What	Default	Flag	Option
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`

What	Default	Flag	Option
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`
configuration file	`/etc/ntp.conf`	`-c`	`conffile`
frequency file	none	`-f`	`driftfile`
leapseconds file	none		`leapfile`
process ID file	none	`-p`	`pidfile`
log file	system log	`-l`	`logfile`
include file	none	none	`includefile`
statistics path	`/var/NTP`	`-s`	`statsdir`
keys path	`/usr/local/etc`	`-k`	`keysdir`

Variable	Description
`ind`	index on this list
`assid`	association ID
`status`	peer status word
`conf`	`yes`: persistent, `no`: ephemeral
`reach`	`yes`: reachable, `no`: unreachable
`auth`	`ok`, `yes`, `bad` and `none`
`condition`	selection status (see the `select` field of the peer status word)
`last_event`	event report (see the `event` field of the peer status word)
`cnt` -event count (see the `count` field of the peer status word)
`ind`	index on this list
`assid`	association ID
`status`	peer status word
`conf`	`yes`: persistent, `no`: ephemeral
`reach`	`yes`: reachable, `no`: unreachable
`auth`	`ok`, `yes`, `bad` and `none`
`condition`	selection status (see the `select` field of the peer status word)
`last_event`	event report (see the `event` field of the peer status word)
`cnt` +event count (see the `count` field of the peer status word)

Column	Description
`lstint`	Interval in s between the receipt of the most recent packet from this -address and the completion of the retrieval of the MRU list by `ntpq`
`avgint`	Average interval in s between packets from this address.
`rstr`	Restriction flags associated with this address. -Most are copied unchanged from the matching `restrict` command, +
`lstint`	Interval in s between the receipt of the most recent packet from this +address and the completion of the retrieval of the MRU list by `ntpq`
`avgint`	Average interval in s between packets from this address.
`rstr`	Restriction flags associated with this address. +Most are copied unchanged from the matching `restrict` command, however 0x400 (kod) and 0x20 (limited) flags are cleared unless the last packet from this address triggered a rate control response.
`r`	Rate control indicator, either a period, `L` or `K` for +
`r`	Rate control indicator, either a period, `L` or `K` for no rate control response, rate limiting by discarding, or rate limiting with a KoD response, respectively.
`m`	Packet mode.
`v`	Packet version number.
`count`	Packets received from this address.
`rport`	Source port of last packet from this address.
`remote address`	DNS name, numeric address, or address followed by claimed DNS name which +
`m`	Packet mode.
`v`	Packet version number.
`count`	Packets received from this address.
`rport`	Source port of last packet from this address.
`remote address`	DNS name, numeric address, or address followed by claimed DNS name which could not be verified in parentheses.

Variable	Description
`[tally]`	single-character code indicating current value of the `select` field -of the peer status word.
`remote`	host name (or IP number) of peer
`refid`	association ID or kiss code.
`st`	stratum
`t`	`u`: unicast or manycast client, -`b`: broadcast or multicast client, -`l`: local (reference clock), -`s`: symmetric (peer), -`A`: manycast server, -`B`: broadcast server, -`M`: multicast server.
`when`	sec/min/hr since last received packet
`poll`	poll interval (log(2) s)
`reach`	reach shift register (octal)
`delay`	roundtrip delay
`offset`	offset of server relative to this host
`jitter`	jitter
`[tally]`	single-character code indicating current value of the `select` field +of the peer status word.
`remote`	host name (or IP number) of peer
`refid`	association ID or kiss code.
`st`	stratum
`t`	`u`: unicast or manycast client, +`b`: broadcast or multicast client, +`l`: local (reference clock), +`s`: symmetric (peer), +`A`: manycast server, +`B`: broadcast server, +`M`: multicast server.
`when`	sec/min/hr since last received packet
`poll`	poll interval (log(2) s)
`reach`	reach shift register (octal)
`delay`	roundtrip delay
`offset`	offset of server relative to this host
`jitter`	jitter

Variable	Description
`status`	system status word
`version`	NTP software version and build time
`processor`	hardware platform and version
`system`	operating system and version
`leap`	leap warning indicator (0-3)
`stratum`	stratum (1-15)
`precision`	precision (log(2) s)
`rootdelay`	total roundtrip delay to the primary reference clock
`rootdisp`	total dispersion to the primary reference clock
`peer`	system peer association ID
`tc` +
`status`	system status word
`version`	NTP software version and build time
`processor`	hardware platform and version
`system`	operating system and version
`leap`	leap warning indicator (0-3)
`stratum`	stratum (1-15)
`precision`	precision (log(2) s)
`rootdelay`	total roundtrip delay to the primary reference clock
`rootdisp`	total dispersion to the primary reference clock
`peer`	system peer association ID
`tc` time constant and poll exponent (log(2) s) (3-17)
`mintc` +
`mintc` minimum time constant (log(2) s) (3-10)
`clock`	date and time of day
`refid` -reference ID or kiss code
`reftime`	reference time
`offset`	combined offset of server relative to this host
`sys_jitter`	combined system jitter
`frequency`	frequency offset (PPM) relative to hardware clock
`clk_wander`	clock frequency wander (PPM)
`clk_jitter`	clock jitter
`tai`	TAI-UTC offset (s)
`leapsec`	NTP seconds when the next leap second is/was inserted
`expire`	NTP seconds when the NIST leapseconds file expires
`clock`	date and time of day
`refid` +reference ID or kiss code
`reftime`	reference time
`offset`	combined offset of server relative to this host
`sys_jitter`	combined system jitter
`frequency`	frequency offset (PPM) relative to hardware clock
`clk_wander`	clock frequency wander (PPM)
`clk_jitter`	clock jitter
`tai`	TAI-UTC offset (s)
`leapsec`	NTP seconds when the next leap second is/was inserted
`expire`	NTP seconds when the NIST leapseconds file expires

Variable	Description
`host`	Autokey host name for this host
`ident`	Autokey group name for this host
`flags`	host flags (see Autokey specification)
`digest`	OpenSSL message digest algorithm
`signature`	OpenSSL digest/signature scheme
`update`	NTP seconds at last signature update
`cert`	certificate subject, issuer and certificate flags
`until`	NTP seconds when the certificate expires
`host`	Autokey host name for this host
`ident`	Autokey group name for this host
`flags`	host flags (see Autokey specification)
`digest`	OpenSSL message digest algorithm
`signature`	OpenSSL digest/signature scheme
`update`	NTP seconds at last signature update
`cert`	certificate subject, issuer and certificate flags
`until`	NTP seconds when the certificate expires

Variable	Description
`associd`	association ID
`status`	peer status word
`srcadr`	source (remote) IP address and port
`dstadr`	destination (local) IP address and port
`leap`	leap indicator (0-3)
`stratum`	stratum (0-15)
`precision`	precision (log(2) s)
`rootdelay`	total roundtrip delay to the primary reference clock
`rootdisp`	total root dispersion to the primary reference clock
`refid`	reference ID or kiss code
`reftime`	reference time
`reach`	reach register (octal)
`unreach`	unreach counter
`hmode`	host mode (1-6)
`pmode`	peer mode (1-5)
`hpoll`	host poll exponent (log(2) s) (3-17)
`ppoll`	peer poll exponent (log(2) s) (3-17)
`headway`	headway (see Rate Management and the Kiss-o’-Death Packet)
`flash`	flash status word
`offset`	filter offset
`delay`	filter delay
`dispersion`	filter dispersion
`jitter`	filter jitter
`ident`	Autokey group name for this association
`bias`	unicast/broadcast bias
`xleave`	interleave delay (see NTP Interleaved Modes)
`associd`	association ID
`status`	peer status word
`srcadr`	source (remote) IP address and port
`dstadr`	destination (local) IP address and port
`leap`	leap indicator (0-3)
`stratum`	stratum (0-15)
`precision`	precision (log(2) s)
`rootdelay`	total roundtrip delay to the primary reference clock
`rootdisp`	total root dispersion to the primary reference clock
`refid`	reference ID or kiss code
`reftime`	reference time
`reach`	reach register (octal)
`unreach`	unreach counter
`hmode`	host mode (1-6)
`pmode`	peer mode (1-5)
`hpoll`	host poll exponent (log(2) s) (3-17)
`ppoll`	peer poll exponent (log(2) s) (3-17)
`headway`	headway (see Rate Management and the Kiss-o’-Death Packet)
`flash`	flash status word
`offset`	filter offset
`delay`	filter delay
`dispersion`	filter dispersion
`jitter`	filter jitter
`ident`	Autokey group name for this association
`bias`	unicast/broadcast bias
`xleave`	interleave delay (see NTP Interleaved Modes)

Variable	Description
`flags`	peer flags (see Autokey specification)
`host`	Autokey server name
`flags`	peer flags (see Autokey specification)
`signature`	OpenSSL digest/signature scheme
`initsequence`	initial key ID
`initkey`	initial key index
`timestamp`	Autokey signature timestamp
`flags`	peer flags (see Autokey specification)
`host`	Autokey server name
`flags`	peer flags (see Autokey specification)
`signature`	OpenSSL digest/signature scheme
`initsequence`	initial key ID
`initkey`	initial key index
`timestamp`	Autokey signature timestamp

Variable	Description
`associd`	association ID
`status`	clock status word
`device`	device description
`timecode`	ASCII time code string (specific to device)
`poll`	poll messages sent
`noreply`	no reply
`badformat`	bad format
`baddata`	bad date or time
`fudgetime1`	fudge time 1
`fudgetime2`	fudge time 2
`stratum`	driver stratum
`refid`	driver reference ID
`flags`	driver flags
`associd`	association ID
`status`	clock status word
`device`	device description
`timecode`	ASCII time code string (specific to device)
`poll`	poll messages sent
`noreply`	no reply
`badformat`	bad format
`baddata`	bad date or time
`fudgetime1`	fudge time 1
`fudgetime2`	fudge time 2
`stratum`	driver stratum
`refid`	driver reference ID
`flags`	driver flags

-Next: ntp.conf Description, Previous: (dir), Up: (dir)

+Next: Description, Previous: (dir), Up: (dir)

NTP’s Configuration File User Manual

NTP’s Configuration File User Manual ¶

This document describes the configuration file for the NTP Project’s -ntpd program. +ntpd program.

This document applies to version 4.2.8p17 of ntp.conf. +

This document applies to version 4.2.8p17 of ntp.conf.

- + + +

Short Table of Contents

1 Description

1 Description

- - - - - - - +

-Previous: Top, Up: Top

+Previous: NTP’s Configuration File User Manual, Up: NTP’s Configuration File User Manual

1 Description

1 Description ¶

The behavior of ntpd can be changed by a configuration file, -by default ntp.conf. +

The behavior of ntpd can be changed by a configuration file, +by default ntp.conf.

- - - - +

Notes about ntp.conf

-Previous: ntp.conf Bugs, Up: ntp.conf Description

+Up: Description

1.1 Notes about ntp.conf

- - +

1.1 Notes about ntp.conf ¶

+ +

The -ntp.conf +ntp.conf configuration file is read at initial startup by the -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) daemon in order to specify the synchronization sources, modes and other related information. Usually, it is installed in the -/etc +/etc directory, but could be installed elsewhere (see the daemon’s --c +-c command line option).

The file format is similar to other -UNIX +UNIX configuration files. Comments begin with a ‘#’ @@ -131,63 +120,52 @@ The page (available as part of the HTML documentation provided in -/usr/share/doc/ntp) +/usr/share/doc/ntp) contains an extended discussion of these options. In addition to the discussion of general ‘Configuration Options’, there are sections describing the following supported functionality and the options used to control it: -

Authentication Support -
Monitoring Support -
Access Control Support -
Automatic NTP Configuration Options -
Reference Clock Support -

Miscellaneous Options +

Authentication Support +
Monitoring Support +
Access Control Support +
Automatic NTP Configuration Options +
Reference Clock Support +
Miscellaneous Options

Following these is a section describing -Miscellaneous Options. +Miscellaneous Options. While there is a rich set of options available, the only required option is one or more -pool, -server, -peer, -broadcast +pool, +server, +peer, +broadcast or -manycastclient +manycastclient commands. -

- - - - - - - - - - - - - +

Configuration Support
Authentication Support
Monitoring Support
Access Control Support
Automatic NTP Configuration Options
Reference Clock Support
Miscellaneous Options
ntp.conf Files
ntp.conf See Also
ntp.conf Bugs
ntp.conf Notes

-Next: Authentication Support, Up: ntp.conf Notes

+Next: Authentication Support, Up: Notes about ntp.conf

1.1.1 Configuration Support

1.1.1 Configuration Support ¶

Following is a description of the configuration commands in NTPv4. These commands have the same basic functions as in NTPv3 and @@ -197,7 +175,12 @@ classes of commands, configuration commands that configure a persistent association with a remote server or peer or reference clock, and auxiliary commands that specify environmental variables that control various related operations. -

1.1.1.1 Configuration Commands ¶

The various modes are determined by the command keyword and the type of the required IP address. Addresses are classed by type as @@ -214,12 +197,12 @@ in some weird and even destructive behavior. is detected, support for the IPv6 address family is generated in addition to the default support of the IPv4 address family. In a few cases, including the -reslist +reslist billboard generated by -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) or -ntpdc(1ntpdcmdoc), +ntpdc(1ntpdcmdoc), IPv6 addresses are automatically generated. IPv6 addresses can be identified by the presence of colons “:” @@ -230,26 +213,26 @@ with the exception of reference clock addresses, which are always IPv4.

Note that in contexts where a host name is expected, a --4 +-4 qualifier preceding the host name forces DNS resolution to the IPv4 namespace, while a --6 +-6 qualifier forces DNS resolution to the IPv6 namespace. See IPv6 references for the equivalent classes for that address family. -

pool address [burst] [iburst] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [xmtnonce]
server address [key key | autokey] [burst] [iburst] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [true] [xmtnonce]
peer address [key key | autokey] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [true] [xleave]
broadcast address [key key | autokey] [version version] [prefer] [minpoll minpoll] [ttl ttl] [xleave]
manycastclient address [key key | autokey] [version version] [prefer] [minpoll minpoll] [maxpoll maxpoll] [ttl ttl]

1.1.1.2 Auxiliary Commands ¶

broadcastclient: This command enables reception of broadcast server messages to any local interface (type b) address. Upon receiving a message for @@ -482,7 +467,7 @@ server and client should operate using symmetric-key or public-key authentication as described in ‘Authentication Options’.
manycastserver address ...
manycastserver address ...: This command enables reception of manycast client messages to the multicast group address(es) (type m) specified. At least one @@ -496,7 +481,7 @@ and client should operate using symmetric-key or public-key authentication as described in ‘Authentication Options’.
multicastclient address ...
multicastclient address ...: This command enables reception of multicast server messages to the multicast group address(es) (type m) specified. Upon receiving @@ -510,28 +495,31 @@ both the server and client should operate using symmetric-key or public-key authentication as described in ‘Authentication Options’.
mdnstries number
mdnstries number: If we are participating in mDNS, after we have synched for the first time we attempt to register with the mDNS system. If that registration attempt fails, we try again at one minute intervals for up to -mdnstries +mdnstries times. After all, -ntpd +ntpd may be starting before mDNS. The default value for -mdnstries +mdnstries is 5.

- +

-Next: Monitoring Support, Previous: Configuration Support, Up: ntp.conf Notes

+Next: Monitoring Support, Previous: Configuration Support, Up: Notes about ntp.conf

1.1.2 Authentication Support

1.1.2 Authentication Support ¶

Authentication support allows the NTP client to verify that the server is in fact known and trusted and not an intruder intending accidentally or on purpose to masquerade as that server. @@ -572,15 +560,15 @@ are on the Building and Installing the Distribution page.

Authentication is configured separately for each association using the -key +key or -autokey +autokey subcommand on the -peer, -server, -broadcast +peer, +server, +broadcast and -manycastclient +manycastclient configuration commands as described in ‘Configuration Options’ page. @@ -609,16 +597,16 @@ the server certificate, verify its credentials and initialize the protocol

The -auth +auth flag controls whether new associations or remote configuration commands require cryptographic authentication. This flag can be set or reset by the -enable +enable and -disable +disable commands and also by remote configuration commands sent by a -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) program running on another machine. If this flag is enabled, which is the default @@ -631,7 +619,7 @@ even if not cryptographic authenticated. It should be understood that operating with the -auth +auth flag disabled invites a significant vulnerability where a rogue hacker can masquerade as a falseticker and seriously @@ -648,7 +636,7 @@ the authentication process itself.

An attractive alternative where multicast support is available is manycast mode, in which clients periodically troll for servers as described in the -Automatic NTP Configuration Options +Automatic NTP Configuration Options page. Either symmetric key or public key cryptographic authentication can be used in this mode. @@ -664,8 +652,18 @@ both symmetric key and public key cryptography are summarized below; further details are in the briefings, papers and reports at the NTP project page linked from -http://www.ntp.org/. -

1.1.2.1 Symmetric-Key Cryptography

+http://www.ntp.org/. +

Symmetric-Key Cryptography
Public Key Cryptography
Naming and Addressing
Operation
Key Management
Authentication Commands
Error Codes

1.1.2.1 Symmetric-Key Cryptography ¶

The original RFC-1305 specification allows any one of possibly 65,535 keys, each distinguished by a 32-bit key identifier, to authenticate an association. @@ -675,45 +673,47 @@ authenticate NTP packets. Keys and related information are specified in a key file, usually called -ntp.keys, +ntp.keys, which must be distributed and stored using secure means beyond the scope of the NTP protocol itself. Besides the keys used for ordinary NTP associations, additional keys can be used as passwords for the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) and -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility programs.

When -ntpd(1ntpdmdoc) +ntpd(1ntpdmdoc) is first started, it reads the key file specified in the -keys +keys configuration command and installs the keys in the key cache. However, individual keys must be activated with the -trusted +trusted command before use. This allows, for instance, the installation of possibly several batches of keys and then activating or deactivating each batch remotely using -ntpdc(1ntpdcmdoc). +ntpdc(1ntpdcmdoc). This also provides a revocation capability that can be used if a key becomes compromised. The -requestkey +requestkey command selects the key used as the password for the -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility, while the -controlkey +controlkey command selects the key used as the password for the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) utility. -

1.1.2.2 Public Key Cryptography

1.1.2.2 Public Key Cryptography ¶

NTPv4 supports the original NTPv3 symmetric key scheme described in RFC-1305 and in addition the Autokey protocol, which is based on public key cryptography. @@ -744,7 +744,7 @@ page.

The specific cryptographic environment used by Autokey servers and clients is determined by a set of files and soft links generated by the -ntp-keygen(1ntpkeygenmdoc) +ntp-keygen(1ntpkeygenmdoc) program. This includes a required host key file, required certificate file and optional sign key file, @@ -755,7 +755,7 @@ along with the matching sign key. There are several schemes available in the OpenSSL software library, each identified by a specific string such as -md5WithRSAEncryption, +md5WithRSAEncryption, which stands for the MD5 message digest with RSA encryption scheme. The current NTP distribution supports @@ -774,7 +774,9 @@ This requires the configuration file in all hosts to be engineered so that, even under anticipated failure conditions, the NTP subnet will form such that every group host can find a trail to at least one trusted host. -

1.1.2.3 Naming and Addressing

1.1.2.3 Naming and Addressing ¶

It is important to note that Autokey does not use DNS to resolve addresses, since DNS can’t be completely trusted until the name servers have synchronized clocks. @@ -787,7 +789,7 @@ DNS compromise is essential.

By convention, the name of an Autokey host is the name returned by the Unix -gethostname(2) +gethostname(2) system call or equivalent in other systems. By the system design model, there are no provisions to allow alternate names or aliases. @@ -806,7 +808,9 @@ For this reason operation with network address translation schemes is not possible. This reflects the intended robust security model where government and corporate NTP servers are operated outside firewall perimeters. -

1.1.2.4 Operation

1.1.2.4 Operation ¶

A specific combination of authentication scheme (none, symmetric key, public key) and identity scheme is called a cryptotype, although not all combinations are compatible. @@ -823,19 +827,19 @@ but may not represent good security practice. of mobilization, either at configuration time or some time later when a message of appropriate cryptotype arrives. When mobilized by a -server +server or -peer +peer configuration command and no -key +key or -autokey +autokey subcommands are present, the association is not authenticated; if the -key +key subcommand is present, the association is authenticated using the symmetric key ID specified; if the -autokey +autokey subcommand is present, the association is authenticated using Autokey.

@@ -877,7 +881,7 @@ If verification fails, Bob sends Cathy a thing called a crypto-NAK, which tells her something broke. She can see the evidence using the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) program.

Denise has rolled her own host key and certificate. @@ -895,10 +899,12 @@ servers (or the same server, although that might not be useful). But, wise security policy might preclude some cryptotype combinations; for instance, running an identity scheme with one server and no authentication with another might not be wise. -

1.1.2.5 Key Management

1.1.2.5 Key Management ¶

The cryptographic values used by the Autokey protocol are incorporated as a set of files generated by the -ntp-keygen(1ntpkeygenmdoc) +ntp-keygen(1ntpkeygenmdoc) utility program, including symmetric key, host key and public certificate files, as well as sign key, identity parameters and leapseconds files. @@ -907,9 +913,9 @@ certificate files can be generated by the OpenSSL utilities and certificates can be imported from public certificate authorities. Note that symmetric keys are necessary for the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) and -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility programs. The remaining files are necessary only for the Autokey protocol. @@ -928,11 +934,13 @@ The certificate extension fields must not contain either a subject key identifier or a issuer key identifier field; however, an extended key usage field for a trusted host must contain the value -trustRoot;. +trustRoot;. Other extension fields are ignored. -

1.1.2.6 Authentication Commands

autokey [logsec]

1.1.2.6 Authentication Commands ¶

autokey [logsec]

Specifies the interval between regenerations of the session key list used with the Autokey protocol. Note that the size of the key @@ -943,18 +951,18 @@ For poll intervals above the specified interval, a session key list with a single entry will be regenerated for every message sent.

controlkey key

Specifies the key identifier to use with the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) utility, which uses the standard protocol defined in RFC-1305. The -key +key argument is the key identifier for a trusted key, where the value can be in the range 1 to 65,535, inclusive.

crypto [cert file] [leap file] [randfile file] [host file] [gq file] [gqpar file] [iffpar file] [mvpar file] [pw password]

This command requires the OpenSSL library. It activates public key cryptography, selects the message digest and signature @@ -965,93 +973,93 @@ the default names are used as described above. Unless the complete path and name of the file are specified, the location of a file is relative to the keys directory specified in the -keysdir +keysdir command or default -/usr/local/etc. +/usr/local/etc. Following are the subcommands: -

cert file

keys keyfile

Specifies the complete path and location of the MD5 key file containing the keys and key identifiers used by -ntpd(1ntpdmdoc), -ntpq(1ntpqmdoc) +ntpd(1ntpdmdoc), +ntpq(1ntpqmdoc) and -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) when operating with symmetric key cryptography. This is the same operation as the --k +-k command line option.

keysdir path

This command specifies the default directory path for cryptographic keys, parameters and certificates. The default is -/usr/local/etc/. +/usr/local/etc/.

requestkey key

Specifies the key identifier to use with the -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) utility program, which uses a proprietary protocol specific to this implementation of -ntpd(1ntpdmdoc). +ntpd(1ntpdmdoc). The -key +key argument is a key identifier for the trusted key, where the value can be in the range 1 to 65,535, inclusive.

revoke logsec

Specifies the interval between re-randomization of certain cryptographic values used by the Autokey scheme, as a power of 2 in seconds. @@ -1063,28 +1071,30 @@ For poll intervals above the specified interval, the values will be updated for every message sent.

trustedkey key ...

Specifies the key identifiers which are trusted for the purposes of authenticating peers with symmetric key cryptography, as well as keys used by the -ntpq(1ntpqmdoc) +ntpq(1ntpqmdoc) and -ntpdc(1ntpdcmdoc) +ntpdc(1ntpdcmdoc) programs. The authentication procedures require that both the local and remote servers share the same key and key identifier for this purpose, although different keys can be used with different servers. The -key +key arguments are 32-bit unsigned integers with values from 1 to 65,535.

1.1.2.7 Error Codes

1.1.2.7 Error Codes ¶

The following error codes are reported via the NTP control and monitoring protocol trap mechanism. -

101: (bad field format or length) The packet has invalid version, length or format. @@ -1148,44 +1158,51 @@ The identity key is missing, corrupt or bogus.

- +

-Next: Access Control Support, Previous: Authentication Support, Up: ntp.conf Notes

+Next: Access Control Support, Previous: Authentication Support, Up: Notes about ntp.conf

1.1.3 Monitoring Support

ntpd(1ntpdmdoc) +

1.1.3 Monitoring Support ¶

ntpd(1ntpdmdoc) includes a comprehensive monitoring facility suitable for continuous, long term recording of server and client timekeeping performance. See the -statistics +statistics command below for a listing and example of each type of statistics currently supported. Statistic files are managed using file generation sets and scripts in the -./scripts +./scripts directory of the source code distribution. Using these facilities and -UNIX -cron(8) +UNIX +cron(8) jobs, the data can be automatically summarized and archived for retrospective analysis. -

1.1.3.1 Monitoring Commands

statistics name ...

• Configuration Support		-
• Authentication Support		-
• Monitoring Support		-
• Access Control Support		-
• Automatic NTP Configuration Options		-
• Reference Clock Support		-
• Miscellaneous Options		-
• ntp.conf Files		-
• ntp.conf See Also		-
• ntp.conf Bugs		-
• ntp.conf Notes		-

• ntpd Description		Description -
• ntpd Invocation		Invoking ntpd -
• Usage		Usage -

• ntpd usage		ntpd help/usage (`--help`) -
• ntpd ipv4		ipv4 option (-4) -
• ntpd ipv6		ipv6 option (-6) -
• ntpd authreq		authreq option (-a) -
• ntpd authnoreq		authnoreq option (-A) -
• ntpd configfile		configfile option (-c) -
• ntpd driftfile		driftfile option (-f) -
• ntpd panicgate		panicgate option (-g) -
• ntpd force-step-once		force-step-once option (-G) -
• ntpd jaildir		jaildir option (-i) -
• ntpd interface		interface option (-I) -
• ntpd keyfile		keyfile option (-k) -
• ntpd logfile		logfile option (-l) -
• ntpd novirtualips		novirtualips option (-L) -
• ntpd modifymmtimer		modifymmtimer option (-M) -
• ntpd nice		nice option (-N) -
• ntpd pidfile		pidfile option (-p) -
• ntpd priority		priority option (-P) -
• ntpd quit		quit option (-q) -
• ntpd propagationdelay		propagationdelay option (-r) -
• ntpd saveconfigquit		saveconfigquit option -
• ntpd statsdir		statsdir option (-s) -
• ntpd trustedkey		trustedkey option (-t) -
• ntpd user		user option (-u) -
• ntpd updateinterval		updateinterval option (-U) -
• ntpd wait-sync		wait-sync option (-w) -
• ntpd slew		slew option (-x) -
• ntpd usepcc		usepcc option -
• ntpd pccfreq		pccfreq option -
• ntpd mdns		mdns option (-m) -
• ntpd config		presetting/configuring ntpd -
• ntpd exit status		exit status -
• ntpd Usage		Usage -
• ntpd Files		Files -
• ntpd See Also		See Also -
• ntpd Bugs		Bugs -
• ntpd Notes		Notes -

• ntpdc Description		Description -
• ntpdc Invocation		Invoking ntpdc -
• Usage		Usage -

• ntpdc usage		ntpdc help/usage (`--help`) -
• ntpdc ipv4		ipv4 option (-4) -
• ntpdc ipv6		ipv6 option (-6) -
• ntpdc command		command option (-c) -
• ntpdc interactive		interactive option (-i) -
• ntpdc listpeers		listpeers option (-l) -
• ntpdc numeric		numeric option (-n) -
• ntpdc peers		peers option (-p) -
• ntpdc showpeers		showpeers option (-s) -
• ntpdc unconnected		unconnected option (-u) -
• ntpdc config		presetting/configuring ntpdc -
• ntpdc exit status		exit status -
• ntpdc Usage		Usage -
• ntpdc See Also		See Also -
• ntpdc Authors		Authors -
• ntpdc Bugs		Bugs -

• ntp-keygen usage		ntp-keygen help/usage (`--help`) -
• ntp-keygen imbits		imbits option (-b) -
• ntp-keygen certificate		certificate option (-c) -
• ntp-keygen cipher		cipher option (-C) -
• ntp-keygen id-key		id-key option (-e) -
• ntp-keygen gq-params		gq-params option (-G) -
• ntp-keygen host-key		host-key option (-H) -
• ntp-keygen iffkey		iffkey option (-I) -
• ntp-keygen ident		ident option (-i) -
• ntp-keygen lifetime		lifetime option (-l) -
• ntp-keygen modulus		modulus option (-m) -
• ntp-keygen md5key		md5key option (-M) -
• ntp-keygen pvt-cert		pvt-cert option (-P) -
• ntp-keygen password		password option (-p) -
• ntp-keygen export-passwd		export-passwd option (-q) -
• ntp-keygen subject-name		subject-name option (-s) -
• ntp-keygen sign-key		sign-key option (-S) -
• ntp-keygen trusted-cert		trusted-cert option (-T) -
• ntp-keygen mv-params		mv-params option (-V) -
• ntp-keygen mv-keys		mv-keys option (-v) -
• ntp-keygen config		presetting/configuring ntp-keygen -
• ntp-keygen exit status		exit status -
• ntp-keygen Usage		Usage -
• ntp-keygen Notes		Notes -
• ntp-keygen Bugs		Bugs -

Copyright Notice

NTP Configuration File User’s Manual

NTP’s Configuration File User Manual

NTP’s Configuration File User Manual ¶

Short Table of Contents

1 Description

1 Description ¶

1.1 Notes about ntp.conf

1.1 Notes about ntp.conf ¶

1.1.1 Configuration Support

1.1.1 Configuration Support ¶

1.1.1.1 Configuration Commands

1.1.1.1 Configuration Commands ¶

1.1.1.2 Auxiliary Commands

1.1.1.2 Auxiliary Commands ¶

1.1.2 Authentication Support

1.1.2 Authentication Support ¶

1.1.2.1 Symmetric-Key Cryptography

1.1.2.1 Symmetric-Key Cryptography ¶

1.1.2.2 Public Key Cryptography

1.1.2.2 Public Key Cryptography ¶

1.1.2.3 Naming and Addressing

1.1.2.3 Naming and Addressing ¶

1.1.2.4 Operation

1.1.2.4 Operation ¶

1.1.2.5 Key Management

1.1.2.5 Key Management ¶

1.1.2.6 Authentication Commands

1.1.2.6 Authentication Commands ¶

1.1.2.7 Error Codes

1.1.2.7 Error Codes ¶

1.1.3 Monitoring Support

1.1.3 Monitoring Support ¶

1.1.3.1 Monitoring Commands

1.1.3.1 Monitoring Commands ¶

1.1.4 Access Control Support

1.1.4 Access Control Support ¶

1.1.4.1 The Kiss-of-Death Packet

1.1.4.1 The Kiss-of-Death Packet ¶

1.1.4.2 Access Control Commands

1.1.4.2 Access Control Commands ¶

1.1.5 Automatic NTP Configuration Options

1.1.5.1 Manycasting

1.1.5 Automatic NTP Configuration Options ¶

1.1.5.1 Manycasting ¶

1.1.5.2 Manycast Interactions with Autokey

1.1.5.2 Manycast Interactions with Autokey ¶

1.1.5.3 Broadcast Options

1.1.5.3 Broadcast Options ¶

1.1.5.4 Manycast Options

1.1.5.4 Manycast Options ¶

1.1.6 Reference Clock Support

1.1.6 Reference Clock Support ¶

1.1.6.1 Reference Clock Commands

1.1.6.1 Reference Clock Commands ¶

1.1.7 Miscellaneous Options

1.1.7 Miscellaneous Options ¶

1.1.8 ntp.conf Files

1.1.8 ntp.conf Files ¶

1.1.9 ntp.conf See Also

1.1.9 ntp.conf See Also ¶

1.1.10 ntp.conf Bugs

1.1.10 ntp.conf Bugs ¶

1.1.11 ntp.conf Notes

1.1.11 ntp.conf Notes ¶

NTP Symmetric Key

NTP’s Symmetric Key File User Manual

NTP’s Symmetric Key File User Manual ¶

Short Table of Contents

1 Description

1 Description ¶

1.1 Notes about ntp.keys

1.1 Notes about ntp.keys ¶

1.1.1 ntp.keys Files

1.1.1 ntp.keys Files ¶

1.1.2 ntp.keys See Also

1.1.2 ntp.keys See Also ¶

1.1.3 ntp.keys Notes

1.1.3 ntp.keys Notes ¶

ntpd: Network Time Protocol (NTP) Daemon User’s Manual

1.1.1 ntpd help/usage (`--help`)

1.1.1 ntpd help/usage (`--help`) ¶