/ntpd/ntp.conf.mdoc.in +++ b/ntpd/ntp.conf.mdoc.in @@ -1,9 +1,9 @@ -.Dd January 7 2024 +.Dd May 7 2024 .Dt NTP_CONF 5 File Formats .Os .\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) .\" -.\" It has been AutoGen-ed January 7, 2024 at 12:34:20 AM by AutoGen 5.18.16 +.\" It has been AutoGen-ed May 7, 2024 at 05:28:50 AM by AutoGen 5.18.16 .\" From the definitions ntp.conf.def .\" and the template file agmdoc-cmd.tpl .Sh NAME diff --git a/ntpd/ntp.keys.5man b/ntpd/ntp.keys.5man index 13ee481a6..1cb2e1238 100644 --- a/ntpd/ntp.keys.5man +++ b/ntpd/ntp.keys.5man @@ -1,8 +1,8 @@ -.TH ntp.keys 5man "07 Jan 2024" "4.2.8p17" "File Formats" +.TH ntp.keys 5man "07 May 2024" "4.2.8p18-RC1" "File Formats" .\" .\" EDIT THIS FILE WITH CAUTION (ntp.man) .\" -.\" It has been AutoGen-ed January 7, 2024 at 12:34:33 AM by AutoGen 5.18.16 +.\" It has been AutoGen-ed May 7, 2024 at 05:29:46 AM by AutoGen 5.18.16 .\" From the definitions ntp.keys.def .\" and the template file agman-file.tpl .Sh NAME diff --git a/ntpd/ntp.keys.5mdoc b/ntpd/ntp.keys.5mdoc index 26fd7e066..e7efdab05 100644 --- a/ntpd/ntp.keys.5mdoc +++ b/ntpd/ntp.keys.5mdoc @@ -1,9 +1,9 @@ -.Dd January 7 2024 +.Dd May 7 2024 .Dt NTP_KEYS 5mdoc File Formats -.Os FreeBSD 11.2-RELEASE_SI +.Os FreeBSD 12.1-RELEASE_SI .\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) .\" -.\" It has been AutoGen-ed January 7, 2024 at 12:34:22 AM by AutoGen 5.18.16 +.\" It has been AutoGen-ed May 7, 2024 at 05:29:02 AM by AutoGen 5.18.16 .\" From the definitions ntp.keys.def .\" and the template file agmdoc-file.tpl .Sh NAME diff --git a/ntpd/ntp.keys.html b/ntpd/ntp.keys.html index 42c013701..11520e6a0 100644 --- a/ntpd/ntp.keys.html +++ b/ntpd/ntp.keys.html @@ -1,6 +1,6 @@ - + - + NTP Symmetric Key @@ -10,19 +10,24 @@ - - - - @@ -30,57 +35,63 @@ ul.toc-numbered-mark {list-style: none} +

NTP Symmetric Key

+ -

NTP’s Symmetric Key File User Manual ¶

NTP’s Symmetric Key File User Manual

This document describes the symmetric key file for the NTP Project’s -ntpd program. +ntpd program.

This document applies to version 4.2.8p17 of ntp.keys. +

This document applies to version 4.2.8p18-RC1 of ntp.keys.

- - -

Short Table of Contents

1 Description

1 Description

+ + + + + + +

+ -

1 Description ¶

1 Description

The name and location of the symmetric key file for ntpd can -be specified in a configuration file, by default /etc/ntp.keys. +

The name and location of the symmetric key file for ntpd can +be specified in a configuration file, by default /etc/ntp.keys.

Notes about ntp.keys

+ + + +

+ -

1.1 Notes about ntp.keys ¶

- - +

1.1 Notes about ntp.keys

+ + @@ -88,14 +99,14 @@ Up: Description & For a description of the use of this type of file, see the "Authentication Support" section of the -ntp.conf(5) +ntp.conf(5) page.

ntpd(8) +

ntpd(8) reads its keys from a file specified using the --k +-k command line option or the -keys +keys statement in the configuration file. While key number 0 is fixed by the NTP standard (as 56 zero bits) @@ -108,130 +119,127 @@ as the configuration file. Key entries use a fixed format of the form

keyno type key opt_IP_list
+keyno type key opt_IP_list

where -keyno +keyno is a positive integer (between 1 and 65535), -type +type is the message digest algorithm, -key +key is the key itself, and -opt_IP_list +opt_IP_list is an optional comma-separated list of IPs where the -keyno +keyno should be trusted. that are allowed to serve time. Each IP in -opt_IP_list +opt_IP_list may contain an optional -/subnetbits +/subnetbits specification which identifies the number of bits for the desired subnet of trust. If -opt_IP_list +opt_IP_list is empty, any properly-authenticated message will be accepted.

The -key +key may be given in a format controlled by the -type +type field. The -type -MD5 +type +MD5 is always supported. If -ntpd +ntpd was built with the OpenSSL library then any digest library supported by that library may be specified. However, if compliance with FIPS 140-2 is required the -type +type must be either -SHA +SHA or -SHA1. +SHA1.

What follows are some key types, and corresponding formats:

MD5

• Configuration Support		+
• Authentication Support		+
• Monitoring Support		+
• Access Control Support		+
• Automatic NTP Configuration Options		+
• Reference Clock Support		+
• Miscellaneous Options		+
• ntp.conf Files		+
• ntp.conf See Also		+
• ntp.conf Bugs		+
• ntp.conf Notes		+

• ntp.conf Files		Files +
• ntp.conf See Also		See Also +
• ntp.conf Bugs		Bugs +
• ntp.conf Notes		Notes +

• ntp.keys Files		Files +
• ntp.keys See Also		See Also +
• ntp.keys Notes		Notes +

• ntpd Description		Description +
• ntpd Invocation		Invoking ntpd +
• Usage		Usage +

• ntpd usage		ntpd help/usage (`--help`) +
• ntpd ipv4		ipv4 option (-4) +
• ntpd ipv6		ipv6 option (-6) +
• ntpd authreq		authreq option (-a) +
• ntpd authnoreq		authnoreq option (-A) +
• ntpd configfile		configfile option (-c) +
• ntpd driftfile		driftfile option (-f) +
• ntpd panicgate		panicgate option (-g) +
• ntpd force-step-once		force-step-once option (-G) +
• ntpd jaildir		jaildir option (-i) +
• ntpd interface		interface option (-I) +
• ntpd keyfile		keyfile option (-k) +
• ntpd logfile		logfile option (-l) +
• ntpd novirtualips		novirtualips option (-L) +
• ntpd modifymmtimer		modifymmtimer option (-M) +
• ntpd nice		nice option (-N) +
• ntpd pidfile		pidfile option (-p) +
• ntpd priority		priority option (-P) +
• ntpd quit		quit option (-q) +
• ntpd propagationdelay		propagationdelay option (-r) +
• ntpd saveconfigquit		saveconfigquit option +
• ntpd statsdir		statsdir option (-s) +
• ntpd trustedkey		trustedkey option (-t) +
• ntpd user		user option (-u) +
• ntpd updateinterval		updateinterval option (-U) +
• ntpd wait-sync		wait-sync option (-w) +
• ntpd slew		slew option (-x) +
• ntpd usepcc		usepcc option +
• ntpd pccfreq		pccfreq option +
• ntpd mdns		mdns option (-m) +
• ntpd config		presetting/configuring ntpd +
• ntpd exit status		exit status +
• ntpd Usage		Usage +
• ntpd Files		Files +
• ntpd See Also		See Also +
• ntpd Bugs		Bugs +
• ntpd Notes		Notes +

What	Default	Flag	Option
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`

What	Default	Flag	Option
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`

Variable	Description
`ind`	index on this list
`assid`	association ID
`status`	peer status word
`conf`	`yes`: persistent, `no`: ephemeral
`reach`	`yes`: reachable, `no`: unreachable
`auth`	`ok`, `yes`, `bad` and `none`
`condition`	selection status (see the `select` field of the peer status word)
`last_event`	event report (see the `event` field of the peer status word)
`cnt` -event count (see the `count` field of the peer status word)
`ind`	index on this list
`assid`	association ID
`status`	peer status word
`conf`	`yes`: persistent, `no`: ephemeral
`reach`	`yes`: reachable, `no`: unreachable
`auth`	`ok`, `yes`, `bad` and `none`
`condition`	selection status (see the `select` field of the peer status word)
`last_event`	event report (see the `event` field of the peer status word)
`cnt` +event count (see the `count` field of the peer status word)

Variable	Description
`[tally]`	single-character code indicating current value of the `select` field -of the peer status word.
`remote`	host name (or IP number) of peer
`refid`	association ID or kiss code.
`st`	stratum
`t`	`u`: unicast or manycast client, -`b`: broadcast or multicast client, -`l`: local (reference clock), -`s`: symmetric (peer), -`A`: manycast server, -`B`: broadcast server, -`M`: multicast server.
`when`	sec/min/hr since last received packet
`poll`	poll interval (log(2) s)
`reach`	reach shift register (octal)
`delay`	roundtrip delay
`offset`	offset of server relative to this host
`jitter`	jitter
`[tally]`	single-character code indicating current value of the `select` field +of the peer status word.
`remote`	host name (or IP number) of peer
`refid`	association ID or kiss code.
`st`	stratum
`t`	`u`: unicast or manycast client, +`b`: broadcast or multicast client, +`l`: local (reference clock), +`s`: symmetric (peer), +`A`: manycast server, +`B`: broadcast server, +`M`: multicast server.
`when`	sec/min/hr since last received packet
`poll`	poll interval (log(2) s)
`reach`	reach shift register (octal)
`delay`	roundtrip delay
`offset`	offset of server relative to this host
`jitter`	jitter

NTP Configuration File User’s Manual

NTP’s Configuration File User Manual ¶

NTP’s Configuration File User Manual

Short Table of Contents

1 Description ¶

1 Description

1.1 Notes about ntp.conf ¶

1.1 Notes about ntp.conf

1.1.1 Configuration Support ¶

1.1.1 Configuration Support

1.1.1.1 Configuration Commands ¶

1.1.1.1 Configuration Commands

1.1.1.2 Auxiliary Commands ¶

1.1.1.2 Auxiliary Commands

1.1.2 Authentication Support ¶

1.1.2 Authentication Support

1.1.2.1 Symmetric-Key Cryptography ¶

1.1.2.1 Symmetric-Key Cryptography

1.1.2.2 Public Key Cryptography ¶

1.1.2.2 Public Key Cryptography

1.1.2.3 Naming and Addressing ¶

1.1.2.3 Naming and Addressing

1.1.2.4 Operation ¶

1.1.2.4 Operation

1.1.2.5 Key Management ¶

1.1.2.5 Key Management

1.1.2.6 Authentication Commands ¶

1.1.2.6 Authentication Commands

1.1.2.7 Error Codes ¶

1.1.2.7 Error Codes

1.1.3 Monitoring Support ¶

1.1.3 Monitoring Support

1.1.3.1 Monitoring Commands ¶

1.1.3.1 Monitoring Commands

1.1.4 Access Control Support ¶

1.1.4 Access Control Support

1.1.4.1 The Kiss-of-Death Packet ¶

1.1.4.1 The Kiss-of-Death Packet

1.1.4.2 Access Control Commands ¶

1.1.4.2 Access Control Commands

1.1.5 Automatic NTP Configuration Options ¶

1.1.5.1 Manycasting ¶

1.1.5 Automatic NTP Configuration Options

1.1.5.1 Manycasting

1.1.5.2 Manycast Interactions with Autokey ¶

1.1.5.2 Manycast Interactions with Autokey

1.1.5.3 Broadcast Options ¶

1.1.5.3 Broadcast Options

1.1.5.4 Manycast Options ¶

1.1.5.4 Manycast Options

1.1.6 Reference Clock Support ¶

1.1.6 Reference Clock Support

1.1.6.1 Reference Clock Commands ¶

1.1.6.1 Reference Clock Commands

1.1.7 Miscellaneous Options ¶

1.1.7 Miscellaneous Options

1.1.8 ntp.conf Files ¶

1.1.8 ntp.conf Files

1.1.9 ntp.conf See Also ¶

1.1.9 ntp.conf See Also

1.1.10 ntp.conf Bugs ¶

1.1.10 ntp.conf Bugs

1.1.11 ntp.conf Notes ¶

1.1.11 ntp.conf Notes

NTP Symmetric Key

NTP’s Symmetric Key File User Manual ¶

NTP’s Symmetric Key File User Manual

Short Table of Contents

1 Description ¶

1 Description

1.1 Notes about ntp.keys ¶

1.1 Notes about ntp.keys

1.1.1 ntp.keys Files ¶

1.1.1 ntp.keys Files

1.1.2 ntp.keys See Also ¶

1.1.2 ntp.keys See Also

1.1.3 ntp.keys Notes ¶

1.1.3 ntp.keys Notes

ntpd: Network Time Protocol (NTP) Daemon User’s Manual

ntpd: Network Time Protocol (NTP) Daemon User Manual ¶

1.1.1 ntpd help/usage (`--help`) ¶

1.1.1 ntpd help/usage (`--help`)