+| Client/Server |
NONE |
AUTH |
PC |
diff --git a/html/keygen.html b/html/keygen.html
index 2b47e579e..bb0589188 100644
--- a/html/keygen.html
+++ b/html/keygen.html
@@ -206,6 +206,7 @@
All cryptographically sound key generation schemes must have means to randomize the entropy seed used to initialize the internal pseudo-random number generator used by the OpenSSL library routines. If a site supports ssh, it is very likely that means to do this are already available. The entropy seed used by the OpenSSL library is contained in a file, usually called .rnd, which must be available when starting the ntp-keygen program or ntpd daemon.
The OpenSSL library looks for the file using the path specified by the RANDFILE environment variable in the user home directory, whether root or some other user. If the RANDFILE environment variable is not present, the library looks for the .rnd file in the user home directory. Since both the ntp-keygen program and ntpd daemon must run as root, the logical place to put this file is in /.rnd or /root/.rnd. If the file is not available or cannot be written, the program exits with a message to the system log.
+On systems that provide /dev/urandom, the randomness device is used instead and the file specified by the randfile subcommand or the RANDFILE environment variable is ignored.
Cryptographic Data Files
diff --git a/html/ntpd.html b/html/ntpd.html
index 2973b8880..9a160007c 100644
--- a/html/ntpd.html
+++ b/html/ntpd.html
@@ -32,7 +32,7 @@
Synopsis
- ntpd [ -46aAbdDgLmnNqx ] [ -c conffile ] [ -f driftfile ] [ -i jaildir ] [ -k keyfile ] [ -l logfile ] [ -p pidfile ] [ -P priority ] [ -r broadcastdelay ] [ -s statsdir ] [ -t key ] [ -u user[:group] ] [ -U interface_update_interval ] [ -v variable ] [ -V variable ]
+ ntpd [ -46aAbdDgLnNqx ] [ -c conffile ] [ -f driftfile ] [ -i jaildir ] [ -I iface ] [ -k keyfile ] [ -l logfile ] [ -p pidfile ] [ -P priority ] [ -r broadcastdelay ] [ -s statsdir ] [ -t key ] [ -u user[:group] ] [ -U interface_update_interval ] [ -v variable ] [ -V variable ]
Description
The ntpd program is an operating system daemon that synchronises the system clock with remote NTP time servers or local reference clocks. It is a complete implementation of the Network Time Protocol (NTP) version 4, but also retains compatibility with version 3, as defined by RFC-1305, and version 1 and 2, as defined by RFC-1059 and RFC-1119, respectively. The program can operate in any of several modes, as described on the Association Management page, and with both symmetric key and public key cryptography, as described on the Authentication Options page.
The ntpd program ordinarily requires a configuration file as desccribe on the Configuration Commands and Options collection above. However a client can discover remote servers and configure them automatically. This makes it possible to deploy a fleet of workstations without specifying configuration details specific to the local environment. Further details are on the Automatic Server Discovery page.
@@ -44,7 +44,7 @@
The issues should be carefully considered before using these options. The maximum slew rate possible is limited to 500 parts-per-million (PPM) by the Unix kernel. As a result, the clock can take 2000 s for each second the clock is outside the acceptable range. During this interval the clock will not be consistent with any other network clock and the system cannot be used for distributed applications that require correctly synchronized network time.
The frequency file, usually called ntp.drift, contains the latest estimate of clock frequency. If this file does not exist when ntpd is started, it enters a special mode designed to measure the particular frequency directly. The measurement takes 15 minutes, after which the frequency is set and ntpd resumes normal mode where the time and frequency are continuously adjusted. The frequency file is updated at intervals of an hour or more depending on the measured clock stability.
Operating Modes
- The ntpd program normally operates continuously while adjusting the time and frequency, but in some cases it may not be practical to run it continuously. With the -q option ntpd operates as in continous mode, but exits just after setting the clock for the first time. Most applications will probably want to specify the iburst option with the server command. With this option a volley of messages is exchanged to groom the data and set the clock in about 10 s. If nothing is heard after a few minutes, the daemon times out and exits.
+ The ntpd program normally operates continuously while adjusting the time and frequency, but in some cases it may not be practical to run it continuously. With the -q option ntpd operates as in continous mode, but exits just after setting the clock for the first time with the configured servers. Most applications will probably want to specify the iburst option with the server command. With this option a volley of messages is exchanged to groom the data and set the clock in about 10 s. If nothing is heard after a few minutes, the daemon times out and exits.
Poll Interval Control
NTP uses an intricate heuristic algorithm to automatically control the poll interval for maximum accuracy consistent with minimum network overhead. The algorithm measures the incidental offset and jitter to determine the best poll interval. When ntpd starts, the interval is the default minimum 64 s. Under normal conditions when the clock discipline has stabilized, the interval increases in steps to the default maximum 1024 s. In addition, should a server become unreachable after some time, the interval increases in steps to the maximum in order to reduce network overhead.
The default poll interval range is suitable for most conditions, but can be changed using options on the Server Options and Miscellaneous Options pages. However, when using maximum intervals much larger than the default, the residual clock frequency error must be small enough for the discipline loop to capture and correct. The capture range is 500 PPM with a 64-s interval decreasing by a factor of two for each interval doubling. At a 36-hr interval, for example, the capture range is only 0.24 PPM.
@@ -88,8 +88,13 @@
In contexts where a host name is expected, a -4 qualifier preceding the host name forces DNS resolution to the IPv4 namespace, while a -6 qualifier forces DNS resolution to the IPv6 namespace.
Various internal ntpd variables can be displayed and configuration options altered while the ntpd is running using the ntpq and ntpdc utility programs.
When ntpd starts it looks at the value of umask, and if zero ntpd will set the umask to 022.
+ Unless the -n, -d or -D option is used, ntpd changes the current working directory to the root directory, so any options or commands specifying paths need to use an absolute path or a path relative to the root.
Command Line Options
+ - -4
+
- Force DNS resolution of host names to the IPv4 namespace.
+
- -6
+
- Force DNS resolution of host names to the IPv6 namespace.
- -a
- Require cryptographic authentication for broadcast client, multicast client and symmetric passive associations. This is the same operation as the enable auth command and is the default.
- -A
@@ -103,7 +108,7 @@
- -D level
- Specify debugging level directly.
- -f driftfile
- - Specify the name and path of the frequency file, default /etc/ntp.drift. This is the same operation as the driftfile driftfile command.
+ - Specify the name and path of the frequency file. This is the same operation as the driftfile driftfile command.
- -g
- Normally, ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, ntpd will exit with a message to the system log. This option can be used with the -q and -x options. See the tinker command for other options.
- -i jaildir
@@ -111,7 +116,7 @@
- -I [address | interface name]
- Open the network address given, or all the addresses associated with the given interface name. This option may appear multiple times. This option also implies not opening other addresses, except wildcard and localhost. This option is deprecated. Please consider using the configuration file interface command, which is more versatile.
- -k keyfile
- - Specify the name and path of the symmetric key file, default /etc/ntp.keys. This is the same operation as the keys keyfile command.
+ - Specify the name and path of the symmetric key file. This is the same operation as the keys keyfile command.
- -l logfile
- Specify the name and path of the log file. The default is the system log file. This is the same operation as the logfile logfile command.
- -L
@@ -220,6 +225,9 @@
keysdir |