From: Harlan Stenn Date: Fri, 21 Dec 2012 23:25:01 +0000 (+0000) Subject: NTP_4_2_7P336 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c9156876ff960e52ba4bcf64fb2b04aa5bd4347a;p=thirdparty%2Fntp.git NTP_4_2_7P336 bk: 50d4efcdVuKrKObrbFAGNaBDEOnskQ --- diff --git a/ChangeLog b/ChangeLog index 7db7efb84a..75ce001796 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,4 @@ +(4.2.7p336) 2012/12/21 Released by Harlan Stenn * [Bug 1223] Final cleanup for rlimit changes. (4.2.7p335) 2012/12/18 Released by Harlan Stenn * Update documentation templates and definitions. diff --git a/ntpd/invoke-ntp.conf.texi b/ntpd/invoke-ntp.conf.texi index e066fbcded..8cb6df4762 100644 --- a/ntpd/invoke-ntp.conf.texi +++ b/ntpd/invoke-ntp.conf.texi @@ -6,7 +6,7 @@ # # EDIT THIS FILE WITH CAUTION (invoke-ntp.conf.texi) # -# It has been AutoGen-ed December 17, 2012 at 11:37:53 AM by AutoGen 5.16.2 +# It has been AutoGen-ed December 21, 2012 at 11:32:20 AM by AutoGen 5.16.2 # From the definitions ntp.conf.def # and the template file agtexi-file.tpl @end ignore diff --git a/ntpd/invoke-ntp.keys.texi b/ntpd/invoke-ntp.keys.texi index f1debb67c0..7fc50fbd53 100644 --- a/ntpd/invoke-ntp.keys.texi +++ b/ntpd/invoke-ntp.keys.texi @@ -6,7 +6,7 @@ # # EDIT THIS FILE WITH CAUTION (invoke-ntp.keys.texi) # -# It has been AutoGen-ed December 18, 2012 at 03:31:40 AM by AutoGen 5.16.2 +# It has been AutoGen-ed December 21, 2012 at 11:19:24 PM by AutoGen 5.16.2 # From the definitions ntp.keys.def # and the template file agtexi-file.tpl @end ignore diff --git a/ntpd/invoke-ntpd.texi b/ntpd/invoke-ntpd.texi index aae92c9c4d..a306b97162 100644 --- a/ntpd/invoke-ntpd.texi +++ b/ntpd/invoke-ntpd.texi @@ -6,7 +6,7 @@ # # EDIT THIS FILE WITH CAUTION (invoke-ntpd.texi) # -# It has been AutoGen-ed December 18, 2012 at 03:57:30 AM by AutoGen 5.16.2 +# It has been AutoGen-ed December 21, 2012 at 06:19:58 PM by AutoGen 5.16.2 # From the definitions ntpd-opts.def # and the template file agtexi-cmd.tpl @end ignore @@ -140,7 +140,7 @@ with a status code of 0. @exampleindent 0 @example -ntpd - NTP daemon program - Ver. 4.2.7p335 +ntpd - NTP daemon program - Ver. 4.2.7p336 USAGE: ntpd [ - [] | --[@{=| @}] ]... \ [ ... ] Flg Arg Option-Name Description diff --git a/ntpd/ntp.conf.5man b/ntpd/ntp.conf.5man index 714d800109..d46ab9330c 100644 --- a/ntpd/ntp.conf.5man +++ b/ntpd/ntp.conf.5man @@ -1,8 +1,8 @@ -.TH ntp.conf 5man "17 Dec 2012" "4.2.7p335" "File Formats" +.TH ntp.conf 5man "21 Dec 2012" "4.2.7p336" "File Formats" .\" .\" EDIT THIS FILE WITH CAUTION (ntp.man) .\" -.\" It has been AutoGen-ed December 17, 2012 at 11:37:40 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 11:32:07 AM by AutoGen 5.16.2 .\" From the definitions ntp.conf.def .\" and the template file agman-cmd.tpl .\" diff --git a/ntpd/ntp.conf.5mdoc b/ntpd/ntp.conf.5mdoc index 9b3c2bcb5a..ee43e60427 100644 --- a/ntpd/ntp.conf.5mdoc +++ b/ntpd/ntp.conf.5mdoc @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTP_CONF 5mdoc File Formats .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:32 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:00 PM by AutoGen 5.16.2 .\" From the definitions ntp.conf.def .\" and the template file agmdoc-cmd.tpl .Sh NAME diff --git a/ntpd/ntp.conf.html b/ntpd/ntp.conf.html index e3b234f439..6e925b2e4b 100644 --- a/ntpd/ntp.conf.html +++ b/ntpd/ntp.conf.html @@ -33,14 +33,7 @@ Up: (dir)

This document describes the configuration file for the NTP Project's ntpd program. -

This document applies to version 4.2.7p335 of ntp.conf. - -

-

Short Contents

- -
+

This document applies to version 4.2.7p336 of ntp.conf.

  • ntp.conf Description @@ -62,11 +55,11 @@ by default ntp.conf.

    - +
    -

    Invoking ntp.conf

    +

    Notes about ntp.conf

    @@ -77,18 +70,16 @@ configuration file is read at initial startup by the daemon in order to specify the synchronization sources, modes and other related information. Usually, it is installed in the -.Pa -/etc +/etc directory, but could be installed elsewhere (see the daemon's -c command line option).

    The file format is similar to other -.Ux +UNIX configuration files. Comments begin with a -.Ql # character and extend to the end of the line; blank lines are ignored. @@ -103,80 +94,55 @@ and text strings.

    The rest of this page describes the configuration and control options. The -.Qq -Notes -on -Configuring -NTP -and -Setting -up -a -NTP -Subnet +"NotesonConfiguringNTPandSettingupaNTPSubnet" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp) ) contains an extended discussion of these options. In addition to the discussion of general -.Sx -Configuration +ConfigurationConfiguration Options , there are sections describing the following supported functionality and the options used to control it:

      -
    • .Sx -Authentication +
    • AuthenticationAuthentication Support -
    • .Sx -Monitoring +
    • MonitoringMonitoring Support -
    • .Sx -Access +
    • AccessAccess Control Support -
    • .Sx -Automatic +
    • AutomaticAutomatic NTP Configuration Options -
    • .Sx -Reference +
    • ReferenceReference Clock Support -
    • .Sx -Miscellaneous +
    • MiscellaneousMiscellaneous Options

    Following these is a section describing -.Sx -Miscellaneous +MiscellaneousMiscellaneous Options . While there is a rich set of options available, the only required option is one or more -.Ic -pool -, -.Ic -server -, -.Ic -peer -, -.Ic -broadcast -or -.Ic -manycastclient -commands. -.Sh -Configuration +pool, server, peer, broadcast or +manycastclient commands. +

    +

    + +
    +
    + +

    Configuration

    + +

    Configuration Support Following is a description of the configuration commands in NTPv4. @@ -187,8 +153,15 @@ classes of commands, configuration commands that configure a persistent association with a remote server or peer or reference clock, and auxiliary commands that specify environmental variables that control various related operations. -.Ss -Configuration +

    +

    + +
    +
    + +

    Configuration

    + +

    Configuration Commands The various modes are determined by the command keyword and the type of the required IP address. @@ -208,7 +181,6 @@ in addition to the default support of the IPv4 address family. In a few cases, including the reslist billboard generated by ntpdc, IPv6 addresses are automatically generated. IPv6 addresses can be identified by the presence of colons -.Dq \&: in the address field. IPv6 addresses can be used almost everywhere where @@ -224,167 +196,47 @@ while a See IPv6 references for the equivalent classes for that address family.

    -
    Xo
    .Op -Cm -burst -.Op -Cm -iburst -.Op -Cm -version -Ar -version -.Op -Cm -prefer -.Op -Cm -minpoll -Ar -minpoll -.Op -Cm -maxpoll -Ar -maxpoll -.Xc -
    Xo
    .Op -Cm -key -Ar -key -\&| -Cm -autokey -.Op -Cm -burst -.Op -Cm -iburst -.Op -Cm -version -Ar -version -.Op -Cm -prefer -.Op -Cm -minpoll -Ar -minpoll -.Op -Cm -maxpoll -Ar -maxpoll -.Xc -
    Xo
    .Op -Cm -key -Ar -key -\&| -Cm -autokey -.Op -Cm -version -Ar -version -.Op -Cm -prefer -.Op -Cm -minpoll -Ar -minpoll -.Op -Cm -maxpoll -Ar -maxpoll -.Xc -
    Xo
    .Op -Cm -key -Ar -key -\&| -Cm -autokey -.Op -Cm -version -Ar -version -.Op -Cm -prefer -.Op -Cm -minpoll -Ar -minpoll -.Op -Cm -ttl -Ar -ttl -.Xc -
    Xo
    .Op -Cm -key -Ar -key -\&| -Cm -autokey -.Op -Cm -version -Ar -version -.Op -Cm -prefer -.Op -Cm -minpoll -Ar -minpoll -.Op -Cm -maxpoll -Ar -maxpoll -.Op -Cm -ttl -Ar -ttl -.Xc +
    Xo
    [burst ] +[iburst ] +[version Ar version ] +[prefer ] +[minpoll Ar minpoll ] +[maxpoll Ar maxpoll ] +
    Xo
    [key Ar key\&| Cm autokey ] +[burst ] +[iburst ] +[version Ar version ] +[prefer ] +[minpoll Ar minpoll ] +[maxpoll Ar maxpoll ] +
    Xo
    [key Ar key\&| Cm autokey ] +[version Ar version ] +[prefer ] +[minpoll Ar minpoll ] +[maxpoll Ar maxpoll ] +
    Xo
    [key Ar key\&| Cm autokey ] +[version Ar version ] +[prefer ] +[minpoll Ar minpoll ] +[ttl Ar ttl ] +
    Xo
    [key Ar key\&| Cm autokey ] +[version Ar version ] +[prefer ] +[minpoll Ar minpoll ] +[maxpoll Ar maxpoll ] +[ttl Ar ttl ]

    These five commands specify the time server name or address to be used and the mode in which to operate. The -.Ar -address -can be +address can be either a DNS name or an IP address in dotted-quad notation. Additional information on association behavior can be found in the -.Qq -Association -Management +"AssociationManagement" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) .

    @@ -400,8 +252,7 @@ In this mode the local clock can synchronized to the remote server, but the remote server can never be synchronized to the local clock. This command should -.Em -not +not be used for type b or m addresses.
    Ic
    For type s addresses (only), this command mobilizes a @@ -425,9 +276,7 @@ broadcast messages go only to the interface associated with the subnet specified, but multicast messages go to all interfaces. In broadcast mode the local server sends periodic broadcast messages to a client population at the -.Ar -address -specified, which is usually the broadcast address on (one of) the +address specified, which is usually the broadcast address on (one of) the local network(s) or a multicast address assigned to NTP. The IANA has assigned the multicast group address IPv4 224.0.1.1 and @@ -437,21 +286,15 @@ messages within administrative boundaries. Ordinarily, this specification applies only to the local server operating as a sender; for operation as a broadcast client, see the -.Ic -broadcastclient -or -.Ic -multicastclient -commands +broadcastclient or +multicastclient commands below.
    Ic
    For type m addresses (only), this command mobilizes a manycast client mode association for the multicast address specified. In this case a specific address must be supplied which matches the address used on the -.Ic -manycastserver -command for +manycastserver command for the designated manycast servers. The NTP multicast address 224.0.1.1 assigned by the IANA should NOT be used, unless specific @@ -459,23 +302,17 @@ means are taken to avoid spraying large areas of the Internet with these messages and causing a possibly massive implosion of replies at the sender. The -.Ic -manycastserver -command specifies that the local server +manycastserver command specifies that the local server is to operate in client mode with the remote servers that are discovered as the result of broadcast/multicast messages. The client broadcasts a request message to the group address associated with the specified -.Ar -address -and specifically enabled +address and specifically enabled servers respond to these messages. The client selects the servers providing the best time and continues as with the -.Ic -server -command. +server command. The remaining servers are discarded as if never heard. @@ -484,8 +321,7 @@ heard.
    Cm
    All packets sent to and received from the server or peer are to include authentication fields encrypted using the autokey scheme described in -.Sx -Authentication +AuthenticationAuthentication Options .
    Cm
    when the server is reachable, send a burst of eight packets @@ -496,9 +332,7 @@ can be changed with the calldelay command to allow additional time for a modem or ISDN call to complete. This is designed to improve timekeeping quality with the -.Ic -server -command and s addresses. +server command and s addresses.
    Cm
    When the server is unreachable, send a burst of eight packets instead of the usual one. The packet spacing is normally 2 s; @@ -507,32 +341,24 @@ changed with the calldelay command to allow additional time for a modem or ISDN call to complete. This is designed to speed the initial synchronization acquisition with the -.Ic -server -command and s addresses and when +server command and s addresses and when ntpd(1ntpdmdoc) is started with the -q option.
    Cm
    All packets sent to and received from the server or peer are to include authentication fields encrypted using the specified -.Ar -key -identifier with values from 1 to 65534, inclusive. +key identifier with values from 1 to 65534, inclusive. The default is to include no encryption field.
    Cm
    Cm
    These options specify the minimum and maximum poll intervals for NTP messages, as a power of 2 in seconds The maximum poll interval defaults to 10 (1,024 s), but can be increased by the -.Cm -maxpoll -option to an upper limit of 17 (36.4 h). +maxpoll option to an upper limit of 17 (36.4 h). The minimum poll interval defaults to 6 (64 s), but can be decreased by the -.Cm -minpoll -option to a lower limit of 4 (16 s). +minpoll option to a lower limit of 4 (16 s).
    Cm
    Marks the server as unused, except for display purposes. The server is discarded by the selection algroithm.
    Cm
    Marks the server as preferred. @@ -540,30 +366,19 @@ All other things being equal, this host will be chosen for synchronization among a set of correctly operating hosts. See the -.Qq -Mitigation -Rules -and -the -prefer -Keyword +"MitigationRulesandthepreferKeyword" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp) ) for further information.
    Cm
    This option is used only with broadcast server and manycast client modes. It specifies the time-to-live -.Ar -ttl -to +ttl to use on broadcast server and multicast server and the maximum -.Ar -ttl -for the expanding ring search with manycast +ttl for the expanding ring search with manycast client packets. Selection of the proper value, which defaults to 127, is something of a black art and should be coordinated with the @@ -573,8 +388,15 @@ packets. Versions 1-4 are the choices, with version 4 the default. -

    .Ss -Auxiliary +

    +

    + +
    +
    + +

    Auxiliary

    + +

    Auxiliary Commands

    Ic
    This command enables reception of broadcast server messages to @@ -588,8 +410,7 @@ Note that, in order to avoid accidental or malicious disruption in this mode, both the server and client should operate using symmetric-key or public-key authentication as described in -.Sx -Authentication +AuthenticationAuthentication Options .
    Ic
    This command enables reception of manycast client messages to @@ -603,8 +424,7 @@ Note that, in order to avoid accidental or malicious disruption in this mode, both the server and client should operate using symmetric-key or public-key authentication as described in -.Sx -Authentication +AuthenticationAuthentication Options .
    Ic
    This command enables reception of multicast server messages to @@ -618,13 +438,19 @@ Note that, in order to avoid accidental or malicious disruption in this mode, both the server and client should operate using symmetric-key or public-key authentication as described in -.Sx -Authentication +AuthenticationAuthentication Options . -

    .Sh -Authentication +

    +

    + +
    +
    + +

    Authentication

    + +

    Authentication Support Authentication support allows the NTP client to verify that the server is in fact known and trusted and not an intruder intending @@ -642,7 +468,7 @@ Either algorithm computes a message digest, or one-way hash, which can be used to verify the server has the correct private key and key identifier. -

    NTPv4 retains the NTPv3 scheme, properly described as symmetric key +

    NTPv4 retains the NTPv3 scheme, properly described as symmetric key cryptography and, in addition, provides a new Autokey scheme based on public key cryptography. Public key cryptography is generally considered more secure @@ -657,35 +483,20 @@ which can be provided by commercial services or produced by utility programs in the OpenSSL software library or the NTPv4 distribution. -

    While the algorithms for symmetric key cryptography are +

    While the algorithms for symmetric key cryptography are included in the NTPv4 distribution, public key cryptography requires the OpenSSL software library to be installed before building the NTP distribution. Directions for doing that are on the Building and Installing the Distribution page. -

    Authentication is configured separately for each association +

    Authentication is configured separately for each association using the -.Cm -key -or -.Cm -autokey -subcommand on the -.Ic -peer -, -.Ic -server -, -.Ic -broadcast -and -.Ic -manycastclient -configuration commands as described in -.Sx -Configuration +key or +autokey subcommand on the +peer, server, broadcast and +manycastclient configuration commands as described in +ConfigurationConfiguration Options page. The authentication @@ -693,7 +504,7 @@ options described below specify the locations of the key files, if other than default, which symmetric keys are trusted and the interval between various operations, if other than default. -

    Authentication is always enabled, +

    Authentication is always enabled, although ineffective if not configured as described below. If a NTP packet arrives @@ -712,18 +523,12 @@ preliminary protocol exchange to obtain the server certificate, verify its credentials and initialize the protocol -

    The -.Cm -auth -flag controls whether new associations or +

    The +auth flag controls whether new associations or remote configuration commands require cryptographic authentication. This flag can be set or reset by the -.Ic -enable -and -.Ic -disable -commands and also by remote +enable and +disable commands and also by remote configuration commands sent by a ntpdc(1ntpdcmdoc) program running in @@ -738,9 +543,7 @@ even if not cryptographic authenticated. It should be understood that operating with the -.Ic -auth -flag disabled invites a significant vulnerability +auth flag disabled invites a significant vulnerability where a rogue hacker can masquerade as a falseticker and seriously disrupt system timekeeping. @@ -753,11 +556,10 @@ and remote configuration commands and, in particular, the flag has no effect on the authentication process itself. -

    An attractive alternative where multicast support is available +

    An attractive alternative where multicast support is available is manycast mode, in which clients periodically troll for servers as described in the -.Sx -Automatic +AutomaticAutomatic NTP Configuration Options @@ -771,7 +573,7 @@ since the client finds them during regular operation, and the configuration files for all clients can be identical. -

    The security model and protocol schemes for +

    The security model and protocol schemes for both symmetric key and public key cryptography are summarized below; further details are in the briefings, papers @@ -779,8 +581,15 @@ and reports at the NTP project page linked from .Li http://www.ntp.org/ . -.Ss -Symmetric-Key +

    +

    + +
    +
    + +

    Symmetric-Key

    + +

    Symmetric-Key Cryptography The original RFC-1305 specification allows any one of possibly 65,534 keys, each distinguished by a 32-bit key identifier, to @@ -791,8 +600,7 @@ authenticate NTP packets. Keys and related information are specified in a key file, usually called -.Pa -ntp.keys +ntp.keys, , which must be distributed and stored using secure means beyond the scope of the NTP protocol itself. @@ -804,18 +612,14 @@ and ntpdc(1ntpdcmdoc) utility programs. -

    When +

    When ntpd(1ntpdmdoc) is first started, it reads the key file specified in the -.Ic -keys -configuration command and installs the keys +keys configuration command and installs the keys in the key cache. However, individual keys must be activated with the -.Ic -trusted -command before use. +trusted command before use. This allows, for instance, the installation of possibly several batches of keys and @@ -825,18 +629,21 @@ remotely using This also provides a revocation capability that can be used if a key becomes compromised. The -.Ic -requestkey -command selects the key used as the password for the +requestkey command selects the key used as the password for the ntpdc(1ntpdcmdoc) utility, while the -.Ic -controlkey -command selects the key used as the password for the +controlkey command selects the key used as the password for the ntpq(1ntpqmdoc) utility. -.Ss -Public +

    +

    + +
    +
    + +

    Public

    + +

    Public Key Cryptography NTPv4 supports the original NTPv3 symmetric key scheme @@ -853,7 +660,7 @@ Using all of these schemes provides strong security against replay with or without modification, spoofing, masquerade and most forms of clogging attacks. -

    The Autokey protocol has several modes of operation +

    The Autokey protocol has several modes of operation corresponding to the various NTP modes supported. Most modes use a special cookie which can be computed independently by the client and server, @@ -863,12 +670,11 @@ in which a pseudo-random key list is generated and used in reverse order. These schemes are described along with an executive summary, current status, briefing slides and reading list on the -.Sx -Autonomous +AutonomousAutonomous Authentication page. -

    The specific cryptographic environment used by Autokey servers +

    The specific cryptographic environment used by Autokey servers and clients is determined by a set of files and soft links generated by the ntp-keygen(1ntpkeygenmdoc) @@ -882,16 +688,13 @@ along with the matching sign key. There are several schemes available in the OpenSSL software library, each identified by a specific string such as -.Cm -md5WithRSAEncryption -, -which stands for the MD5 message digest with RSA +md5WithRSAEncryption, which stands for the MD5 message digest with RSA encryption scheme. The current NTP distribution supports all the schemes in the OpenSSL library, including those based on RSA and DSA digital signatures. -

    NTP secure groups can be used to define cryptographic compartments +

    NTP secure groups can be used to define cryptographic compartments and security hierarchies. It is important that every host in the group be able to construct a certificate trail to one @@ -903,8 +706,15 @@ This requires the configuration file in all hosts to be engineered so that, even under anticipated failure conditions, the NTP subnet will form such that every group host can find a trail to at least one trusted host. -.Ss -Naming +

    +

    + +
    +
    + +

    Naming

    + +

    Naming and Addressing It is important to note that Autokey does not use DNS to @@ -917,7 +727,7 @@ The name appears in the host certificate in either or both the subject and issuer fields, so protection against DNS compromise is essential. -

    By convention, the name of an Autokey host is the name returned +

    By convention, the name of an Autokey host is the name returned by the Unix gethostname(2) system call or equivalent in other systems. @@ -926,7 +736,7 @@ model, there are no provisions to allow alternate names or aliases. However, this is not to say that DNS aliases, different names for each interface, etc., are constrained in any way. -

    It is also important to note that Autokey verifies authenticity +

    It is also important to note that Autokey verifies authenticity using the host name, network address and public keys, all of which are bound together by the protocol specifically to deflect masquerade attacks. @@ -938,8 +748,15 @@ For this reason operation with network address translation schemes is not possible. This reflects the intended robust security model where government and corporate NTP servers are operated outside firewall perimeters. -.Ss -Operation +

    +

    + +
    +
    + +

    Operation

    + +

    Operation A specific combination of authentication scheme (none, symmetric key, public key) and identity scheme is called a cryptotype, although not all combinations are compatible. @@ -952,33 +769,21 @@ Note however that some cryptotype combinations may successfully interoperate with each other, but may not represent good security practice. -

    The cryptotype of an association is determined at the time +

    The cryptotype of an association is determined at the time of mobilization, either at configuration time or some time later when a message of appropriate cryptotype arrives. When mobilized by a -.Ic -server -or -.Ic -peer -configuration command and no -.Ic -key -or -.Ic -autokey -subcommands are present, the association is not +server or +peer configuration command and no +key or +autokey subcommands are present, the association is not authenticated; if the -.Ic -key -subcommand is present, the association is authenticated +key subcommand is present, the association is authenticated using the symmetric key ID specified; if the -.Ic -autokey -subcommand is present, the association is authenticated +autokey subcommand is present, the association is authenticated using Autokey. -

    When multiple identity schemes are supported in the Autokey +

    When multiple identity schemes are supported in the Autokey protocol, the first message exchange determines which one is used. The client request message contains bits corresponding to which schemes it has available. @@ -987,7 +792,7 @@ contains bits corresponding to which schemes it has available. Both server and client match the received bits with their own and select a common scheme. -

    Following the principle that time is a public value, +

    Following the principle that time is a public value, a server responds to any client packet that matches its cryptotype capabilities. Thus, a server receiving @@ -1001,7 +806,7 @@ with the first packet received. By default, unauthenticated associations will not be mobilized unless overridden in a decidedly dangerous way. -

    Some examples may help to reduce confusion. +

    Some examples may help to reduce confusion. Client Alice has no specific cryptotype selected. Server Bob has both a symmetric key file and minimal Autokey files. Alice's unauthenticated messages arrive at Bob, who replies with @@ -1017,13 +822,13 @@ Bob sends Cathy a thing called a crypto-NAK, which tells her something broke. She can see the evidence using the ntpq program. -

    Denise has rolled her own host key and certificate. +

    Denise has rolled her own host key and certificate. She also uses one of the identity schemes as Bob. She sends the first Autokey message to Bob and they both dance the protocol authentication and identity steps. If all comes out okay, Denise and Bob continue as described above. -

    It should be clear from the above that Bob can support +

    It should be clear from the above that Bob can support all the girls at the same time, as long as he has compatible authentication and identity credentials. Now, Bob can act just like the girls in his own choice of servers; @@ -1032,8 +837,15 @@ servers (or the same server, although that might not be useful). But, wise security policy might preclude some cryptotype combinations; for instance, running an identity scheme with one server and no authentication with another might not be wise. -.Ss -Key +

    +

    + +
    +
    + +

    Key

    + +

    Key Management The cryptographic values used by the Autokey protocol are incorporated as a set of files generated by the @@ -1053,7 +865,7 @@ utility programs. The remaining files are necessary only for the Autokey protocol. -

    Certificates imported from OpenSSL or public certificate +

    Certificates imported from OpenSSL or public certificate authorities have certian limitations. The certificate should be in ASN.1 syntax, X.509 Version 3 format and encoded in PEM, which is the same format @@ -1067,13 +879,16 @@ The certificate extension fields must not contain either a subject key identifier or a issuer key identifier field; however, an extended key usage field for a trusted host must contain the value -.Cm -trustRoot -; -. -Other extension fields are ignored. -.Ss -Authentication +trustRoot;. Other extension fields are ignored. +

    +

    + +
    +
    + +

    Authentication

    + +

    Authentication Commands

    Ic
    Specifies the interval between regenerations of the session key @@ -1090,62 +905,19 @@ sent. utility, which uses the standard protocol defined in RFC-1305. The -.Ar -key -argument is +key argument is the key identifier for a trusted key, where the value can be in the range 1 to 65,534, inclusive. -
    Xo
    .Op -Cm -cert -Ar -file -.Op -Cm -leap -Ar -file -.Op -Cm -randfile -Ar -file -.Op -Cm -host -Ar -file -.Op -Cm -sign -Ar -file -.Op -Cm -gq -Ar -file -.Op -Cm -gqpar -Ar -file -.Op -Cm -iffpar -Ar -file -.Op -Cm -mvpar -Ar -file -.Op -Cm -pw -Ar -password -.Xc +
    Xo
    [cert Ar file ] +[leap Ar file ] +[randfile Ar file ] +[host Ar file ] +[sign Ar file ] +[gq Ar file ] +[gqpar Ar file ] +[iffpar Ar file ] +[mvpar Ar file ] +[pw Ar password ] This command requires the OpenSSL library. It activates public key cryptography, selects the message digest and signature @@ -1156,18 +928,14 @@ the default names are used as described above. Unless the complete path and name of the file are specified, the location of a file is relative to the keys directory specified in the -.Ic -keysdir -command or default -.Pa -/usr/local/etc +keysdir command or default +/usr/local/etc. . Following are the subcommands:
    Cm
    Specifies the location of the required host public certificate file. This overrides the link -.Pa -ntpkey_cert_ +ntpkey_cert_NsArhostname Ns Ar hostname @@ -1175,8 +943,7 @@ in the keys directory.
    Cm
    Specifies the location of the optional GQ parameters file. This overrides the link -.Pa -ntpkey_gq_ +ntpkey_gq_NsArhostname Ns Ar hostname @@ -1184,30 +951,26 @@ in the keys directory.
    Cm
    Specifies the location of the required host key file. This overrides the link -.Pa -ntpkey_key_ +ntpkey_key_NsArhostname Ns Ar hostname in the keys directory.
    Cm
    Specifies the location of the optional IFF parameters file.This overrides the link -.Pa -ntpkey_iff_ +ntpkey_iff_NsArhostname Ns Ar hostname in the keys directory.
    Cm
    Specifies the location of the optional leapsecond file. This overrides the link -.Pa -ntpkey_leap +ntpkey_leap in the keys directory.
    Cm
    Specifies the location of the optional MV parameters file. This overrides the link -.Pa -ntpkey_mv_ +ntpkey_mv_NsArhostname Ns Ar hostname @@ -1222,8 +985,7 @@ The defaults are described in the main text above.
    Cm
    Specifies the location of the optional sign key file. This overrides the link -.Pa -ntpkey_sign_ +ntpkey_sign_NsArhostname Ns Ar hostname @@ -1253,8 +1015,7 @@ path This command specifies the default directory path for cryptographic keys, parameters and certificates. The default is -.Pa -/usr/local/etc/ +/usr/local/etc/. . .It Ic @@ -1267,9 +1028,7 @@ utility program, which uses a proprietary protocol specific to this implementation of ntpd(1ntpdmdoc). The -.Ar -key -argument is a key identifier +key argument is a key identifier for the trusted key, where the value can be in the range 1 to 65,534, inclusive. .It @@ -1305,142 +1064,104 @@ and remote servers share the same key and key identifier for this purpose, although different keys can be used with different servers. The -.Ar -key -arguments are 32-bit unsigned +key arguments are 32-bit unsigned integers with values from 1 to 65,534. -

    .Ss -Error +

    +

    + +
    +
    + +

    Error

    + +

    Error Codes The following error codes are reported via the NTP control and monitoring protocol trap mechanism.

    -
    101
    .Pq -bad -field -format -or -length +
    101
    (badfieldformatorlength) The packet has invalid version, length or format. -
    102
    .Pq -bad -timestamp +
    102
    (badtimestamp) The packet timestamp is the same or older than the most recent received. This could be due to a replay or a server clock time step. -
    103
    .Pq -bad -filestamp +
    103
    (badfilestamp) The packet filestamp is the same or older than the most recent received. This could be due to a replay or a key file generation error. -
    104
    .Pq -bad -or -missing -public -key +
    104
    (badormissingpublickey) The public key is missing, has incorrect format or is an unsupported type. -
    105
    .Pq -unsupported -digest -type +
    105
    (unsupporteddigesttype) The server requires an unsupported digest/signature scheme. -
    106
    .Pq -mismatched -digest -types +
    106
    (mismatcheddigesttypes) Not used. -
    107
    .Pq -bad -signature -length +
    107
    (badsignaturelength) The signature length does not match the current public key. -
    108
    .Pq -signature -not -verified +
    108
    (signaturenotverified) The message fails the signature check. It could be bogus or signed by a different private key. -
    109
    .Pq -certificate -not -verified +
    109
    (certificatenotverified) The certificate is invalid or signed with the wrong key. -
    110
    .Pq -certificate -not -verified +
    110
    (certificatenotverified) The certificate is not yet valid or has expired or the signature could not be verified. -
    111
    .Pq -bad -or -missing -cookie +
    111
    (badormissingcookie) The cookie is missing, corrupted or bogus. -
    112
    .Pq -bad -or -missing -leapseconds -table +
    112
    (badormissingleapsecondstable) The leapseconds table is missing, corrupted or bogus. -
    113
    .Pq -bad -or -missing -certificate +
    113
    (badormissingcertificate) The certificate is missing, corrupted or bogus. -
    114
    .Pq -bad -or -missing -identity +
    114
    (badormissingidentity) The identity key is missing, corrupt or bogus. -

    .Sh -Monitoring +

    +

    + +
    +
    + +

    Monitoring

    + +

    Monitoring Support ntpd(1ntpdmdoc) includes a comprehensive monitoring facility suitable for continuous, long term recording of server and client timekeeping performance. See the -.Ic -statistics -command below +statistics command below for a listing and example of each type of statistics currently supported. Statistic files are managed using file generation sets and scripts in the -.Pa -./scripts +./scripts directory of this distribution. Using these facilities and -.Ux +UNIX cron(8) jobs, the data can be automatically summarized and archived for retrospective analysis. -.Ss -Monitoring +

    +

    + +
    +
    + +

    Monitoring

    + +

    Monitoring Commands

    Ic
    Enables writing of statistics records. Currently, four kinds of -.Ar -name -statistics are supported. +name statistics are supported.
    Cm
    Enables recording of clock driver statistics information. Each update received from a clock driver appends a line of the following form to the file generation set named -.Cm -clockstats -: -.Bd +clockstats: .Bd -literal 49213 525.624 127.127.4.1 93 226 00:08:29.606 D .Ed @@ -1461,10 +1182,7 @@ It enables recording of cryptographic public key protocol information. Each message received by the protocol module appends a line of the following form to the file generation set named -.Cm -cryptostats -: -.Bd +cryptostats: .Bd -literal 49213 525.624 127.127.4.1 message .Ed @@ -1475,18 +1193,14 @@ The next field shows the peer address in dotted-quad notation, The final message field includes the message type and certain ancillary information. See the -.Sx -Authentication +AuthenticationAuthentication Options section for further information.
    Cm
    Enables recording of loop filter statistics information. Each update of the local clock outputs a line of the following form to the file generation set named -.Cm -loopstats -: -.Bd +loopstats: .Bd -literal 50935 75440.031 0.000006019 13.778190 0.000351733 0.0133806 .Ed @@ -1504,10 +1218,7 @@ signals, where present and configured. Each valid update appends a line of the following form to the current element of a file generation set named -.Cm -peerstats -: -.Bd +peerstats: .Bd -literal 48773 10847.650 127.127.4.1 9714 -0.001605376 0.000000000 0.001424877 0.000958674 .Ed @@ -1528,10 +1239,7 @@ special signals, where present and configured. Each NTP message received from a peer or clock driver appends a line of the following form to the file generation set named -.Cm -rawstats -: -.Bd +rawstats: .Bd -literal 50928 2132.543 128.4.1.1 128.4.1.20 3102453281.584327000 3102453281.58622800031 02453332.540806000 3102453332.541458000 .Ed @@ -1550,10 +1258,7 @@ smoothing and mitigation algorithms. Each hour a line of the following form is appended to the file generation set named -.Cm -sysstats -: -.Bd +sysstats: .Bd -literal 50928 2132.543 36000 81965 0 9546 56 71793 512 540 10 147 .Ed @@ -1584,9 +1289,7 @@ Indicates the full path of a directory where statistics files should be created (see below). This keyword allows the (otherwise constant) -.Cm -filegen -filename prefix to be modified for file generation sets, which +filegen filename prefix to be modified for file generation sets, which is useful for handling statistics logs. .It Cm @@ -1594,27 +1297,10 @@ filegen Ar name Xo -.Op -Cm -file -Ar -filename -.Op -Cm -type -Ar -typename -.Op -Cm -link -| -nolink -.Op -Cm -enable -| -disable -.Xc +[file Ar filename ] +[type Ar typename ] +[link | nolink ] +[enable | disable ] Configures setting of generation file set name. Generation file sets provide a means for handling files that are @@ -1637,67 +1323,38 @@ produced.) program running at a remote location.
    Cm
    This is the type of the statistics records, as shown in the -.Cm -statistics -command. +statistics command.
    Cm
    This is the file name for the statistics records. Filenames of set members are built from three concatenated elements -.Ar -Cm -prefix -, -.Ar -Cm -filename -and -.Ar -Cm -suffix -: +Cm prefix, Cm filename and +Cm suffix:
    Cm
    This is a constant filename path. It is not subject to modifications via the -.Ar -filegen -option. +filegen option. It is defined by the server, usually specified as a compile-time constant. It may, however, be configurable for individual file generation sets via other commands. For example, the prefix used with -.Ar -loopstats -and -.Ar -peerstats -generation can be configured using the -.Ar -statsdir -option explained above. +loopstats and +peerstats generation can be configured using the +statsdir option explained above.
    Cm
    This string is directly concatenated to the prefix mentioned above (no intervening -.Ql -/ -) -. +/). This can be modified using the file argument to the -.Ar -filegen -statement. +filegen statement. No -.Pa -.. +.. elements are allowed in this component to prevent filenames referring to parts outside the filesystem hierarchy denoted by -.Ar -prefix -. -
    Cm
    This part is reflects individual elements of a file set. +prefix.
    Cm
    This part is reflects individual elements of a file set. It is generated according to the type of a file set. @@ -1719,15 +1376,10 @@ separating files belonging to different ntpd(1ntpdmdoc) server incarnations. The set member filename is built by appending a -.Ql \&. to concatenated -.Ar -prefix -and -.Ar -filename -strings, and +prefix and +filename strings, and appending the decimal representation of the process ID of the ntpd(1ntpdmdoc) server process. @@ -1736,42 +1388,22 @@ A day is defined as the period between 00:00 and 24:00 UTC. The file set member suffix consists of a -.Ql \&. and a day specification in the form -.Cm -YYYYMMdd -. -.Cm -YYYY -is a 4-digit year number (e.g., 1992). -.Cm -MM -is a two digit month number. -.Cm -dd -is a two digit day number. +YYYYMMdd. YYYY is a 4-digit year number (e.g., 1992). +MM is a two digit month number. +dd is a two digit day number. Thus, all information written at 10 December 1992 would end up in a file named -.Ar -prefix -.Ar -filename -Ns -.19921210 -. -
    Cm
    Any file set member contains data related to a certain week of +prefix filename Ns.19921210.
    Cm
    Any file set member contains data related to a certain week of a year. The term week is defined by computing day-of-year modulo 7. Elements of such a file generation set are distinguished by appending the following suffix to the file set filename base: A dot, a 4-digit year number, the letter -.Cm -W -, -and a 2-digit week number. +W, and a 2-digit week number. For example, information from January, 10th 1992 would end up in a file with suffix .No @@ -1791,22 +1423,13 @@ suffix consists of a dot and a 4 digit year number. the file set every 24 hours of server operation. The filename suffix consists of a dot, the letter -.Cm -a -, -and an 8-digit number. +a, and an 8-digit number. This number is taken to be the number of seconds the server is running at the start of the corresponding 24-hour period. Information is only written to a file generation by specifying -.Cm -enable -; -output is prevented by specifying -.Cm -disable -. - -

    .It +enable; output is prevented by specifying +disable. +.It Cm link | @@ -1815,22 +1438,14 @@ It is convenient to be able to access the current element of a file generation set by a fixed name. This feature is enabled by specifying -.Cm -link -and disabled using -.Cm -nolink -. -If link is specified, a +link and disabled using +nolink. If link is specified, a hard link from the current file set element to a file without suffix is created. When there is already a file with this name and the number of links of this file is one, it is renamed appending a dot, the letter -.Cm -C -, -and the pid of the ntpd server process. +C, and the pid of the ntpd server process. When the number of links is greater than one, the file is unlinked. This @@ -1843,8 +1458,15 @@ Cm disable Enables or disables the recording function. -

    .Sh -Access +

    +

    + +
    +
    + +

    Access

    + +

    Access Control Support The @@ -1860,26 +1482,15 @@ The list is searched in order with the last match found defining the restriction flags associated with the entry. Additional information and examples can be found in the -.Qq -Notes -on -Configuring -NTP -and -Setting -up -a -NTP -Subnet +"NotesonConfiguringNTPandSettingupaNTPSubnet" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) . -

    The restriction facility was implemented in conformance +

    The restriction facility was implemented in conformance with the access policies for the original NSFnet backbone time servers. Later the facility was expanded to deflect @@ -1891,7 +1502,7 @@ an alternative to the NTP authentication facilities. Source address based restrictions are easily circumvented by a determined cracker. -

    Clients can be denied service because they are explicitly +

    Clients can be denied service because they are explicitly included in the restrict list created by the restrict command or implicitly as the result of cryptographic or rate limit violations. @@ -1906,8 +1517,15 @@ an indefinate period. When a client or network is denied access for an indefinate period, the only way at present to remove the restrictions is by restarting the server. -.Ss -The +

    +

    + +
    +
    + +

    The

    + +

    The Kiss-of-Death Packet Ordinarily, packets denied service are simply dropped with no @@ -1922,20 +1540,14 @@ KoD packets have the leap bits set unsynchronized and stratum set to zero and the reference identifier field set to a four-byte ASCII code. If the -.Cm -noserve -or -.Cm -notrust -flag of the matching restrict list entry is set, +noserve or +notrust flag of the matching restrict list entry is set, the code is "DENY"; if the -.Cm -limited -flag is set and the rate limit +limited flag is set and the rate limit is exceeded, the code is "RATE". Finally, if a cryptographic violation occurs, the code is "CRYP". -

    A client receiving a KoD performs a set of sanity checks to +

    A client receiving a KoD performs a set of sanity checks to minimize security exposure, then updates the stratum and reference identifier peer variables, sets the access denied (TEST4) bit in the peer flash variable and sends @@ -1947,95 +1559,53 @@ to restart the protocol at both the client and server. This happens automatically at the client when the association times out. It will happen at the server only if the server operator cooperates. -.Ss -Access +

    +

    + +
    +
    + +

    Access

    + +

    Access Control Commands

    -
    Xo
    .Op -Cm -average -Ar -avg -.Op -Cm -minimum -Ar -min -.Op -Cm -monitor -Ar -prob -.Xc +
    Xo
    [average Ar avg ] +[minimum Ar min ] +[monitor Ar prob ] Set the parameters of the -.Cm -limited -facility which protects the server from +limited facility which protects the server from client abuse. The -.Cm -average -subcommand specifies the minimum average packet +average subcommand specifies the minimum average packet spacing, while the -.Cm -minimum -subcommand specifies the minimum packet spacing. +minimum subcommand specifies the minimum packet spacing. Packets that violate these minima are discarded and a kiss-o'-death packet returned if enabled. The default minimum average and minimum are 5 and 2, respectively. The monitor subcommand specifies the probability of discard for packets that overflow the rate-control window. -
    Xo
    .Op -Cm -mask -Ar -mask -.Op -Ar -flag -... -.Xc +
    Xo
    [mask Ar mask ] +[flag... ] The -.Ar -address -argument expressed in +address argument expressed in dotted-quad form is the address of a host or network. Alternatively, the -.Ar -address -argument can be a valid host DNS name. +address argument can be a valid host DNS name. The -.Ar -mask -argument expressed in dotted-quad form defaults to -.Cm -255.255.255.255 -, -meaning that the -.Ar -address -is treated as the address of an individual host. +mask argument expressed in dotted-quad form defaults to +255.255.255.255, meaning that the +address is treated as the address of an individual host. A default entry (address -.Cm -0.0.0.0 -, -mask -.Cm -0.0.0.0 -) -is always included and is always the first entry in the list. +0.0.0.0, mask +0.0.0.0) is always included and is always the first entry in the list. Note that text string -.Cm -default -, -with no mask option, may +default, with no mask option, may be used to indicate the default entry. In the current implementation, -.Cm -flag -always +flag always restricts access, i.e., an entry with no flags indicates that free access to the server is to be given. The flags are not orthogonal, @@ -2066,9 +1636,7 @@ monitoring capability of ntpd(1ntpdmdoc). Thus, monitoring is always active as long as there is a restriction entry with the -.Cm -limited -flag. +limited flag.
    Cm
    Declare traps set by matching hosts to be low priority. The number of traps a server can maintain is limited (the current limit @@ -2112,17 +1680,11 @@ Its presence causes the restriction entry to be matched only if the source port in the packet is the standard NTP UDP port (123). Both -.Cm -ntpport -and -.Cm -non-ntpport -may +ntpport and +non-ntpport may be specified. The -.Cm -ntpport -is considered more specific and +ntpport is considered more specific and is sorted later in the list.
    Cm
    Deny packets that do not match the current NTP version. @@ -2135,13 +1697,27 @@ otherwise unconfigured; no flags are associated with the default entry (i.e., everything besides your own NTP server is unrestricted). -

    .Sh -Automatic +

    +

    + +
    +
    + +

    Automatic

    + +

    Automatic NTP Configuration Options -.Ss -Manycasting +

    +

    + +
    +
    + +

    Manycasting

    + +

    Manycasting Manycasting is a automatic discovery and configuration paradigm new to NTPv4. It is intended as a means for a multicast client @@ -2154,14 +1730,14 @@ client associations with some number of the "best" of the nearby manycast servers, yet automatically reconfigures to sustain this number of servers should one or another fail. -

    Note that the manycasting paradigm does not coincide +

    Note that the manycasting paradigm does not coincide with the anycast paradigm described in RFC-1546, which is designed to find a single server from a clique of servers providing the same service. The manycast paradigm is designed to find a plurality of redundant servers satisfying defined optimality criteria. -

    Manycasting can be used with either symmetric key +

    Manycasting can be used with either symmetric key or public key cryptography. The public key infrastructure (PKI) offers the best protection against compromised keys @@ -2175,16 +1751,11 @@ http://www.openssl.org/ The library can also be used with other NTPv4 modes as well and is highly recommended, especially for broadcast modes. -

    A persistent manycast client association is configured +

    A persistent manycast client association is configured using the manycastclient command, which is similar to the server command but with a multicast (IPv4 class -.Cm -D -or IPv6 prefix -.Cm -FF -) -group address. +D or IPv6 prefix +FF) group address. The IANA has designated IPv4 address 224.1.1.1 and IPv6 address FF05::101 (site local) for NTP. When more servers are needed, it broadcasts manycast @@ -2195,10 +1766,8 @@ There can be as many manycast client associations as different group address, each one serving as a template for a future ephemeral unicast client/server association. -

    Manycast servers configured with the -.Ic -manycastserver -command listen on the specified group address for manycast +

    Manycast servers configured with the +manycastserver command listen on the specified group address for manycast client messages. Note the distinction between manycast client, which actively broadcasts messages, and manycast server, @@ -2209,7 +1778,7 @@ to a valid source and operating at a stratum level equal to or lower than the manycast client, it replies to the manycast client message with an ordinary unicast server message. -

    The manycast client receiving this message mobilizes +

    The manycast client receiving this message mobilizes an ephemeral client/server association according to the matching manycast client template, but only if cryptographically authenticated and the server stratum is less than or equal @@ -2231,33 +1800,19 @@ distance. The surviving associations then continue in ordinary client/server mode. -

    The manycast client polling strategy is designed to reduce +

    The manycast client polling strategy is designed to reduce as much as possible the volume of manycast client messages and the effects of implosion due to near-simultaneous arrival of manycast server messages. The strategy is determined by the -.Ic -manycastclient -, -.Ic -tos -and -.Ic -ttl -configuration commands. +manycastclient, tos and +ttl configuration commands. The manycast poll interval is normally eight times the system poll interval, which starts out at the -.Cm -minpoll -value specified in the -.Ic -manycastclient -, -command and, under normal circumstances, increments to the -.Cm -maxpolll -value specified in this command. +minpoll value specified in the +manycastclient, command and, under normal circumstances, increments to the +maxpolll value specified in this command. Initially, the TTL is set at the minimum hops specified by the ttl command. At each retransmission the TTL is increased until reaching @@ -2265,77 +1820,49 @@ the maximum hops specified by this command or a sufficient number client associations have been found. Further retransmissions use the same TTL. -

    The quality and reliability of the suite of associations +

    The quality and reliability of the suite of associations discovered by the manycast client is determined by the NTP mitigation algorithms and the -.Cm -minclock -and -.Cm -minsane -values specified in the -.Ic -tos -configuration command. +minclock and +minsane values specified in the +tos configuration command. At least -.Cm -minsane -candidate servers must be available and the mitigation +minsane candidate servers must be available and the mitigation algorithms produce at least -.Cm -minclock -survivors in order to synchronize the clock. +minclock survivors in order to synchronize the clock. Byzantine agreement principles require at least four candidates in order to correctly discard a single falseticker. For legacy purposes, -.Cm -minsane -defaults to 1 and -.Cm -minclock -defaults to 3. +minsane defaults to 1 and +minclock defaults to 3. For manycast service -.Cm -minsane -should be explicitly set to 4, assuming at least that +minsane should be explicitly set to 4, assuming at least that number of servers are available. -

    If at least -.Cm -minclock -servers are found, the manycast poll interval is immediately +

    If at least +minclock servers are found, the manycast poll interval is immediately set to eight times -.Cm -maxpoll -. -If less than -.Cm -minclock -servers are found when the TTL has reached the maximum hops, +maxpoll. If less than +minclock servers are found when the TTL has reached the maximum hops, the manycast poll interval is doubled. For each transmission after that, the poll interval is doubled again until reaching the maximum of eight times -.Cm -maxpoll -. -Further transmissions use the same poll interval and +maxpoll. Further transmissions use the same poll interval and TTL values. Note that while all this is going on, each client/server association found is operating normally it the system poll interval. -

    Administratively scoped multicast boundaries are normally +

    Administratively scoped multicast boundaries are normally specified by the network router configuration and, in the case of IPv6, the link/site scope prefix. By default, the increment for TTL hops is 32 starting from 31; however, the -.Ic -ttl -configuration command can be +ttl configuration command can be used to modify the values to match the scope rules. -

    It is often useful to narrow the range of acceptable +

    It is often useful to narrow the range of acceptable servers which can be found by manycast client associations. Because manycast servers respond only when the client stratum is equal to or greater than the server stratum, @@ -2346,37 +1873,23 @@ in TTL range will eventually find all primary servers in TTL range, which is probably not the most common objective in large networks. The -.Ic -tos -command can be used to modify this behavior. +tos command can be used to modify this behavior. Servers with stratum below -.Cm -floor -or above -.Cm -ceiling -specified in the -.Ic -tos -command are strongly discouraged during the selection +floor or above +ceiling specified in the +tos command are strongly discouraged during the selection process; however, these servers may be temporally accepted if the number of servers within TTL range is less than -.Cm -minclock -. - -

    The above actions occur for each manycast client message, +minclock. +The above actions occur for each manycast client message, which repeats at the designated poll interval. However, once the ephemeral client association is mobilized, subsequent manycast server replies are discarded, since that would result in a duplicate association. If during a poll interval the number of client associations falls below -.Cm -minclock -, -all manycast client prototype associations are reset +minclock, all manycast client prototype associations are reset to the initial poll interval and TTL hops and operation resumes from the beginning. It is important to avoid @@ -2385,11 +1898,9 @@ all manycast servers in TTL range to respond. The result could well be an implosion, either minor or major, depending on the number of servers in range. The recommended value for -.Cm -maxpoll -is 12 (4,096 s). +maxpoll is 12 (4,096 s). -

    It is possible and frequently useful to configure a host +

    It is possible and frequently useful to configure a host as both manycast client and manycast server. A number of hosts configured this way and sharing a common group address will automatically organize themselves @@ -2400,32 +1911,24 @@ subnet of two primary servers and a hundred or more dependent clients. With two exceptions, all servers and clients have identical configuration files including both -.Ic -multicastclient -and -.Ic -multicastserver -commands using, for instance, multicast group address +multicastclient and +multicastserver commands using, for instance, multicast group address 239.1.1.1. The only exception is that each primary server configuration file must include commands for the primary reference source such as a GPS receiver. -

    The remaining configuration files for all secondary +

    The remaining configuration files for all secondary servers and clients have the same contents, except for the -.Ic -tos -command, which is specific for each stratum level. +tos command, which is specific for each stratum level. For stratum 1 and stratum 2 servers, that command is not necessary. For stratum 3 and above servers the -.Cm -floor -value is set to the intended stratum number. +floor value is set to the intended stratum number. Thus, all stratum 3 configuration files are identical, all stratum 4 files are identical and so forth. -

    Once operations have stabilized in this scenario, +

    Once operations have stabilized in this scenario, the primary servers will find the primary reference source and each other, since they both operate at the same stratum (1), but not with any secondary server or client, @@ -2437,7 +1940,7 @@ it will continue to operate as a client and other clients will time out the corresponding association and re-associate accordingly. -

    Some administrators prefer to avoid running +

    Some administrators prefer to avoid running ntpd(1ntpdmdoc) continuously and run either ntpdate(8) @@ -2456,8 +1959,15 @@ the rascals, sets the clock and then departs. Servers do not have to be configured in advance and all clients throughout the network can have the same configuration file. -.Ss -Manycast +

    +

    + +
    +
    + +

    Manycast

    + +

    Manycast Interactions with Autokey @@ -2474,7 +1984,7 @@ but the certificates remain in the local cache. It often happens that several complete signing trails from the client to the primary servers are collected in this way. -

    About once an hour or less often if the poll interval +

    About once an hour or less often if the poll interval exceeds this, the client regenerates the Autokey key list. This is in general transparent in client/server mode. However, about once per day the server private value @@ -2490,35 +2000,19 @@ At the same time, the manycast scheme starts all over from the beginning and the expanding ring shrinks to the minimum and increments from there while collecting all servers in scope. -.Ss -Manycast +

    +

    + +
    +
    + +

    Manycast

    + +

    Manycast Options

    Xo
    .Oo -.Cm -ceiling -Ar -ceiling -| -.Cm -cohort - -

    0.Cm -floor -Ar -floor -| -.Cm -minclock -Ar -minclock -| -.Cm -minsane -Ar -minsane -.Oc -.Xc +ceiling Ar ceiling | cohort 0 | 1 | floor Ar floor | minclock Ar minclock | minsane Ar minsane .Oc This command affects the clock selection and clustering algorithms. It can be used to select the quality and @@ -2528,12 +2022,8 @@ The variables operate as follows:

    Cm
    Peers with strata above -.Cm -ceiling -will be discarded if there are at least -.Cm -minclock -peers remaining. +ceiling will be discarded if there are at least +minclock peers remaining. This value defaults to 15, but can be changed to any number from 1 to 15.
    Cm
    This is a binary flag which enables (0) or disables (1) @@ -2544,19 +2034,13 @@ large numbers of clients with the same stratum level are present. The default is to enable these replies.
    Cm
    Peers with strata below -.Cm -floor -will be discarded if there are at least -.Cm -minclock -peers remaining. +floor will be discarded if there are at least +minclock peers remaining. This value defaults to 1, but can be changed to any number from 1 to 15.
    Cm
    The clustering algorithm repeatedly casts out outlyer associations until no more than -.Cm -minclock -associations remain. +minclock associations remain. This value defaults to 3, but can be changed to any number from 1 to the number of configured sources. @@ -2569,9 +2053,7 @@ The default is 1 for legacy purposes. However, according to principles of Byzantine agreement, -.Cm -minsane -should be at least 4 in order to detect and discard +minsane should be at least 4 in order to detect and discard a single falseticker.

    .It @@ -2587,8 +2069,15 @@ in an expanding-ring search. The default is eight multiples of 32 starting at 31. -

    .Sh -Reference +

    +

    + +
    +
    + +

    Reference

    + +

    Reference Clock Support The NTP Version 4 daemon supports some three dozen different radio, @@ -2596,54 +2085,31 @@ satellite and modem reference clocks plus a special pseudo-clock used for backup or when no other clock source is available. Detailed descriptions of individual device drivers and options can be found in the -.Qq -Reference -Clock -Drivers +"ReferenceClockDrivers" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) . Additional information can be found in the pages linked there, including the -.Qq -Debugging -Hints -for -Reference -Clock -Drivers +"DebuggingHintsforReferenceClockDrivers" and -.Qq -How -To -Write -a -Reference -Clock -Driver +"HowToWriteaReferenceClockDriver" pages (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) . In addition, support for a PPS signal is available as described in the -.Qq -Pulse-per-second -(PPS) -Signal -Interfacing +"Pulse-per-second(PPS)SignalInterfacing" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) . Many @@ -2651,21 +2117,15 @@ drivers support special line discipline/streams modules which can significantly improve the accuracy using the driver. These are described in the -.Qq -Line -Disciplines -and -Streams -Drivers +"LineDisciplinesandStreamsDrivers" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) . -

    A reference clock will generally (though not always) be a radio +

    A reference clock will generally (though not always) be a radio timecode receiver which is synchronized to a source of standard time such as the services offered by the NRC in Canada and NIST and USNO in the US. @@ -2681,7 +2141,7 @@ or the hardware port has not been appropriately configured results in a scalding remark to the system log file, but is otherwise non hazardous. -

    For the purposes of configuration, +

    For the purposes of configuration, ntpd(1ntpdmdoc) treats reference clocks in a manner analogous to normal NTP peers as much @@ -2703,103 +2163,61 @@ u .Sm on where -.Ar -t -is an integer +t is an integer denoting the clock type and -.Ar -u -indicates the unit +u indicates the unit number in the range 0-3. While it may seem overkill, it is in fact sometimes useful to configure multiple reference clocks of the same type, in which case the unit numbers must be unique. -

    The -.Ic -server -command is used to configure a reference +

    The +server command is used to configure a reference clock, where the -.Ar -address -argument in that command +address argument in that command is the clock address. The -.Cm -key -, -.Cm -version -and -.Cm -ttl -options are not used for reference clock support. +key, version and +ttl options are not used for reference clock support. The -.Cm -mode -option is added for reference clock support, as +mode option is added for reference clock support, as described below. The -.Cm -prefer -option can be useful to +prefer option can be useful to persuade the server to cherish a reference clock with somewhat more enthusiasm than other reference clocks or peers. Further information on this option can be found in the -.Qq -Mitigation -Rules -and -the -prefer -Keyword +"MitigationRulesandthepreferKeyword" (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp) ) page. The -.Cm -minpoll -and -.Cm -maxpoll -options have +minpoll and +maxpoll options have meaning only for selected clock drivers. See the individual clock driver document pages for additional information. -

    The -.Ic -fudge -command is used to provide additional +

    The +fudge command is used to provide additional information for individual clock drivers and normally follows immediately after the -.Ic -server -command. +server command. The -.Ar -address -argument specifies the clock address. +address argument specifies the clock address. The -.Cm -refid -and -.Cm -stratum -options can be used to +refid and +stratum options can be used to override the defaults for the device. There are two optional device-dependent time offsets and four flags that can be included in the -.Ic -fudge -command as well. +fudge command as well. -

    The stratum number of a reference clock is by default zero. +

    The stratum number of a reference clock is by default zero. Since the ntpd(1ntpdmdoc) daemon adds one to the stratum of each @@ -2808,21 +2226,24 @@ one. In order to provide engineered backups, it is often useful to specify the reference clock stratum as greater than zero. The -.Cm -stratum -option is used for this purpose. +stratum option is used for this purpose. Also, in cases involving both a reference clock and a pulse-per-second (PPS) discipline signal, it is useful to specify the reference clock identifier as other than the default, depending on the driver. The -.Cm -refid -option is used for this purpose. +refid option is used for this purpose. Except where noted, these options apply to all clock drivers. -.Ss -Reference +

    +

    + +
    +
    + +

    Reference

    + +

    Reference Clock Commands

    @@ -2837,25 +2258,10 @@ Ar u .Sm on -.Op -Cm -prefer -.Op -Cm -mode -Ar -int -.Op -Cm -minpoll -Ar -int -.Op -Cm -maxpoll -Ar -int -.Xc +[prefer ] +[mode Ar int ] +[minpoll Ar int ] +[maxpoll Ar int ] This command can be used to configure reference clocks in special ways. The options are interpreted as follows: @@ -2865,18 +2271,11 @@ All other things being equal, this host will be chosen for synchronization among a set of correctly operating hosts. See the -.Qq -Mitigation -Rules -and -the -prefer -Keyword +"MitigationRulesandthepreferKeyword" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp) ) for further information.
    Cm
    Specifies a mode number which is interpreted in a @@ -2889,19 +2288,11 @@ drivers. for reference clock messages, as a power of 2 in seconds For most directly connected reference clocks, both -.Cm -minpoll -and -.Cm -maxpoll -default to 6 (64 s). +minpoll and +maxpoll default to 6 (64 s). For modem reference clocks, -.Cm -minpoll -defaults to 10 (17.1 m) and -.Cm -maxpoll -defaults to 14 (4.5 h). +minpoll defaults to 10 (17.1 m) and +maxpoll defaults to 14 (4.5 h). The allowable range is 4 (16 s) to 17 (36.4 h) inclusive.

    .It @@ -2919,54 +2310,19 @@ Ar u .Sm on -.Op -Cm -time1 -Ar -sec -.Op -Cm -time2 -Ar -sec -.Op -Cm -stratum -Ar -int -.Op -Cm -refid -Ar -string -.Op -Cm -mode -Ar -int -.Op -Cm -flag1 -Cm -0.Op -Cm -flag2 -Cm -0.Op -Cm -flag3 -Cm -0.Op -Cm -flag4 -Cm -0.Xc +[time1 Ar sec ] +[time2 Ar sec ] +[stratum Ar int ] +[refid Ar string ] +[mode Ar int ] +[flag1 Cm 0\&| Cm 1 ] +[flag2 Cm 0\&| Cm 1 ] +[flag3 Cm 0\&| Cm 1 ] +[flag4 Cm 0\&| Cm 1 ] This command can be used to configure reference clocks in special ways. It must immediately follow the -.Ic -server -command which configures the driver. +server command which configures the driver. Note that the same capability is possible at run time using the ntpdc(1ntpdcmdoc) @@ -2993,37 +2349,26 @@ Note: in order to facilitate calibration when more than one radio clock or PPS signal is supported, a special calibration feature is available. It takes the form of an argument to the -.Ic -enable -command described in -.Sx -Miscellaneous +enable command described in +MiscellaneousMiscellaneous Options page and operates as described in the -.Qq -Reference -Clock -Drivers +"ReferenceClockDrivers" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) .

    Cm
    Specifies a fixed-point decimal number in seconds, which is interpreted in a driver-dependent way. See the descriptions of specific drivers in the -.Qq -Reference -Clock -Drivers +"ReferenceClockDrivers" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) .
    Cm
    Specifies the stratum number assigned to the driver, an integer @@ -3047,27 +2392,25 @@ interpretation of these values, and whether they are used at all, is a function of the particular clock driver. However, by convention -.Cm -flag4 -is used to enable recording monitoring +flag4 is used to enable recording monitoring data to the -.Cm -clockstats -file configured with the -.Ic -filegen -command. +clockstats file configured with the +filegen command. Further information on the -.Ic -filegen -command can be found in -.Sx -Monitoring +filegen command can be found in +MonitoringMonitoring Options . -

    .Sh -Miscellaneous +

    +

    + +
    +
    + +

    Miscellaneous

    + +

    Miscellaneous Options

    Ic
    The broadcast and multicast modes require a special calibration @@ -3113,665 +2456,12 @@ must have write permission for the directory the drift file is located in, and that file system links, symbolic or otherwise, should be avoided.
    Xo
    .Oo -.Cm -auth -| -Cm -bclient -| -.Cm -calibrate -| -Cm -kernel -| -.Cm -monitor -| -Cm -ntp -| -.Cm -pps -| -Cm -stats -.Oc -.Xc +auth | Cm bclient | calibrate | Cm kernel | monitor | Cm ntp | pps | Cm stats .Oc
    Xo
    .Oo -.Cm -auth -| -Cm -bclient -| -.Cm -calibrate -| -Cm -kernel -| -.Cm -monitor -| -Cm -ntp -| -.Cm -pps -| -Cm -stats -.Oc -.Xc +auth | Cm bclient | calibrate | Cm kernel | monitor | Cm ntp | pps | Cm stats .Oc Provides a way to enable or disable various server options. Flags not mentioned are unaffected. Note that all of these flags can be controlled remotely using the ntpdc(1ntpdcmdoc) utility program. -
    -
    Cm
    Enables the server to synchronize with unconfigured peers only if the -peer has been correctly authenticated using either public key or -private key cryptography. -The default for this flag is -.Ic -enable -. -
    Cm
    Enables the server to listen for a message from a broadcast or -multicast server, as in the -.Ic -multicastclient -command with default -address. -The default for this flag is -.Ic -disable -. -
    Cm
    Enables the calibrate feature for reference clocks. -The default for -this flag is -.Ic -disable -. -
    Cm
    Enables the kernel time discipline, if available. -The default for this -flag is -.Ic -enable -if support is available, otherwise -.Ic -disable -. -
    Cm
    Enables the monitoring facility. -See the -ntpdc(1ntpdcmdoc) -program -and the -.Ic -monlist -command or further information. -The -default for this flag is -.Ic -enable -. -
    Cm
    Enables time and frequency discipline. -In effect, this switch opens and -closes the feedback loop, which is useful for testing. -The default for -this flag is -.Ic -enable -. -
    Cm
    Enables the pulse-per-second (PPS) signal when frequency and time is -disciplined by the precision time kernel modifications. -See the -.Qq -A -Kernel -Model -for -Precision -Timekeeping -(available as part of the HTML documentation -provided in -.Pa -/usr/share/doc/ntp -) -page for further information. -The default for this flag is -.Ic -disable -. -
    Cm
    Enables the statistics facility. -See the -.Sx -Monitoring -Options -section for further information. -The default for this flag is -.Ic -disable -. - -

    .It -Ic -includefile -Ar -includefile -This command allows additional configuration commands -to be included from a separate file. -Include files may -be nested to a depth of five; upon reaching the end of any -include file, command processing resumes in the previous -configuration file. -This option is useful for sites that run -ntpd(1ntpdmdoc) -on multiple hosts, with (mostly) common options (e.g., a -restriction list). -.It -Ic -logconfig -Ar -configkeyword -This command controls the amount and type of output written to -the system -syslog(3) -facility or the alternate -.Ic -logfile -log file. -By default, all output is turned on. -All -.Ar -configkeyword -keywords can be prefixed with -.Ql -= -, -.Ql -+ -and -.Ql -- -, -where -.Ql -= -sets the -syslog(3) -priority mask, -.Ql -+ -adds and -.Ql -- -removes -messages. -syslog(3) -messages can be controlled in four -classes -.Po -.Cm -clock -, -.Cm -peer -, -.Cm -sys -and -.Cm -sync -.Pc -. -Within these classes four types of messages can be -controlled: informational messages -.Po -.Cm -info -.Pc -, -event messages -.Po -.Cm -events -.Pc -, -statistics messages -.Po -.Cm -statistics -.Pc -and -status messages -.Po -.Cm -status -.Pc -. - -

    Configuration keywords are formed by concatenating the message class with -the event class. -The -.Cm -all -prefix can be used instead of a message class. -A -message class may also be followed by the -.Cm -all -keyword to enable/disable all -messages of the respective message class.Thus, a minimal log configuration -could look like this: -.Bd --literal -logconfig =syncstatus +sysevents -.Ed - -

    This would just list the synchronizations state of -ntpd(1ntpdmdoc) -and the major system events. -For a simple reference server, the -following minimum message configuration could be useful: -.Bd --literal -logconfig =syncall +clockall -.Ed - -

    This configuration will list all clock information and -synchronization information. -All other events and messages about -peers, system events and so on is suppressed. -.It -Ic -logfile -Ar -logfile -This command specifies the location of an alternate log file to -be used instead of the default system -syslog(3) -facility. -This is the same operation as the -l command line option. -.It -Ic -setvar -Ar -variable -Op -Cm -default -This command adds an additional system variable. -These -variables can be used to distribute additional information such as -the access policy. -If the variable of the form -.Sm -off -.Va -name -= -Ar -value -.Sm -on -is followed by the -.Cm -default -keyword, the -variable will be listed as part of the default system variables -.Po -ntpq(1ntpqmdoc) -.Ic -rv -command -.Pc -) -. -These additional variables serve -informational purposes only. -They are not related to the protocol -other that they can be listed. -The known protocol variables will -always override any variables defined via the -.Ic -setvar -mechanism. -There are three special variables that contain the names -of all variable of the same group. -The -.Va -sys_var_list -holds -the names of all system variables. -The -.Va -peer_var_list -holds -the names of all peer variables and the -.Va -clock_var_list -holds the names of the reference clock variables. -.It -Xo -Ic -tinker -.Oo -.Cm -allan -Ar -allan -| -.Cm -dispersion -Ar -dispersion -| -.Cm -freq -Ar -freq -| -.Cm -huffpuff -Ar -huffpuff -| -.Cm -panic -Ar -panic -| -.Cm -step -Ar -srep -| -.Cm -stepout -Ar -stepout -.Oc -.Xc -This command can be used to alter several system variables in -very exceptional circumstances. -It should occur in the -configuration file before any other configuration options. -The -default values of these variables have been carefully optimized for -a wide range of network speeds and reliability expectations. -In -general, they interact in intricate ways that are hard to predict -and some combinations can result in some very nasty behavior. -Very -rarely is it necessary to change the default values; but, some -folks cannot resist twisting the knobs anyway and this command is -for them. -Emphasis added: twisters are on their own and can expect -no help from the support group. - -

    The variables operate as follows: -

    -
    Cm
    The argument becomes the new value for the minimum Allan -intercept, which is a parameter of the PLL/FLL clock discipline -algorithm. -The value in log2 seconds defaults to 7 (1024 s), which is also the lower -limit. -
    Cm
    The argument becomes the new value for the dispersion increase rate, -normally .000015 s/s. -
    Cm
    The argument becomes the initial value of the frequency offset in -parts-per-million. -This overrides the value in the frequency file, if -present, and avoids the initial training state if it is not. -
    Cm
    The argument becomes the new value for the experimental -huff-n'-puff filter span, which determines the most recent interval -the algorithm will search for a minimum delay. -The lower limit is -900 s (15 m), but a more reasonable value is 7200 (2 hours). -There -is no default, since the filter is not enabled unless this command -is given. -
    Cm
    The argument is the panic threshold, normally 1000 s. -If set to zero, -the panic sanity check is disabled and a clock offset of any value will -be accepted. -
    Cm
    The argument is the step threshold, which by default is 0.128 s. -It can -be set to any positive number in seconds. -If set to zero, step -adjustments will never occur. -Note: The kernel time discipline is -disabled if the step threshold is set to zero or greater than the -default. -
    Cm
    The argument is the stepout timeout, which by default is 900 s. -It can -be set to any positive number in seconds. -If set to zero, the stepout -pulses will not be suppressed. - -

    .It -Xo -Ic -trap -Ar -host_address -.Op -Cm -port -Ar -port_number -.Op -Cm -interface -Ar -interface_address -.Xc -This command configures a trap receiver at the given host -address and port number for sending messages with the specified -local interface address. -If the port number is unspecified, a value -of 18447 is used. -If the interface address is not specified, the -message is sent with a source address of the local interface the -message is sent through. -Note that on a multihomed host the -interface used may vary from time to time with routing changes. - -

    The trap receiver will generally log event messages and other -information from the server in a log file. -While such monitor -programs may also request their own trap dynamically, configuring a -trap receiver will ensure that no messages are lost when the server -is started. -.It -Cm -hop -Ar -... -This command specifies a list of TTL values in increasing order, up to 8 -values can be specified. -In manycast mode these values are used in turn in -an expanding-ring search. -The default is eight multiples of 32 starting at -31. - -

    This section was generated by AutoGen, -using the agtexi-cmd template and the option descriptions for the ntp.conf program. -This software is released under the NTP license, <http://ntp.org/license>. - -

    - -
    -

    -Next: , -Up: ntp.conf Invocation -
    -
    - -

    ntp.conf help/usage (--help)

    - -

    -This is the automatically generated usage text for ntp.conf. - -

    The text printed is the same whether selected with the help option -(--help) or the more-help option (--more-help). more-help will print -the usage text by passing it through a pager program. -more-help is disabled on platforms without a working -fork(2) function. The PAGER environment variable is -used to select the program, defaulting to more. Both will exit -with a status code of 0. - - 

                                                                                                                       ntp.conf is unavailable - no --help
-
    -
    -

    -Next: , -Previous: ntp.conf usage, -Up: ntp.conf Invocation -
    -
    - -

    presetting/configuring ntp.conf

    - -

    Any option that is not marked as not presettable may be preset by -loading values from environment variables named NTP.CONF and NTP.CONF_<OPTION_NAME>. <OPTION_NAME> must be one of -the options listed above in upper case and segmented with underscores. -The NTP.CONF variable will be tokenized and parsed like -the command line. The remaining variables are tested for existence and their -values are treated like option arguments. - -

    The command line options relating to configuration and/or usage help are: - -

    version
    - -

    Print the program version to standard out, optionally with licensing -information, then exit 0. The optional argument specifies how much licensing -detail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. Only the -first letter of the argument is examined: - -

    -
    version
    Only print the version. This is the default. -
    copyright
    Name the copyright usage licensing terms. -
    verbose
    Print the full copyright usage licensing terms. -
    - -
    -

    -Next: , -Previous: ntp.conf config, -Up: ntp.conf Invocation -
    -
    - -

    ntp.conf exit status

    - -

    One of the following exit values will be returned: -

    -
    0 (EXIT_SUCCESS)
    Successful program execution. -
    1 (EXIT_FAILURE)
    The operation failed or the command syntax was not valid. -
    -
    -

    -Next: , -Previous: ntp.conf exit status, -Up: ntp.conf Invocation -
    -
    - -

    ntp.conf Files

    - -
    -
    Pa
    the default name of the configuration file -
    Pa
    private MD5 keys -
    Pa
    RSA private key -
    Pa
    RSA public key -
    Pa
    Diffie-Hellman agreement parameters - -
    -

    -Next: , -Previous: ntp.conf Files, -Up: ntp.conf Invocation -
    -
    - -

    ntp.conf See Also

    - -

    .Sh -SEE -ALSO -ntpd(1ntpdmdoc), -ntpdc(1ntpdcmdoc), -ntpq(1ntpqmdoc) - -

    In addition to the manual pages provided, -comprehensive documentation is available on the world wide web -at -.Li -http://www.ntp.org/ -. -A snapshot of this documentation is available in HTML format in -.Pa -/usr/share/doc/ntp -. -.Rs -.%A -David -L. -Mills -.%T -Network -Time -Protocol -(Version -4) -.%O -RFC5905 -.Re -

    -

    -Next: , -Previous: ntp.conf See Also, -Up: ntp.conf Invocation -
    -
    - -

    ntp.conf Bugs

    - -

    The syntax checking is not picky; some combinations of -ridiculous and even hilarious options and modes may not be -detected. - -

    The -.Pa -ntpkey_ -Ns -Ar -host -files are really digital -certificates. -These should be obtained via secure directory -services when they become universally available. -

    -

    -Previous: ntp.conf Bugs, -Up: ntp.conf Invocation -
    -
    - -

    ntp.conf Notes

    - -

    This document corresponds to version of NTP. -This document was derived from FreeBSD. - - - diff --git a/ntpd/ntp.conf.man.in b/ntpd/ntp.conf.man.in index 4f0a641c04..9b7b1bdcb0 100644 --- a/ntpd/ntp.conf.man.in +++ b/ntpd/ntp.conf.man.in @@ -1,8 +1,8 @@ -.TH ntp.conf 5 "17 Dec 2012" "4.2.7p335" "File Formats" +.TH ntp.conf 5 "21 Dec 2012" "4.2.7p336" "File Formats" .\" .\" EDIT THIS FILE WITH CAUTION (ntp.man) .\" -.\" It has been AutoGen-ed December 17, 2012 at 11:37:40 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 11:32:07 AM by AutoGen 5.16.2 .\" From the definitions ntp.conf.def .\" and the template file agman-cmd.tpl .\" diff --git a/ntpd/ntp.conf.mdoc.in b/ntpd/ntp.conf.mdoc.in index 80bd198ed0..2633abe4c0 100644 --- a/ntpd/ntp.conf.mdoc.in +++ b/ntpd/ntp.conf.mdoc.in @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTP_CONF 5 File Formats .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:32 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:00 PM by AutoGen 5.16.2 .\" From the definitions ntp.conf.def .\" and the template file agmdoc-cmd.tpl .Sh NAME diff --git a/ntpd/ntp.keys.5man b/ntpd/ntp.keys.5man index bda0511be4..8c89a74f7c 100644 --- a/ntpd/ntp.keys.5man +++ b/ntpd/ntp.keys.5man @@ -1,8 +1,8 @@ -.TH ntp.keys 5man "17 Dec 2012" "4.2.7p335" "File Formats" +.TH ntp.keys 5man "21 Dec 2012" "4.2.7p336" "File Formats" .\" .\" EDIT THIS FILE WITH CAUTION (ntp.man) .\" -.\" It has been AutoGen-ed December 17, 2012 at 11:37:44 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 11:32:11 AM by AutoGen 5.16.2 .\" From the definitions ntp.keys.def .\" and the template file agman-file.tpl .\" diff --git a/ntpd/ntp.keys.5mdoc b/ntpd/ntp.keys.5mdoc index 06de12c29c..0ce326507c 100644 --- a/ntpd/ntp.keys.5mdoc +++ b/ntpd/ntp.keys.5mdoc @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTP_KEYS 5mdoc File Formats .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:34 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:03 PM by AutoGen 5.16.2 .\" From the definitions ntp.keys.def .\" and the template file agmdoc-file.tpl .Sh NAME diff --git a/ntpd/ntp.keys.html b/ntpd/ntp.keys.html index 0bd6e91e41..55f09958a5 100644 --- a/ntpd/ntp.keys.html +++ b/ntpd/ntp.keys.html @@ -33,9 +33,9 @@ Up: (dir)

    This document describes the symmetric key file for the NTP Project's ntpd program. -

    This document applies to version 4.2.7p335 of ntp.keys. +

    This document applies to version 4.2.7p336 of ntp.keys. -

    +

    Short Contents

      NTP's Symmetric Key File User Manual @@ -62,19 +62,17 @@ be specified in a configuration file, by default /etc/ntp.keys.

      - +
      -

      Invoking ntp.keys

      +

      Notes about ntp.keys

      This document describes the format of an NTP symmetric key file. For a description of the use of this type of file, see the -.Qq -Authentication -Support +"AuthenticationSupport" section of the ntp.conf(5) page. @@ -82,9 +80,7 @@ page.

      ntpd(8) reads its keys from a file specified using the -k command line option or the -.Ic -keys -statement in the configuration file. +keys statement in the configuration file. While key number 0 is fixed by the NTP standard (as 56 zero bits) and may not be changed, @@ -102,29 +98,17 @@ type key

      where -.Ar -keyno -is a positive integer (between 1 and 65534), -.Ar -type -is the message digest algorithm, +keyno is a positive integer (between 1 and 65534), +type is the message digest algorithm, and -.Ar -key -is the key itself. +key is the key itself.

      The -.Ar -key -may be given in a format +key may be given in a format controlled by the -.Ar -type -field. +type field. The -.Ar -type -.Li +type .Li MD5 is always supported. If @@ -133,9 +117,7 @@ ntpd was built with the OpenSSL library then any digest library supported by that library may be specified. However, if compliance with FIPS 140-2 is required the -.Ar -type -must be either +type must be either .Li SHA or @@ -170,123 +152,5 @@ so it is generally appropriate to specify these keys in ASCII format. using the agtexi-cmd template and the option descriptions for the ntp.keys program. This software is released under the NTP license, <http://ntp.org/license>. -

      - -
      -

      -Next: , -Up: ntp.keys Invocation -
      -
      - -

      ntp.keys help/usage (--help)

      - -

      -This is the automatically generated usage text for ntp.keys. - -

      The text printed is the same whether selected with the help option -(--help) or the more-help option (--more-help). more-help will print -the usage text by passing it through a pager program. -more-help is disabled on platforms without a working -fork(2) function. The PAGER environment variable is -used to select the program, defaulting to more. Both will exit -with a status code of 0. - - 

           ntp.keys is unavailable - no --help
-
      -
      -

      -Next: , -Previous: ntp.keys usage, -Up: ntp.keys Invocation -
      -
      - -

      presetting/configuring ntp.keys

      - -

      Any option that is not marked as not presettable may be preset by -loading values from environment variables named NTP.KEYS and NTP.KEYS_<OPTION_NAME>. <OPTION_NAME> must be one of -the options listed above in upper case and segmented with underscores. -The NTP.KEYS variable will be tokenized and parsed like -the command line. The remaining variables are tested for existence and their -values are treated like option arguments. - -

      The command line options relating to configuration and/or usage help are: - -

      version
      - -

      Print the program version to standard out, optionally with licensing -information, then exit 0. The optional argument specifies how much licensing -detail to provide. The default is to print just the version. The licensing infomation may be selected with an option argument. Only the -first letter of the argument is examined: - -

      -
      version
      Only print the version. This is the default. -
      copyright
      Name the copyright usage licensing terms. -
      verbose
      Print the full copyright usage licensing terms. -
      - -
      -

      -Next: , -Previous: ntp.keys config, -Up: ntp.keys Invocation -
      -
      - -

      ntp.keys exit status

      - -

      One of the following exit values will be returned: -

      -
      0 (EXIT_SUCCESS)
      Successful program execution. -
      1 (EXIT_FAILURE)
      The operation failed or the command syntax was not valid. -
      -
      -

      -Next: , -Previous: ntp.keys exit status, -Up: ntp.keys Invocation -
      -
      - -

      ntp.keys Files

      - -
      -
      Pa
      the default name of the configuration file - -
      -

      -Next: , -Previous: ntp.keys Files, -Up: ntp.keys Invocation -
      -
      - -

      ntp.keys See Also

      - -

      ntp.conf(5), -ntpd(1ntpdmdoc), -ntpdate(1ntpdatemdoc), -ntpdc(1ntpdcmdoc), -sntp(1sntpmdoc) -

      -

      -Previous: ntp.keys See Also, -Up: ntp.keys Invocation -
      -
      - -

      ntp.keys Notes

      - -

      This document corresponds to version of NTP. -This document was derived from FreeBSD. - diff --git a/ntpd/ntp.keys.man.in b/ntpd/ntp.keys.man.in index 39e2b51b00..00dd118313 100644 --- a/ntpd/ntp.keys.man.in +++ b/ntpd/ntp.keys.man.in @@ -1,8 +1,8 @@ -.TH ntp.keys 5 "17 Dec 2012" "4.2.7p335" "File Formats" +.TH ntp.keys 5 "21 Dec 2012" "4.2.7p336" "File Formats" .\" .\" EDIT THIS FILE WITH CAUTION (ntp.man) .\" -.\" It has been AutoGen-ed December 17, 2012 at 11:37:44 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 11:32:11 AM by AutoGen 5.16.2 .\" From the definitions ntp.keys.def .\" and the template file agman-file.tpl .\" diff --git a/ntpd/ntp.keys.mdoc.in b/ntpd/ntp.keys.mdoc.in index c9ba0af7db..3cfedd6473 100644 --- a/ntpd/ntp.keys.mdoc.in +++ b/ntpd/ntp.keys.mdoc.in @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTP_KEYS 5 File Formats .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:34 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:03 PM by AutoGen 5.16.2 .\" From the definitions ntp.keys.def .\" and the template file agmdoc-file.tpl .Sh NAME diff --git a/ntpd/ntpd-opts.c b/ntpd/ntpd-opts.c index 80be8b0432..29561b1e84 100644 --- a/ntpd/ntpd-opts.c +++ b/ntpd/ntpd-opts.c @@ -1,7 +1,7 @@ /* * EDIT THIS FILE WITH CAUTION (ntpd-opts.c) * - * It has been AutoGen-ed December 17, 2012 at 11:36:48 AM by AutoGen 5.16.2 + * It has been AutoGen-ed December 21, 2012 at 11:31:18 AM by AutoGen 5.16.2 * From the definitions ntpd-opts.def * and the template file options * @@ -78,7 +78,7 @@ extern FILE * option_usage_fp; * ntpd option static const strings */ static char const ntpd_opt_strs[2987] = -/* 0 */ "ntpd 4.2.7p335\n" +/* 0 */ "ntpd 4.2.7p336\n" "Copyright (C) 1970-2012 The University of Delaware, all rights reserved.\n" "This is free software. It is licensed for use, modification and\n" "redistribution under the terms of the NTP License, copies of which\n" @@ -204,12 +204,12 @@ static char const ntpd_opt_strs[2987] = /* 2753 */ "Output version information and exit\0" /* 2789 */ "version\0" /* 2797 */ "NTPD\0" -/* 2802 */ "ntpd - NTP daemon program - Ver. 4.2.7p335\n" +/* 2802 */ "ntpd - NTP daemon program - Ver. 4.2.7p336\n" "USAGE: %s [ - [] | --[{=| }] ]... \\\n" "\t\t[ ... ]\n\0" /* 2935 */ "http://bugs.ntp.org, bugs@ntp.org\0" /* 2969 */ "\n\n\0" -/* 2972 */ "ntpd 4.2.7p335"; +/* 2972 */ "ntpd 4.2.7p336"; /* * ipv4 option description with diff --git a/ntpd/ntpd-opts.h b/ntpd/ntpd-opts.h index 11a7926acf..1bf59d297c 100644 --- a/ntpd/ntpd-opts.h +++ b/ntpd/ntpd-opts.h @@ -1,7 +1,7 @@ /* * EDIT THIS FILE WITH CAUTION (ntpd-opts.h) * - * It has been AutoGen-ed December 17, 2012 at 11:36:47 AM by AutoGen 5.16.2 + * It has been AutoGen-ed December 21, 2012 at 11:31:17 AM by AutoGen 5.16.2 * From the definitions ntpd-opts.def * and the template file options * @@ -104,8 +104,8 @@ typedef enum { } teOptIndex; #define OPTION_CT 37 -#define NTPD_VERSION "4.2.7p335" -#define NTPD_FULL_VERSION "ntpd 4.2.7p335" +#define NTPD_VERSION "4.2.7p336" +#define NTPD_FULL_VERSION "ntpd 4.2.7p336" /* * Interface defines for all options. Replace "n" with the UPPER_CASED diff --git a/ntpd/ntpd.1ntpdman b/ntpd/ntpd.1ntpdman index 5463a81644..282213935e 100644 --- a/ntpd/ntpd.1ntpdman +++ b/ntpd/ntpd.1ntpdman @@ -1,8 +1,8 @@ -.TH ntpd 1ntpdman "17 Dec 2012" "4.2.7p335" "User Commands" +.TH ntpd 1ntpdman "21 Dec 2012" "4.2.7p336" "User Commands" .\" .\" EDIT THIS FILE WITH CAUTION (ntpd-opts.man) .\" -.\" It has been AutoGen-ed December 17, 2012 at 11:37:47 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 11:32:14 AM by AutoGen 5.16.2 .\" From the definitions ntpd-opts.def .\" and the template file agman-cmd.tpl .\" diff --git a/ntpd/ntpd.1ntpdmdoc b/ntpd/ntpd.1ntpdmdoc index 137fb45505..d60a579de9 100644 --- a/ntpd/ntpd.1ntpdmdoc +++ b/ntpd/ntpd.1ntpdmdoc @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTPD 1ntpdmdoc User Commands .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntpd-opts.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:36 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:04 PM by AutoGen 5.16.2 .\" From the definitions ntpd-opts.def .\" and the template file agmdoc-cmd.tpl .Sh NAME diff --git a/ntpd/ntpd.html b/ntpd/ntpd.html index bf47d58b4b..2a1d67d38f 100644 --- a/ntpd/ntpd.html +++ b/ntpd/ntpd.html @@ -218,7 +218,7 @@ the usage text by passing it through a pager program. used to select the program, defaulting to more. Both will exit with a status code of 0. -

      ntpd - NTP daemon program - Ver. 4.2.7p334
+
      ntpd - NTP daemon program - Ver. 4.2.7p335
 USAGE:  ntpd [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
                 [ <server1> ... <serverN> ]
   Flg Arg Option-Name    Description
@@ -393,7 +393,7 @@ Up: ntpd Invocation
 This is the “configuration file name” option. 
 This option takes an argument string. 
 The name and path of the configuration file,
-/etc/ntp.conf
+/etc/ntp.conf
 by default. 
 
      
 
      
@@ -409,12 +409,12 @@ Up: ntpd Invocation
 This is the “frequency drift file name” option. 
 This option takes an argument string. 
 The name and path of the frequency file,
-/etc/ntp.drift
+/etc/ntp.drift
 by default. 
 This is the same operation as the
-driftfile driftfile
+driftfile driftfile
 configuration specification in the
-/etc/ntp.conf
+/etc/ntp.conf
 file. 
 
      
 
      
@@ -435,16 +435,16 @@ This is the “allow the first adjustment to be big” option.

    Normally, -ntpd +ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, -ntpd +ntpd will exit with a message to the system log. This option can be used with the --q +-q and --x +-x options. See the -tinker +tinker configuration file directive for other options.

    @@ -466,19 +466,17 @@ This option takes an argument string.

Chroot the server to the directory -jaildir +jaildir . This option also implies that the server attempts to drop root privileges at startup. You may need to also specify a --u +-u option. This option is only available if the OS supports adjusting the clock without full root privileges. This option is supported under NetBSD (configure with -–enable-clockctl -) and Linux (configure with -–enable-linuxcaps -). +--enable-clockctl) and Linux (configure with +--enable-linuxcaps).

Next: , @@ -502,7 +500,7 @@ This option takes an argument string iface. given interface name. This option may appear multiple times. This option also implies not opening other addresses, except wildcard and localhost. This option is deprecated. Please consider using the configuration file -interface command, which is more versatile. +interface command, which is more versatile.

Next: , @@ -517,10 +515,10 @@ Up: ntpd Invocation This is the “path to symmetric keys” option. This option takes an argument string. Specify the name and path of the symmetric key file. -/etc/ntp.keys +/etc/ntp.keys is the default. This is the same operation as the -keys keyfile +keys keyfile configuration file directive.

@@ -538,7 +536,7 @@ This option takes an argument string. Specify the name and path of the log file. The default is the system log file. This is the same operation as the -logfile logfile +logfile logfile configuration file directive.

@@ -554,7 +552,7 @@ Up: ntpd Invocation This is the “do not listen to virtual interfaces” option. Do not listen to virtual interfaces, defined as those with names containing a colon. This option is deprecated. Please -consider using the configuration file interface command, which +consider using the configuration file interface command, which is more versatile.

@@ -590,7 +588,7 @@ Up: ntpd Invocation

This is the “run at high priority” option. To the extent permitted by the operating system, run -ntpd +ntpd at the highest priority.

@@ -606,10 +604,10 @@ Up: ntpd Invocation This is the “path to the pid file” option. This option takes an argument string. Specify the name and path of the file used to record -ntpd's +ntpd's process ID. This is the same operation as the -pidfile pidfile +pidfile pidfile configuration file directive.

@@ -625,9 +623,9 @@ Up: ntpd Invocation This is the “process priority” option. This option takes an argument number. To the extent permitted by the operating system, run -ntpd +ntpd at the specified -sched_setscheduler(SCHED_FIFO) +sched_setscheduler(SCHED_FIFO) priority.

@@ -648,15 +646,15 @@ This is the “set the time and quit” option. saveconfigquit, wait-sync. -

ntpd +

ntpd will not daemonize and will exit after the clock is first synchronized. This behavior mimics that of the -ntpdate +ntpdate program, which will soon be replaced with a shell script. The --g +-g and --x +-x options can be used with this option. Note: The kernel time discipline is disabled with this option.

@@ -694,7 +692,7 @@ This option takes an argument string. quit, wait-sync. -

Cause ntpd to parse its startup configuration file and save an +

Cause ntpd to parse its startup configuration file and save an equivalent to the given filename and exit. This option was designed for automated testing.

@@ -712,7 +710,7 @@ This is the “statistics file location” option. This option takes an argument string. Specify the directory path for files created by the statistics facility. This is the same operation as the -statsdir statsdir +statsdir statsdir configuration file directive.

@@ -733,7 +731,7 @@ This option takes an argument string tkey.
  • may appear an unlimited number of times. -

    Add a key number to the trusted key list. +

    Add the specified key number to the trusted key list.

    Next: , @@ -757,10 +755,8 @@ This option takes an argument string. This option is only available if the OS supports adjusting the clock without full root privileges. This option is supported under NetBSD (configure with -–enable-clockctl -) and Linux (configure with -–enable-linuxcaps -). +--enable-clockctl) and Linux (configure with +--enable-linuxcaps).

    Next: , @@ -799,13 +795,13 @@ This option takes an argument number. nofork, quit, saveconfigquit. -

    If greater than zero, alters ntpd behavior when forking to +

    If greater than zero, alters ntpd's behavior when forking to daemonize. Instead of exiting with status 0 immediately after the fork, the parent waits up to the specified number of seconds for the child to first synchronize the clock. The exit status is zero (success) if the clock was synchronized, -otherwise it is ETIMEDOUT. -This provides the option for a script starting ntpd to easily +otherwise it is ETIMEDOUT. +This provides the option for a script starting ntpd to easily wait for the first set of the clock before proceeding.

    @@ -824,12 +820,12 @@ This option sets the threshold to 600 s, which is well within the accuracy windo Note: Since the slew rate of typical Unix kernels is limited to 0.5 ms/s, each second of adjustment requires an amortization interval of 2000 s. Thus, an adjustment as much as 600 s will take almost 14 days to complete. This option can be used with the --g +-g and --q +-q options. See the -tinker +tinker configuration file directive for other options. Note: The kernel time discipline is disabled with this option.
    @@ -850,8 +846,8 @@ This is the “use cpu cycle counter (windows only)” option.
  • must be compiled in by defining SYS_WINNT during the compilation. -

    Attempt to substitute the CPU counter for QueryPerformanceCounter. -The CPU counter and QueryPerformanceCounter are compared, and if +

    Attempt to substitute the CPU counter for QueryPerformanceCounter. +The CPU counter and QueryPerformanceCounter are compared, and if they have the same frequency, the CPU counter (RDTSC on x86) is used directly, saving the overhead of a system call.

    @@ -873,7 +869,7 @@ This option takes an argument string.
  • must be compiled in by defining SYS_WINNT during the compilation. -

    Force substitution the CPU counter for QueryPerformanceCounter. +

    Force substitution the CPU counter for QueryPerformanceCounter. The CPU counter (RDTSC on x86) is used unconditionally with the given frequency (in Hz).

    @@ -954,10 +950,15 @@ Up: ntpd Invocation

    ntpd Usage

    -

    .Ss -"How -NTP -Operates" +

    +

    + +
    +
    + +

    How NTP Operates

    + +

    How NTP Operates The ntpd utility operates by exchanging messages with @@ -975,12 +976,8 @@ interval of 64s, several minutes can elapse before the clock is set. This initial delay to set the clock can be safely and dramatically reduced using the -.Cm -iburst -keyword with the -.Ic -server -configuration +iburst keyword with the +server configuration command, as described in ntp.conf(5). @@ -1078,23 +1075,18 @@ frequency error is so large that the first sample is outside the acceptable range, ntpd enters the same state as when the -.Pa -ntp.drift +ntp.drift file is not present. The intent of this behavior is to quickly correct the frequency and restore operation to the normal tracking mode. In the most extreme cases (the host -.Cm -time.ien.it -comes to mind), there may be occasional +time.ien.it comes to mind), there may be occasional step/slew corrections and subsequent frequency corrections. It helps in these cases to use the -.Cm -burst -keyword when +burst keyword when configuring the server, but ONLY when you have permission to do so from the owner of the target host. @@ -1109,23 +1101,21 @@ but this was never more than a mediocre hack and is no longer needed.

    There is a way to start ntpd(8) that often addresses all of the problems mentioned above. -.Ss -"Starting -NTP -(Best -Current -Practice)" +

    +

    + +
    +
    + +

    Starting NTP (Best Current Practice)

    + +

    Starting NTP (Best Current Practice) First, use the -.Cm -iburst -option on your -.Cm -server -entries. +iburst option on your +server entries.

    If you can also keep a good -.Pa -ntp.drift +ntp.drift file then ntpd(8) will effectively "warm-start" and your system's clock will @@ -1144,9 +1134,7 @@ as much time as possible to get the system's clock synchronized and stable.

    Finally, if you have processes like -.Cm -dovecot -or database servers +dovecot or database servers that require monotonically-increasing time, run @@ -1159,15 +1147,20 @@ and after exits successfully it is as safe as it will ever be to start any process that require stable time. -.Ss -"Frequency -Discipline" +

    +

    + +
    +
    + +

    Frequency Discipline

    + +

    Frequency Discipline The ntpd behavior at startup depends on whether the frequency file, usually -.Pa -ntp.drift +ntp.drift, , exists. This file @@ -1194,22 +1187,25 @@ frequency is initialized from the file and enters normal mode immediately. After that the current frequency offset is written to the file at hourly intervals. -.Ss -"Operating -Modes" +

    +

    + +
    +
    + +

    Operating Modes

    + +

    Operating Modes The ntpd utility can operate in any of several modes, including symmetric active/passive, client/server broadcast/multicast and manycast, as described in the -.Qq -Association -Management +"AssociationManagement" page (available as part of the HTML documentation provided in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp). ) . It normally operates continuously while @@ -1265,12 +1261,8 @@ setting the clock for the first time. The procedure for initially setting the clock is the same as in continuous mode; most applications will probably want to specify the -.Cm -iburst -keyword with the -.Ic -server -configuration command. +iburst keyword with the +server configuration command. With this keyword a volley of messages are exchanged to groom the data and the clock is set in about 10 s. @@ -1302,10 +1294,15 @@ stopped and run in one-time mode as required. At each startup, the frequency is read from the file and initializes the kernel frequency. -.Ss -"Poll -Interval -Control" +

    +

    + +
    +
    + +

    Poll Interval Control

    + +

    Poll Interval Control This version of NTP includes an intricate state machine to reduce the network load while maintaining a quality of synchronization consistent with the observed jitter and wander. @@ -1317,16 +1314,10 @@ the consequences of changing the poll adjustment range from the default minimum of 64 s to the default maximum of 1,024 s. The default minimum can be changed with the -.Ic -tinker -.Cm -minpoll -command to a value not less than 16 s. +tinker minpoll command to a value not less than 16 s. This value is used for all configured associations, unless overridden by the -.Cm -minpoll -option on the configuration command. +minpoll option on the configuration command. Note that most device drivers will not operate properly if the poll interval is less than 64 s and that the broadcast server and manycast client associations will @@ -1348,18 +1339,22 @@ At a minimum of 1,024 s, for example, the capture range is only 31 PPM. If the intrinsic error is greater than this, the drift file -.Pa -ntp.drift +ntp.drift will have to be specially tailored to reduce the residual error below this limit. Once this is done, the drift file is automatically updated once per hour and is available to initialize the frequency on subsequent daemon restarts. -.Ss -"The -huff-n'-puff -Filter" +

    +

    + +
    +
    + +

    The huff-n'-puff Filter

    + +

    The huff-n'-puff Filter In scenarios where a considerable amount of data are to be downloaded or uploaded over telephone modems, timekeeping quality can be seriously degraded. @@ -1388,12 +1383,8 @@ and positive (puff) correction, which depends on the sign of the offset.

    The filter is activated by the -.Ic -tinker -command and -.Cm -huffpuff -keyword, as described in +tinker command and +huffpuff keyword, as described in ntp.conf(5).

    @@ -1432,8 +1423,7 @@ at http://www.ntp.org/ . A snapshot of this documentation is available in HTML format in -.Pa -/usr/share/doc/ntp +/usr/share/doc/ntp. . .Rs .%A diff --git a/ntpd/ntpd.man.in b/ntpd/ntpd.man.in index 9fc01aec93..6c43dfc705 100644 --- a/ntpd/ntpd.man.in +++ b/ntpd/ntpd.man.in @@ -1,8 +1,8 @@ -.TH ntpd @NTPD_MS@ "17 Dec 2012" "4.2.7p335" "User Commands" +.TH ntpd @NTPD_MS@ "21 Dec 2012" "4.2.7p336" "User Commands" .\" .\" EDIT THIS FILE WITH CAUTION (ntpd-opts.man) .\" -.\" It has been AutoGen-ed December 17, 2012 at 11:37:47 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 11:32:14 AM by AutoGen 5.16.2 .\" From the definitions ntpd-opts.def .\" and the template file agman-cmd.tpl .\" diff --git a/ntpd/ntpd.mdoc.in b/ntpd/ntpd.mdoc.in index fd2428d7c7..42d1fecc0e 100644 --- a/ntpd/ntpd.mdoc.in +++ b/ntpd/ntpd.mdoc.in @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTPD @NTPD_MS@ User Commands .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntpd-opts.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:36 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:04 PM by AutoGen 5.16.2 .\" From the definitions ntpd-opts.def .\" and the template file agmdoc-cmd.tpl .Sh NAME diff --git a/ntpdc/invoke-ntpdc.texi b/ntpdc/invoke-ntpdc.texi index b61260aa3e..871f7726ea 100644 --- a/ntpdc/invoke-ntpdc.texi +++ b/ntpdc/invoke-ntpdc.texi @@ -6,7 +6,7 @@ # # EDIT THIS FILE WITH CAUTION (invoke-ntpdc.texi) # -# It has been AutoGen-ed December 18, 2012 at 03:57:58 AM by AutoGen 5.16.2 +# It has been AutoGen-ed December 21, 2012 at 06:20:27 PM by AutoGen 5.16.2 # From the definitions ntpdc-opts.def # and the template file agtexi-cmd.tpl @end ignore @@ -69,7 +69,7 @@ with a status code of 0. @exampleindent 0 @example -ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p335 +ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p336 USAGE: ntpdc [ - [] | --[@{=| @}] ]... [ host ...] Flg Arg Option-Name Description -4 no ipv4 Force IPv4 DNS name resolution diff --git a/ntpdc/ntpdc-opts.c b/ntpdc/ntpdc-opts.c index ad6969431b..5a7291c61d 100644 --- a/ntpdc/ntpdc-opts.c +++ b/ntpdc/ntpdc-opts.c @@ -1,7 +1,7 @@ /* * EDIT THIS FILE WITH CAUTION (ntpdc-opts.c) * - * It has been AutoGen-ed December 18, 2012 at 03:57:48 AM by AutoGen 5.16.2 + * It has been AutoGen-ed December 21, 2012 at 06:20:16 PM by AutoGen 5.16.2 * From the definitions ntpdc-opts.def * and the template file options * @@ -72,7 +72,7 @@ extern FILE * option_usage_fp; * ntpdc option static const strings */ static char const ntpdc_opt_strs[1862] = -/* 0 */ "ntpdc 4.2.7p335\n" +/* 0 */ "ntpdc 4.2.7p336\n" "Copyright (C) 1970-2012 The University of Delaware, all rights reserved.\n" "This is free software. It is licensed for use, modification and\n" "redistribution under the terms of the NTP License, copies of which\n" @@ -130,14 +130,14 @@ static char const ntpdc_opt_strs[1862] = /* 1640 */ "no-load-opts\0" /* 1653 */ "no\0" /* 1656 */ "NTPDC\0" -/* 1662 */ "ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p335\n" +/* 1662 */ "ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p336\n" "USAGE: %s [ - [] | --[{=| }] ]... [ host ...]\n\0" /* 1794 */ "$HOME\0" /* 1800 */ ".\0" /* 1802 */ ".ntprc\0" /* 1809 */ "http://bugs.ntp.org, bugs@ntp.org\0" /* 1843 */ "\n\n\0" -/* 1846 */ "ntpdc 4.2.7p335"; +/* 1846 */ "ntpdc 4.2.7p336"; /* * ipv4 option description with diff --git a/ntpdc/ntpdc-opts.h b/ntpdc/ntpdc-opts.h index fd463e0053..f75a4c6285 100644 --- a/ntpdc/ntpdc-opts.h +++ b/ntpdc/ntpdc-opts.h @@ -1,7 +1,7 @@ /* * EDIT THIS FILE WITH CAUTION (ntpdc-opts.h) * - * It has been AutoGen-ed December 18, 2012 at 03:57:48 AM by AutoGen 5.16.2 + * It has been AutoGen-ed December 21, 2012 at 06:20:15 PM by AutoGen 5.16.2 * From the definitions ntpdc-opts.def * and the template file options * @@ -82,8 +82,8 @@ typedef enum { } teOptIndex; #define OPTION_CT 15 -#define NTPDC_VERSION "4.2.7p335" -#define NTPDC_FULL_VERSION "ntpdc 4.2.7p335" +#define NTPDC_VERSION "4.2.7p336" +#define NTPDC_FULL_VERSION "ntpdc 4.2.7p336" /* * Interface defines for all options. Replace "n" with the UPPER_CASED diff --git a/ntpdc/ntpdc.1ntpdcman b/ntpdc/ntpdc.1ntpdcman index e5f888e907..53ad4d37c2 100644 --- a/ntpdc/ntpdc.1ntpdcman +++ b/ntpdc/ntpdc.1ntpdcman @@ -1,8 +1,8 @@ -.TH ntpdc 1ntpdcman "18 Dec 2012" "4.2.7p335" "User Commands" +.TH ntpdc 1ntpdcman "21 Dec 2012" "4.2.7p336" "User Commands" .\" .\" EDIT THIS FILE WITH CAUTION (ntpdc-opts.man) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:57:54 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:23 PM by AutoGen 5.16.2 .\" From the definitions ntpdc-opts.def .\" and the template file agman-cmd.tpl .\" diff --git a/ntpdc/ntpdc.1ntpdcmdoc b/ntpdc/ntpdc.1ntpdcmdoc index 61818e9b08..0e2c42c75c 100644 --- a/ntpdc/ntpdc.1ntpdcmdoc +++ b/ntpdc/ntpdc.1ntpdcmdoc @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTPDC 1ntpdcmdoc User Commands .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntpdc-opts.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:58:00 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:20:30 PM by AutoGen 5.16.2 .\" From the definitions ntpdc-opts.def .\" and the template file agmdoc-cmd.tpl .Sh NAME diff --git a/ntpdc/ntpdc.html b/ntpdc/ntpdc.html index 323910aba3..1a8bb83e15 100644 --- a/ntpdc/ntpdc.html +++ b/ntpdc/ntpdc.html @@ -36,7 +36,7 @@ display the time offset of the system clock relative to the server clock. Run as root, it can correct the system clock to this offset as well. It can be run as an interactive command or from a cron job. -

    This document applies to version 4.2.7p335 of ntpdc. +

    This document applies to version 4.2.7p336 of ntpdc.

    The program implements the SNTP protocol as defined by RFC 5905, the NTPv4 IETF specification. @@ -138,7 +138,7 @@ the usage text by passing it through a pager program. used to select the program, defaulting to more. Both will exit with a status code of 0. -

    ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p335
+
    ntpdc - vendor-specific NTPD control program - Ver. 4.2.7p336
 USAGE:  ntpdc [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [ host ...]
   Flg Arg Option-Name    Description
    -4 no  ipv4           Force IPv4 DNS name resolution
diff --git a/ntpdc/ntpdc.man.in b/ntpdc/ntpdc.man.in
index 9911f4eb4f..64b4034281 100644
--- a/ntpdc/ntpdc.man.in
+++ b/ntpdc/ntpdc.man.in
@@ -1,8 +1,8 @@
-.TH ntpdc @NTPDC_MS@ "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH ntpdc @NTPDC_MS@ "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntpdc-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:57:54 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:23 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpdc-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/ntpdc/ntpdc.mdoc.in b/ntpdc/ntpdc.mdoc.in
index 938589c405..5a10cfb912 100644
--- a/ntpdc/ntpdc.mdoc.in
+++ b/ntpdc/ntpdc.mdoc.in
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt NTPDC @NTPDC_MS@ User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntpdc-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:00 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:30 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpdc-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/ntpq/invoke-ntpq.texi b/ntpq/invoke-ntpq.texi
index f64484a8cf..e561172507 100644
--- a/ntpq/invoke-ntpq.texi
+++ b/ntpq/invoke-ntpq.texi
@@ -6,7 +6,7 @@
 # 
 # EDIT THIS FILE WITH CAUTION  (invoke-ntpq.texi)
 # 
-# It has been AutoGen-ed  December 18, 2012 at 03:58:14 AM by AutoGen 5.16.2
+# It has been AutoGen-ed  December 21, 2012 at 06:20:44 PM by AutoGen 5.16.2
 # From the definitions    ntpq-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
@@ -272,7 +272,7 @@ with a status code of 0.
 
 @exampleindent 0
 @example
-ntpq - standard NTP query program - Ver. 4.2.7p335
+ntpq - standard NTP query program - Ver. 4.2.7p336
 USAGE:  ntpq [ - [] | --[@{=| @}] ]... [ host ...]
   Flg Arg Option-Name    Description
    -4 no  ipv4           Force IPv4 DNS name resolution
diff --git a/ntpq/ntpq-opts.c b/ntpq/ntpq-opts.c
index af64d364df..5092f3d7cf 100644
--- a/ntpq/ntpq-opts.c
+++ b/ntpq/ntpq-opts.c
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (ntpq-opts.c)
  *  
- *  It has been AutoGen-ed  December 18, 2012 at 03:58:03 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 06:20:33 PM by AutoGen 5.16.2
  *  From the definitions    ntpq-opts.def
  *  and the template file   options
  *
@@ -72,7 +72,7 @@ extern FILE * option_usage_fp;
  *  ntpq option static const strings
  */
 static char const ntpq_opt_strs[1833] =
-/*     0 */ "ntpq 4.2.7p335\n"
+/*     0 */ "ntpq 4.2.7p336\n"
             "Copyright (C) 1970-2012 The University of Delaware, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
             "redistribution under the terms of the NTP License, copies of which\n"
@@ -128,13 +128,13 @@ static char const ntpq_opt_strs[1833] =
 /*  1627 */ "no-load-opts\0"
 /*  1640 */ "no\0"
 /*  1643 */ "NTPQ\0"
-/*  1648 */ "ntpq - standard NTP query program - Ver. 4.2.7p335\n"
+/*  1648 */ "ntpq - standard NTP query program - Ver. 4.2.7p336\n"
             "USAGE:  %s [ - [] | --[{=| }] ]... [ host ...]\n\0"
 /*  1769 */ "$HOME\0"
 /*  1775 */ ".\0"
 /*  1777 */ ".ntprc\0"
 /*  1784 */ "http://bugs.ntp.org, bugs@ntp.org\0"
-/*  1818 */ "ntpq 4.2.7p335";
+/*  1818 */ "ntpq 4.2.7p336";
 
 /*
  *  ipv4 option description with
diff --git a/ntpq/ntpq-opts.h b/ntpq/ntpq-opts.h
index fca5b1763b..3ce7b6e1dd 100644
--- a/ntpq/ntpq-opts.h
+++ b/ntpq/ntpq-opts.h
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (ntpq-opts.h)
  *  
- *  It has been AutoGen-ed  December 18, 2012 at 03:58:02 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 06:20:32 PM by AutoGen 5.16.2
  *  From the definitions    ntpq-opts.def
  *  and the template file   options
  *
@@ -81,8 +81,8 @@ typedef enum {
 } teOptIndex;
 
 #define OPTION_CT    14
-#define NTPQ_VERSION       "4.2.7p335"
-#define NTPQ_FULL_VERSION  "ntpq 4.2.7p335"
+#define NTPQ_VERSION       "4.2.7p336"
+#define NTPQ_FULL_VERSION  "ntpq 4.2.7p336"
 
 /*
  *  Interface defines for all options.  Replace "n" with the UPPER_CASED
diff --git a/ntpq/ntpq.1ntpqman b/ntpq/ntpq.1ntpqman
index 158f6c0047..86c0a3db24 100644
--- a/ntpq/ntpq.1ntpqman
+++ b/ntpq/ntpq.1ntpqman
@@ -1,8 +1,8 @@
-.TH ntpq 1ntpqman "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH ntpq 1ntpqman "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntpq-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:10 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:40 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpq-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/ntpq/ntpq.1ntpqmdoc b/ntpq/ntpq.1ntpqmdoc
index 0099c5778d..41ba9c659c 100644
--- a/ntpq/ntpq.1ntpqmdoc
+++ b/ntpq/ntpq.1ntpqmdoc
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt NTPQ 1ntpqmdoc User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntpq-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:16 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:46 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpq-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/ntpq/ntpq.man.in b/ntpq/ntpq.man.in
index 553823a936..8a390065cf 100644
--- a/ntpq/ntpq.man.in
+++ b/ntpq/ntpq.man.in
@@ -1,8 +1,8 @@
-.TH ntpq @NTPQ_MS@ "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH ntpq @NTPQ_MS@ "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntpq-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:10 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:40 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpq-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/ntpq/ntpq.mdoc.in b/ntpq/ntpq.mdoc.in
index 062e96a5d9..5bcdc62726 100644
--- a/ntpq/ntpq.mdoc.in
+++ b/ntpq/ntpq.mdoc.in
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt NTPQ @NTPQ_MS@ User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntpq-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:16 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:46 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpq-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/ntpsnmpd/invoke-ntpsnmpd.texi b/ntpsnmpd/invoke-ntpsnmpd.texi
index 7e5f8deb3d..750c874466 100644
--- a/ntpsnmpd/invoke-ntpsnmpd.texi
+++ b/ntpsnmpd/invoke-ntpsnmpd.texi
@@ -6,7 +6,7 @@
 # 
 # EDIT THIS FILE WITH CAUTION  (invoke-ntpsnmpd.texi)
 # 
-# It has been AutoGen-ed  December 18, 2012 at 03:58:29 AM by AutoGen 5.16.2
+# It has been AutoGen-ed  December 21, 2012 at 06:21:00 PM by AutoGen 5.16.2
 # From the definitions    ntpsnmpd-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
@@ -43,7 +43,7 @@ with a status code of 0.
 
 @exampleindent 0
 @example
-ntpsnmpd - NTP SNMP MIB agent - Ver. 4.2.7p335
+ntpsnmpd - NTP SNMP MIB agent - Ver. 4.2.7p336
 USAGE:  ntpsnmpd [ - [] | --[@{=| @}] ]...
   Flg Arg Option-Name    Description
    -n no  nofork         Do not fork
diff --git a/ntpsnmpd/ntpsnmpd-opts.c b/ntpsnmpd/ntpsnmpd-opts.c
index 6b0fff0c0a..052b229b67 100644
--- a/ntpsnmpd/ntpsnmpd-opts.c
+++ b/ntpsnmpd/ntpsnmpd-opts.c
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (ntpsnmpd-opts.c)
  *  
- *  It has been AutoGen-ed  December 18, 2012 at 03:58:19 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 06:20:49 PM by AutoGen 5.16.2
  *  From the definitions    ntpsnmpd-opts.def
  *  and the template file   options
  *
@@ -64,7 +64,7 @@ extern FILE * option_usage_fp;
  *  ntpsnmpd option static const strings
  */
 static char const ntpsnmpd_opt_strs[1561] =
-/*     0 */ "ntpsnmpd 4.2.7p335\n"
+/*     0 */ "ntpsnmpd 4.2.7p336\n"
             "Copyright (C) 1970-2012 The University of Delaware, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
             "redistribution under the terms of the NTP License, copies of which\n"
@@ -103,14 +103,14 @@ static char const ntpsnmpd_opt_strs[1561] =
 /*  1360 */ "no-load-opts\0"
 /*  1373 */ "no\0"
 /*  1376 */ "NTPSNMPD\0"
-/*  1385 */ "ntpsnmpd - NTP SNMP MIB agent - Ver. 4.2.7p335\n"
+/*  1385 */ "ntpsnmpd - NTP SNMP MIB agent - Ver. 4.2.7p336\n"
             "USAGE:  %s [ - [] | --[{=| }] ]...\n\0"
 /*  1490 */ "$HOME\0"
 /*  1496 */ ".\0"
 /*  1498 */ ".ntprc\0"
 /*  1505 */ "http://bugs.ntp.org, bugs@ntp.org\0"
 /*  1539 */ "\n\n\0"
-/*  1542 */ "ntpsnmpd 4.2.7p335";
+/*  1542 */ "ntpsnmpd 4.2.7p336";
 
 /*
  *  nofork option description:
diff --git a/ntpsnmpd/ntpsnmpd-opts.h b/ntpsnmpd/ntpsnmpd-opts.h
index 1cd3927cbf..196965183b 100644
--- a/ntpsnmpd/ntpsnmpd-opts.h
+++ b/ntpsnmpd/ntpsnmpd-opts.h
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (ntpsnmpd-opts.h)
  *  
- *  It has been AutoGen-ed  December 18, 2012 at 03:58:18 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 06:20:48 PM by AutoGen 5.16.2
  *  From the definitions    ntpsnmpd-opts.def
  *  and the template file   options
  *
@@ -75,8 +75,8 @@ typedef enum {
 } teOptIndex;
 
 #define OPTION_CT    8
-#define NTPSNMPD_VERSION       "4.2.7p335"
-#define NTPSNMPD_FULL_VERSION  "ntpsnmpd 4.2.7p335"
+#define NTPSNMPD_VERSION       "4.2.7p336"
+#define NTPSNMPD_FULL_VERSION  "ntpsnmpd 4.2.7p336"
 
 /*
  *  Interface defines for all options.  Replace "n" with the UPPER_CASED
diff --git a/ntpsnmpd/ntpsnmpd.1ntpsnmpdman b/ntpsnmpd/ntpsnmpd.1ntpsnmpdman
index a5b879ab6b..6a618186b4 100644
--- a/ntpsnmpd/ntpsnmpd.1ntpsnmpdman
+++ b/ntpsnmpd/ntpsnmpd.1ntpsnmpdman
@@ -1,8 +1,8 @@
-.TH ntpsnmpd 1ntpsnmpdman "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH ntpsnmpd 1ntpsnmpdman "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntpsnmpd-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:25 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:57 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpsnmpd-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/ntpsnmpd/ntpsnmpd.1ntpsnmpdmdoc b/ntpsnmpd/ntpsnmpd.1ntpsnmpdmdoc
index 10155db599..5605a10924 100644
--- a/ntpsnmpd/ntpsnmpd.1ntpsnmpdmdoc
+++ b/ntpsnmpd/ntpsnmpd.1ntpsnmpdmdoc
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt NTPSNMPD 1ntpsnmpdmdoc User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntpsnmpd-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:31 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:02 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpsnmpd-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/ntpsnmpd/ntpsnmpd.man.in b/ntpsnmpd/ntpsnmpd.man.in
index 7df737f839..e0c9201b53 100644
--- a/ntpsnmpd/ntpsnmpd.man.in
+++ b/ntpsnmpd/ntpsnmpd.man.in
@@ -1,8 +1,8 @@
-.TH ntpsnmpd @NTPSNMPD_MS@ "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH ntpsnmpd @NTPSNMPD_MS@ "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntpsnmpd-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:25 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:20:57 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpsnmpd-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/ntpsnmpd/ntpsnmpd.mdoc.in b/ntpsnmpd/ntpsnmpd.mdoc.in
index a358fa0e05..89d5e80059 100644
--- a/ntpsnmpd/ntpsnmpd.mdoc.in
+++ b/ntpsnmpd/ntpsnmpd.mdoc.in
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt NTPSNMPD @NTPSNMPD_MS@ User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntpsnmpd-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:31 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:02 PM by AutoGen 5.16.2
 .\"  From the definitions    ntpsnmpd-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/packageinfo.sh b/packageinfo.sh
index 3ddd5427f6..fe8eafaf5a 100644
--- a/packageinfo.sh
+++ b/packageinfo.sh
@@ -70,7 +70,7 @@ CLTAG=NTP_4_2_0
 # - Numeric values increment
 # - empty 'increments' to 1
 # - NEW 'increments' to empty
-point=335
+point=336
 
 ### betapoint is normally modified by script.
 # ntp-stable Beta number (betapoint)
diff --git a/scripts/invoke-ntp-wait.texi b/scripts/invoke-ntp-wait.texi
index 0c9c9acea2..61ac7e1f0f 100644
--- a/scripts/invoke-ntp-wait.texi
+++ b/scripts/invoke-ntp-wait.texi
@@ -6,7 +6,7 @@
 # 
 # EDIT THIS FILE WITH CAUTION  (invoke-ntp-wait.texi)
 # 
-# It has been AutoGen-ed  December 17, 2012 at 11:36:20 AM by AutoGen 5.16.2
+# It has been AutoGen-ed  December 21, 2012 at 11:30:14 AM by AutoGen 5.16.2
 # From the definitions    ntp-wait-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
diff --git a/scripts/ntp-wait.1ntp-waitman b/scripts/ntp-wait.1ntp-waitman
index 8ca36a609f..38729609ef 100644
--- a/scripts/ntp-wait.1ntp-waitman
+++ b/scripts/ntp-wait.1ntp-waitman
@@ -1,8 +1,8 @@
-.TH ntp-wait 1ntp-waitman "17 Dec 2012" "ntp (4.2.7p335)" "User Commands"
+.TH ntp-wait 1ntp-waitman "21 Dec 2012" "ntp (4.2.7p336)" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntp-wait-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 17, 2012 at 11:36:16 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 11:30:10 AM by AutoGen 5.16.2
 .\"  From the definitions    ntp-wait-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/scripts/ntp-wait.1ntp-waitmdoc b/scripts/ntp-wait.1ntp-waitmdoc
index 15b7087f6d..9ac1b36624 100644
--- a/scripts/ntp-wait.1ntp-waitmdoc
+++ b/scripts/ntp-wait.1ntp-waitmdoc
@@ -1,9 +1,9 @@
-.Dd December 17 2012
+.Dd December 21 2012
 .Dt NTP_WAIT 1ntp-waitmdoc User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntp-wait-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 17, 2012 at 11:36:22 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 11:30:17 AM by AutoGen 5.16.2
 .\"  From the definitions    ntp-wait-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/scripts/ntp-wait.html b/scripts/ntp-wait.html
index dd143f9f1f..b135ae0838 100644
--- a/scripts/ntp-wait.html
+++ b/scripts/ntp-wait.html
@@ -41,7 +41,7 @@ until the system's time has stabilized and synchronized,
 and only then start any applicaitons (like database servers) that require
 accurate and stable time.
 
-  
    This document applies to version 4.2.7p335 of ntp-wait.
+  
    This document applies to version 4.2.7p336 of ntp-wait.
 
   
    
 
    Short Contents
    
diff --git a/scripts/ntp-wait.man.in b/scripts/ntp-wait.man.in
index b45924a706..0c9cb0ff2b 100644
--- a/scripts/ntp-wait.man.in
+++ b/scripts/ntp-wait.man.in
@@ -1,8 +1,8 @@
-.TH ntp-wait @NTP_WAIT_MS@ "17 Dec 2012" "ntp (4.2.7p335)" "User Commands"
+.TH ntp-wait @NTP_WAIT_MS@ "21 Dec 2012" "ntp (4.2.7p336)" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntp-wait-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 17, 2012 at 11:36:16 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 11:30:10 AM by AutoGen 5.16.2
 .\"  From the definitions    ntp-wait-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/scripts/ntp-wait.mdoc.in b/scripts/ntp-wait.mdoc.in
index 7262507953..5e67de88be 100644
--- a/scripts/ntp-wait.mdoc.in
+++ b/scripts/ntp-wait.mdoc.in
@@ -1,9 +1,9 @@
-.Dd December 17 2012
+.Dd December 21 2012
 .Dt NTP_WAIT @NTP_WAIT_MS@ User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntp-wait-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 17, 2012 at 11:36:22 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 11:30:17 AM by AutoGen 5.16.2
 .\"  From the definitions    ntp-wait-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/sntp/invoke-sntp.texi b/sntp/invoke-sntp.texi
index 0dca33eba7..0f1ed1ed54 100644
--- a/sntp/invoke-sntp.texi
+++ b/sntp/invoke-sntp.texi
@@ -6,7 +6,7 @@
 # 
 # EDIT THIS FILE WITH CAUTION  (invoke-sntp.texi)
 # 
-# It has been AutoGen-ed  December 18, 2012 at 03:59:12 AM by AutoGen 5.16.2
+# It has been AutoGen-ed  December 21, 2012 at 06:21:43 PM by AutoGen 5.16.2
 # From the definitions    sntp-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
@@ -95,7 +95,7 @@ with a status code of 0.
 
 @exampleindent 0
 @example
-sntp - standard Simple Network Time Protocol client program - Ver. 4.2.7p335
+sntp - standard Simple Network Time Protocol client program - Ver. 4.2.7p336
 USAGE:  sntp [ - [] | --[@{=| @}] ]... \
                 [ hostname-or-IP ...]
   Flg Arg Option-Name    Description
diff --git a/sntp/sntp-opts.c b/sntp/sntp-opts.c
index 6a3b353de1..0eb0ee67ff 100644
--- a/sntp/sntp-opts.c
+++ b/sntp/sntp-opts.c
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (sntp-opts.c)
  *  
- *  It has been AutoGen-ed  December 17, 2012 at 11:33:38 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 11:25:47 AM by AutoGen 5.16.2
  *  From the definitions    sntp-opts.def
  *  and the template file   options
  *
@@ -73,7 +73,7 @@ extern FILE * option_usage_fp;
  *  sntp option static const strings
  */
 static char const sntp_opt_strs[2500] =
-/*     0 */ "sntp 4.2.7p335\n"
+/*     0 */ "sntp 4.2.7p336\n"
             "Copyright (C) 1970-2012 The University of Delaware, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
             "redistribution under the terms of the NTP License, copies of which\n"
@@ -157,7 +157,7 @@ static char const sntp_opt_strs[2500] =
 /*  2244 */ "LOAD_OPTS\0"
 /*  2254 */ "no-load-opts\0"
 /*  2267 */ "SNTP\0"
-/*  2272 */ "sntp - standard Simple Network Time Protocol client program - Ver. 4.2.7p335\n"
+/*  2272 */ "sntp - standard Simple Network Time Protocol client program - Ver. 4.2.7p336\n"
             "USAGE:  %s [ - [] | --[{=| }] ]... \\\n"
             "\t\t[ hostname-or-IP ...]\n\0"
 /*  2433 */ "$HOME\0"
@@ -165,7 +165,7 @@ static char const sntp_opt_strs[2500] =
 /*  2441 */ ".ntprc\0"
 /*  2448 */ "http://bugs.ntp.org, bugs@ntp.org\0"
 /*  2482 */ "\n\n\0"
-/*  2485 */ "sntp 4.2.7p335";
+/*  2485 */ "sntp 4.2.7p336";
 
 /*
  *  ipv4 option description with
diff --git a/sntp/sntp-opts.h b/sntp/sntp-opts.h
index cef1680e11..f4aac3e045 100644
--- a/sntp/sntp-opts.h
+++ b/sntp/sntp-opts.h
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (sntp-opts.h)
  *  
- *  It has been AutoGen-ed  December 17, 2012 at 11:33:38 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 11:25:46 AM by AutoGen 5.16.2
  *  From the definitions    sntp-opts.def
  *  and the template file   options
  *
@@ -90,8 +90,8 @@ typedef enum {
 } teOptIndex;
 
 #define OPTION_CT    23
-#define SNTP_VERSION       "4.2.7p335"
-#define SNTP_FULL_VERSION  "sntp 4.2.7p335"
+#define SNTP_VERSION       "4.2.7p336"
+#define SNTP_FULL_VERSION  "sntp 4.2.7p336"
 
 /*
  *  Interface defines for all options.  Replace "n" with the UPPER_CASED
diff --git a/sntp/sntp.1sntpman b/sntp/sntp.1sntpman
index 3540212ebe..1465598ca5 100644
--- a/sntp/sntp.1sntpman
+++ b/sntp/sntp.1sntpman
@@ -1,8 +1,8 @@
-.TH sntp 1sntpman "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH sntp 1sntpman "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (sntp-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:59:07 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:38 PM by AutoGen 5.16.2
 .\"  From the definitions    sntp-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/sntp/sntp.1sntpmdoc b/sntp/sntp.1sntpmdoc
index e34318cc07..6aee7a5890 100644
--- a/sntp/sntp.1sntpmdoc
+++ b/sntp/sntp.1sntpmdoc
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt SNTP 1sntpmdoc User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (sntp-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:59:14 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:45 PM by AutoGen 5.16.2
 .\"  From the definitions    sntp-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/sntp/sntp.html b/sntp/sntp.html
index 44d71f2232..96f114c76f 100644
--- a/sntp/sntp.html
+++ b/sntp/sntp.html
@@ -36,7 +36,7 @@ display the time offset of the system clock relative to the server
 clock.  Run as root, it can correct the system clock to this offset as
 well.  It can be run as an interactive command or from a cron job.
 
-  
    This document applies to version 4.2.7p335 of sntp.
+  
    This document applies to version 4.2.7p336 of sntp.
 
   
    The program implements the SNTP protocol as defined by RFC 5905, the NTPv4
 IETF specification.
@@ -170,7 +170,7 @@ the usage text by passing it through a pager program.
 used to select the program, defaulting to more.  Both will exit
 with a status code of 0.
 
-
    sntp - standard Simple Network Time Protocol client program - Ver. 4.2.7p335
+
    sntp - standard Simple Network Time Protocol client program - Ver. 4.2.7p336
 USAGE:  sntp [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
                 [ hostname-or-IP ...]
   Flg Arg Option-Name    Description
diff --git a/sntp/sntp.man.in b/sntp/sntp.man.in
index 8a85ba50bd..ada846ed5b 100644
--- a/sntp/sntp.man.in
+++ b/sntp/sntp.man.in
@@ -1,8 +1,8 @@
-.TH sntp @SNTP_MS@ "18 Dec 2012" "4.2.7p335" "User Commands"
+.TH sntp @SNTP_MS@ "21 Dec 2012" "4.2.7p336" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (sntp-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:59:07 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:38 PM by AutoGen 5.16.2
 .\"  From the definitions    sntp-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/sntp/sntp.mdoc.in b/sntp/sntp.mdoc.in
index e288d6eaef..54fe542c5a 100644
--- a/sntp/sntp.mdoc.in
+++ b/sntp/sntp.mdoc.in
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt SNTP @SNTP_MS@ User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (sntp-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:59:14 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:45 PM by AutoGen 5.16.2
 .\"  From the definitions    sntp-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/util/invoke-ntp-keygen.texi b/util/invoke-ntp-keygen.texi
index aea7651497..2fb9fd8cd0 100644
--- a/util/invoke-ntp-keygen.texi
+++ b/util/invoke-ntp-keygen.texi
@@ -6,7 +6,7 @@
 # 
 # EDIT THIS FILE WITH CAUTION  (invoke-ntp-keygen.texi)
 # 
-# It has been AutoGen-ed  December 18, 2012 at 03:58:49 AM by AutoGen 5.16.2
+# It has been AutoGen-ed  December 21, 2012 at 06:21:21 PM by AutoGen 5.16.2
 # From the definitions    ntp-keygen-opts.def
 # and the template file   agtexi-cmd.tpl
 @end ignore
@@ -928,7 +928,7 @@ with a status code of 0.
 
 @exampleindent 0
 @example
-ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p335
+ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p336
 USAGE:  ntp-keygen [ - [] | --[@{=| @}] ]...
   Flg Arg Option-Name    Description
    -b Num imbits         identity modulus bits
diff --git a/util/ntp-keygen-opts.c b/util/ntp-keygen-opts.c
index 4dfe5beb42..2eeea62493 100644
--- a/util/ntp-keygen-opts.c
+++ b/util/ntp-keygen-opts.c
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (ntp-keygen-opts.c)
  *  
- *  It has been AutoGen-ed  December 18, 2012 at 03:58:35 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 06:21:07 PM by AutoGen 5.16.2
  *  From the definitions    ntp-keygen-opts.def
  *  and the template file   options
  *
@@ -75,7 +75,7 @@ extern FILE * option_usage_fp;
  *  ntp-keygen option static const strings
  */
 static char const ntp_keygen_opt_strs[2358] =
-/*     0 */ "ntp-keygen (ntp) 4.2.7p335\n"
+/*     0 */ "ntp-keygen (ntp) 4.2.7p336\n"
             "Copyright (C) 1970-2012 The University of Delaware, all rights reserved.\n"
             "This is free software. It is licensed for use, modification and\n"
             "redistribution under the terms of the NTP License, copies of which\n"
@@ -166,14 +166,14 @@ static char const ntp_keygen_opt_strs[2358] =
 /*  2136 */ "no-load-opts\0"
 /*  2149 */ "no\0"
 /*  2152 */ "NTP_KEYGEN\0"
-/*  2163 */ "ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p335\n"
+/*  2163 */ "ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p336\n"
             "USAGE:  %s [ - [] | --[{=| }] ]...\n\0"
 /*  2279 */ "$HOME\0"
 /*  2285 */ ".\0"
 /*  2287 */ ".ntprc\0"
 /*  2294 */ "http://bugs.ntp.org, bugs@ntp.org\0"
 /*  2328 */ "\n\n\0"
-/*  2331 */ "ntp-keygen (ntp) 4.2.7p335";
+/*  2331 */ "ntp-keygen (ntp) 4.2.7p336";
 
 /*
  *  imbits option description:
diff --git a/util/ntp-keygen-opts.h b/util/ntp-keygen-opts.h
index a47e246dce..c3d71ced47 100644
--- a/util/ntp-keygen-opts.h
+++ b/util/ntp-keygen-opts.h
@@ -1,7 +1,7 @@
 /*  
  *  EDIT THIS FILE WITH CAUTION  (ntp-keygen-opts.h)
  *  
- *  It has been AutoGen-ed  December 18, 2012 at 03:58:35 AM by AutoGen 5.16.2
+ *  It has been AutoGen-ed  December 21, 2012 at 06:21:06 PM by AutoGen 5.16.2
  *  From the definitions    ntp-keygen-opts.def
  *  and the template file   options
  *
@@ -93,8 +93,8 @@ typedef enum {
 } teOptIndex;
 
 #define OPTION_CT    26
-#define NTP_KEYGEN_VERSION       "4.2.7p335"
-#define NTP_KEYGEN_FULL_VERSION  "ntp-keygen (ntp) 4.2.7p335"
+#define NTP_KEYGEN_VERSION       "4.2.7p336"
+#define NTP_KEYGEN_FULL_VERSION  "ntp-keygen (ntp) 4.2.7p336"
 
 /*
  *  Interface defines for all options.  Replace "n" with the UPPER_CASED
diff --git a/util/ntp-keygen.1ntp-keygenman b/util/ntp-keygen.1ntp-keygenman
index 88d8aeef99..255df02eac 100644
--- a/util/ntp-keygen.1ntp-keygenman
+++ b/util/ntp-keygen.1ntp-keygenman
@@ -1,8 +1,8 @@
-.TH ntp-keygen 1ntp-keygenman "18 Dec 2012" "ntp (4.2.7p335)" "User Commands"
+.TH ntp-keygen 1ntp-keygenman "21 Dec 2012" "ntp (4.2.7p336)" "User Commands"
 .\"
 .\"  EDIT THIS FILE WITH CAUTION  (ntp-keygen-opts.man)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:44 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:15 PM by AutoGen 5.16.2
 .\"  From the definitions    ntp-keygen-opts.def
 .\"  and the template file   agman-cmd.tpl
 .\"
diff --git a/util/ntp-keygen.1ntp-keygenmdoc b/util/ntp-keygen.1ntp-keygenmdoc
index 90bea45aa2..eded0ed07a 100644
--- a/util/ntp-keygen.1ntp-keygenmdoc
+++ b/util/ntp-keygen.1ntp-keygenmdoc
@@ -1,9 +1,9 @@
-.Dd December 18 2012
+.Dd December 21 2012
 .Dt NTP_KEYGEN 1ntp-keygenmdoc User Commands
 .Os SunOS 5.10
 .\"  EDIT THIS FILE WITH CAUTION  (ntp-keygen-opts.mdoc)
 .\"  
-.\"  It has been AutoGen-ed  December 18, 2012 at 03:58:51 AM by AutoGen 5.16.2
+.\"  It has been AutoGen-ed  December 21, 2012 at 06:21:23 PM by AutoGen 5.16.2
 .\"  From the definitions    ntp-keygen-opts.def
 .\"  and the template file   agmdoc-cmd.tpl
 .Sh NAME
diff --git a/util/ntp-keygen.html b/util/ntp-keygen.html
index 2c2db781da..6cb57c0edc 100644
--- a/util/ntp-keygen.html
+++ b/util/ntp-keygen.html
@@ -70,7 +70,7 @@ All other files are in PEM-encoded
 printable ASCII format so they can be embedded as MIME attachments in
 mail to other sites.
 
-  
    This document applies to version 4.2.7p335 of ntp-keygen.
+  
    This document applies to version 4.2.7p336 of ntp-keygen.
 
 
    
 
    
@@ -243,78 +243,59 @@ gethostname
 function, normally the DNS name of the host is used.
 
   
    The
-.Ar
-pw
-option of the
-.Ar
-crypto
-configuration command specifies the read
+pw option of the
+crypto configuration command specifies the read
 password for previously encrypted local files. 
 This must match the local password used by this program. 
 If not specified, the host name is used. 
 Thus, if files are generated by this program without password,
 they can be read back by
-.Ar
-ntpd
-without password but only on the same host.
+ntpd without password but only on the same host.
 
   
    Normally, encrypted files for each host are generated by that host and
 used only by that host, although exceptions exist as noted later on
 this page. 
 The symmetric keys file, normally called
-.Ar
-ntp.keys
-,
-is usually installed in
-.Pa
-/etc
+ntp.keys, is usually installed in
+/etc. 
 . 
 Other files and links are usually installed in
-.Pa
-/usr/local/etc
+/usr/local/etc,
 ,
 which is normally in a shared filesystem in
 NFS-mounted networks and cannot be changed by shared clients. 
 The location of the keys directory can be changed by the
-.Ar
-keysdir
-configuration command in such cases. 
+keysdir configuration command in such cases. 
 Normally, this is in
-.Pa
-/etc
+/etc. 
 .
 
   
    This program directs commentary and error messages to the standard
 error stream
-.Ar
-stderr
-and remote files to the standard output stream
-.Ar
-stdout
-where they can be piped to other applications or redirected to files. 
+stderr and remote files to the standard output stream
+stdout where they can be piped to other applications or redirected to files. 
 The names used for generated files and links all begin with the
 string
-.Ar
-ntpkey
-and include the file type, generating host and filestamp,
+ntpkey and include the file type, generating host and filestamp,
 as described in the
-.Dq
-Cryptographic
-Data
-Files
+CryptographicDataFiles
 section below. 
-.Ss
-Running
+
    
+
    
+
+
    
+
    
+
+
    Running
    
+
+
    Running
 the
 Program
 To test and gain experience with Autokey concepts, log in as root and
 change to the keys directory, usually
-.Pa
-/usr/local/etc
+/usr/local/etc
 When run for the first time, or if all files with names beginning with
-.Ar
-ntpkey
-have been removed, use the
+ntpkey have been removed, use the
 ntp-keygen
 command without arguments to generate a
 default RSA host key and matching RSA-MD5 certificate with expiration
@@ -358,21 +339,13 @@ After that and when the host is synchronized to a proventic source, the
 certificate should be re-generated.
 
   
    Additional information on trusted groups and identity schemes is on the
-.Dq
-Autokey
-Public-Key
-Authentication
+AutokeyPublic-KeyAuthentication
 page.
 
   
    The
 ntpd(8)
 configuration command
-.Ic
-crypto
-pw
-Ar
-password
-specifies the read password for previously encrypted files. 
+crypto pw Ar password specifies the read password for previously encrypted files. 
 The daemon expires on the spot if the password is missing
 or incorrect. 
 For convenience, if a file has been previously encrypted,
@@ -382,40 +355,23 @@ If the previous write password is specified as the host name,
 these files can be read by that host with no explicit password.
 
   
    File names begin with the prefix
-.Cm
-ntpkey_
-and end with the postfix
-.Ar
-_hostname.filestamp
-,
-where
-.Ar
-hostname
-is the owner name, usually the string returned
+ntpkey_ and end with the postfix
+_hostname.filestamp, where
+hostname is the owner name, usually the string returned
 by the Unix gethostname() routine, and
-.Ar
-filestamp
-is the NTP seconds when the file was generated, in decimal digits. 
+filestamp is the NTP seconds when the file was generated, in decimal digits. 
 This both guarantees uniqueness and simplifies maintenance
 procedures, since all files can be quickly removed
 by a
-.Ic
-rm
-ntpkey\&*
-command or all files generated
+rmntpkey\&* command or all files generated
 at a specific time can be removed by a
-.Ic
-rm
-.Ar
-\&*filestamp
-command. 
+rm \&*filestamp command. 
 To further reduce the risk of misconfiguration,
 the first two lines of a file contain the file name
 and generation date and time as comments.
 
   
    All files are installed by default in the keys directory
-.Pa
-/usr/local/etc
+/usr/local/etc,
 ,
 which is normally in a shared filesystem
 in NFS-mounted networks. 
@@ -455,8 +411,15 @@ The
 program uses the same timestamp extension for all files generated
 at one time, so each generation is distinct and can be readily
 recognized in monitoring data. 
-.Ss
-Running
+
    
+
    
+
+
    
+
    
+
+
    Running
    
+
+
    Running
 the
 program
 The safest way to run the
@@ -464,15 +427,12 @@ The safest way to run the
 program is logged in directly as root. 
 The recommended procedure is change to the keys directory,
 usually
-.Pa
-/usr/local/etc
+/usr/local/etc,
 ,
 then run the program. 
 When run for the first time,
 or if all
-.Cm
-ntpkey
-files have been removed,
+ntpkey files have been removed,
 the program generates a RSA host key file and matching RSA-MD5 certificate file,
 which is all that is necessary in many cases. 
 The program also generates soft links from the generic names
@@ -502,38 +462,23 @@ However, the identification parameter files, although encoded
 as the other files, are probably not compatible with anything other than Autokey.
 
   
    Running the program as other than root and using the Unix
-.Ic
-su
-command
+su command
 to assume root may not work properly, since by default the OpenSSL library
 looks for the random seed file
-.Cm
-.rnd
-in the user home directory. 
+.rnd in the user home directory. 
 However, there should be only one
-.Cm
-.rnd
-,
-most conveniently
+.rnd, most conveniently
 in the root directory, so it is convenient to define the
-.Cm
-$RANDFILE
-environment variable used by the OpenSSL library as the path to
-.Cm
-/.rnd
-.
-
-  
    Installing the keys as root might not work in NFS-mounted
+$RANDFILE environment variable used by the OpenSSL library as the path to
+/.rnd. 
+Installing the keys as root might not work in NFS-mounted
 shared file systems, as NFS clients may not be able to write
 to the shared keys directory, even as root. 
 In this case, NFS clients can specify the files in another
 directory such as
-.Pa
-/etc
+/etc
 using the
-.Ic
-keysdir
-command. 
+keysdir command. 
 There is no need for one client to read the keys and certificates
 of other clients or servers, as these data are obtained automatically
 by the Autokey protocol.
@@ -549,8 +494,7 @@ The owner name is also used for the host and sign key files,
 while the trusted name is used for the identity files.
 
   
    All files are installed by default in the keys directory
-.Pa
-/usr/local/etc
+/usr/local/etc,
 ,
 which is normally in a shared filesystem
 in NFS-mounted networks. 
@@ -590,8 +534,15 @@ The
 program uses the same timestamp extension for all files generated
 at one time, so each generation is distinct and can be readily
 recognized in monitoring data. 
-.Ss
-Running
+
    
+
    
+
+
    
+
    
+
+
    Running
    
+
+
    Running
 the
 program
 The safest way to run the
@@ -599,15 +550,12 @@ The safest way to run the
 program is logged in directly as root. 
 The recommended procedure is change to the keys directory,
 usually
-.Pa
-/usr/local/etc
+/usr/local/etc,
 ,
 then run the program. 
 When run for the first time,
 or if all
-.Cm
-ntpkey
-files have been removed,
+ntpkey files have been removed,
 the program generates a RSA host key file and matching RSA-MD5 certificate file,
 which is all that is necessary in many cases. 
 The program also generates soft links from the generic names
@@ -637,38 +585,23 @@ However, the identification parameter files, although encoded
 as the other files, are probably not compatible with anything other than Autokey.
 
   
    Running the program as other than root and using the Unix
-.Ic
-su
-command
+su command
 to assume root may not work properly, since by default the OpenSSL library
 looks for the random seed file
-.Cm
-.rnd
-in the user home directory. 
+.rnd in the user home directory. 
 However, there should be only one
-.Cm
-.rnd
-,
-most conveniently
+.rnd, most conveniently
 in the root directory, so it is convenient to define the
-.Cm
-$RANDFILE
-environment variable used by the OpenSSL library as the path to
-.Cm
-/.rnd
-.
-
-  
    Installing the keys as root might not work in NFS-mounted
+$RANDFILE environment variable used by the OpenSSL library as the path to
+/.rnd. 
+Installing the keys as root might not work in NFS-mounted
 shared file systems, as NFS clients may not be able to write
 to the shared keys directory, even as root. 
 In this case, NFS clients can specify the files in another
 directory such as
-.Pa
-/etc
+/etc
 using the
-.Ic
-keysdir
-command. 
+keysdir command. 
 There is no need for one client to read the keys and certificates
 of other clients or servers, as these data are obtained automatically
 by the Autokey protocol.
@@ -689,8 +622,7 @@ seconds.
 Each cryptographic configuration involves selection of a signature scheme
 and identification scheme, called a cryptotype,
 as explained in the
-.Sx
-Authentication
+AuthenticationAuthentication
 Options
 section of
 ntp.conf(5). 
@@ -707,8 +639,7 @@ A trusted group is the set of all hosts that have, directly or indirectly,
 a certificate trail ending at a trusted host. 
 The trail is defined by static configuration file entries
 or dynamic means described on the
-.Sx
-Automatic
+AutomaticAutomatic
 NTP
 Configuration
 Options
@@ -717,9 +648,7 @@ section of
 
   
    On each trusted host as root, change to the keys directory. 
 To insure a fresh fileset, remove all
-.Cm
-ntpkey
-files. 
+ntpkey files. 
 Then run
 ntp-keygen
 -T to generate keys and a trusted certificate. 
@@ -735,24 +664,15 @@ scheme than the default, run
 ntp-keygen
 with the
 -S -Ar -type option, where
-.Ar
-type
-is either
-.Cm
-RSA
-or
-.Cm
-DSA
-. 
-The most often need to do this is when a DSA-signed certificate is used. 
+type is either
+RSA or
+DSA. The most often need to do this is when a DSA-signed certificate is used. 
 If it is necessary to use a different certificate scheme than the default,
 run
 ntp-keygen
 with the
 -c -Ar -scheme option and selected
-.Ar
-scheme
-as needed. 
+scheme as needed. 
 f
 ntp-keygen
 is run again without these options, it generates a new certificate
@@ -772,16 +692,21 @@ When
 is restarted, it loads any new files and restarts the protocol. 
 Other dependent hosts will continue as usual until signatures are refreshed,
 at which time the protocol is restarted. 
-.Ss
-Identity
+
    
+
    
+
+
    
+
    
+
+
    Identity
    
+
+
    Identity
 Schemes
 As mentioned on the Autonomous Authentication page,
 the default TC identity scheme is vulnerable to a middleman attack. 
 However, there are more secure identity schemes available,
 including PC, IFF, GQ and MV described on the
-.Qq
-Identification
-Schemes
+"IdentificationSchemes"
 page
 (maybe available at
 .Li
@@ -810,14 +735,12 @@ only as clients have key files that contain only client keys.
 On trusted host alice run
 ntp-keygen
 -P -p -Ar -password to generate the host key file
-.Pa
-ntpkey_RSAkey_
+ntpkey_RSAkey_NsAralice.filestamp
 Ns
 Ar
 alice.filestamp
 and trusted private certificate file
-.Pa
-ntpkey_RSA-MD5_cert_
+ntpkey_RSA-MD5_cert_NsAralice.filestamp. 
 Ns
 Ar
 alice.filestamp
@@ -825,14 +748,12 @@ alice.filestamp
 Copy both files to all group hosts;
 they replace the files which would be generated in other schemes. 
 On each host bob install a soft link from the generic name
-.Pa
-ntpkey_host_
+ntpkey_host_NsArbob
 Ns
 Ar
 bob
 to the host key file and soft link
-.Pa
-ntpkey_cert_
+ntpkey_cert_NsArbob
 Ns
 Ar
 bob
@@ -849,8 +770,7 @@ generate the IFF parameter file.
 On trusted host alice run
 ntp-keygen
 -T -I -p -Ar -password to produce her parameter file
-.Pa
-ntpkey_IFFpar_
+ntpkey_IFFpar_NsAralice.filestamp,
 Ns
 Ar
 alice.filestamp
@@ -858,8 +778,7 @@ alice.filestamp
 which includes both server and client keys. 
 Copy this file to all group hosts that operate as both servers
 and clients and install a soft link from the generic
-.Pa
-ntpkey_iff_
+ntpkey_iff_NsAralice
 Ns
 Ar
 alice
@@ -878,8 +797,7 @@ After generating the parameter file, on alice run
 -e and pipe the output to a file or mail program. 
 Copy or mail this file to all restricted clients. 
 On these clients install a soft link from the generic
-.Pa
-ntpkey_iff_
+ntpkey_iff_NsAralice
 Ns
 Ar
 alice
@@ -893,8 +811,7 @@ in the group, generate the IFF parameter file.
 On trusted host alice run
 ntp-keygen
 -T -G -p -Ar -password to produce her parameter file
-.Pa
-ntpkey_GQpar_
+ntpkey_GQpar_NsAralice.filestamp,
 Ns
 Ar
 alice.filestamp
@@ -902,16 +819,14 @@ alice.filestamp
 which includes both server and client keys. 
 Copy this file to all group hosts and install a soft link
 from the generic
-.Pa
-ntpkey_gq_
+ntpkey_gq_NsAralice
 Ns
 Ar
 alice
 to this file. 
 In addition, on each host bob install a soft link
 from generic
-.Pa
-ntpkey_gq_
+ntpkey_gq_NsArbob
 Ns
 Ar
 bob
@@ -926,36 +841,23 @@ and bob one of her clients.
 On TA trish run
 ntp-keygen
 -V -Ar -n -p -Ar -password, where
-.Ar
-n
-is the number of revokable keys (typically 5) to produce
+n is the number of revokable keys (typically 5) to produce
 the parameter file
-.Pa
-ntpkeys_MVpar_
+ntpkeys_MVpar_NsArtrish.filestamp
 Ns
 Ar
 trish.filestamp
 and client key files
-.Pa
-ntpkeys_MVkeyd_
+ntpkeys_MVkeyd_NsArtrish.filestamp
 Ns
 Ar
 trish.filestamp
 where
-.Ar
-d
-is the key number (0 \&<
-.Ar
-d
-\&<
-.Ar
-n
-)
-. 
-Copy the parameter file to alice and install a soft link
+d is the key number (0 \&<
+d \&<
+n). Copy the parameter file to alice and install a soft link
 from the generic
-.Pa
-ntpkey_mv_
+ntpkey_mv_NsAralice
 Ns
 Ar
 alice
@@ -966,24 +868,28 @@ It doesn't matter which client key file goes to alice,
 since they all work the same way. 
 Alice copies the client key file to all of her cliens. 
 On client bob install a soft link from generic
-.Pa
-ntpkey_mvkey_
+ntpkey_mvkey_NsArbob
 Ns
 Ar
 bob
 to the client key file. 
 As the MV scheme is independent of keys and certificates,
 these files can be refreshed as needed. 
-.Ss
-Command
+
    
+
    
+
+
    
+
    
+
+
    Command
    
+
+
    Command
 Line
 Options
      
    
 
    Fl
    Select certificate message digest/signature encryption scheme. 
 The
-.Ar
-scheme
-can be one of the following:
+scheme can be one of the following:
 . 
 Cm
 RSA-MD2
@@ -1001,16 +907,10 @@ RSA-RIPEMD160
 DSA-SHA
 ,
 or
-.Cm
-DSA-SHA1
-. 
-Note that RSA schemes must be used with a RSA sign key and DSA
+DSA-SHA1. Note that RSA schemes must be used with a RSA sign key and DSA
 schemes must be used with a DSA sign key. 
 The default without this option is
-.Cm
-RSA-MD5
-. 
-
    Fl
    Enable debugging. 
+RSA-MD5. 
    Fl
    Enable debugging. 
 This option displays the cryptographic data produced in eye-friendly billboards. 
 
    Fl
    Write the IFF client keys to the standard output. 
 This is intended for automatic key distribution by mail. 
@@ -1023,34 +923,33 @@ If the GQ parameters do not yet exist, create them first.
 
    Fl
    Generate parameters for the IFF identification scheme,
 obsoleting any that may exist. 
 
    Fl
    Set the suject name to
-.Ar
-name
-. 
-This is used as the subject field in certificates
+name. This is used as the subject field in certificates
 and in the file name for host and sign keys. 
 
    Fl
    Generate MD5 keys, obsoleting any that may exist. 
 
    Fl
    Generate a private certificate. 
 By default, the program generates public certificates. 
 
    Fl
    Encrypt generated files containing private data with
-.Ar
-password
-and the DES-CBC algorithm. 
+password and the DES-CBC algorithm. 
 
    Fl
    Set the password for reading files to password. 
 
    Fl
    Generate a new sign key of the designated type,
 obsoleting any that may exist. 
 By default, the program uses the host key as the sign key. 
 
    Fl
    Set the issuer name to
-.Ar
-name
-. 
-This is used for the issuer field in certificates
+name. This is used for the issuer field in certificates
 and in the file name for identity files. 
 
    Fl
    Generate a trusted certificate. 
 By default, the program generates a non-trusted certificate. 
 
    Fl
    Generate parameters and keys for the Mu-Varadharajan (MV) identification scheme.
 
-     
    .Ss
-Random
+
    
+
    
+
+
    
+
    
+
+
    Random
    
+
+     
    Random
 Seed
 File
 All cryptographically sound key generation schemes must have means
@@ -1064,7 +963,7 @@ program.
 If a site supports OpenSSL or its companion OpenSSH,
 it is very likely that means to do this are already available.
 
-     
    It is important to understand that entropy must be evolved
+       
    It is important to understand that entropy must be evolved
 for each generation, for otherwise the random number sequence
 would be predictable. 
 Various means dependent on external events, such as keystroke intervals,
@@ -1072,23 +971,16 @@ can be used to do this and some systems have built-in entropy sources.
 Suitable means are described in the OpenSSL software documentation,
 but are outside the scope of this page.
 
-     
    The entropy seed used by the OpenSSL library is contained in a file,
+       
    The entropy seed used by the OpenSSL library is contained in a file,
 usually called
-.Cm
-.rnd
-,
-which must be available when starting the NTP daemon
+.rnd, which must be available when starting the NTP daemon
 or the
 ntp-keygen
 program. 
 The NTP daemon will first look for the file
 using the path specified by the
-.Ic
-randfile
-subcommand of the
-.Ic
-crypto
-configuration command. 
+randfile subcommand of the
+crypto configuration command. 
 If not specified in this way, or when starting the
 ntp-keygen
 program,
@@ -1103,14 +995,19 @@ If the
 RANDFILE
 environment variable is not present,
 the library will look for the
-.Cm
-.rnd
-file in the user home directory. 
+.rnd file in the user home directory. 
 If the file is not available or cannot be written,
 the daemon exits with a message to the system log and the program
 exits with a suitable error message. 
-.Ss
-Cryptographic
+
    
+
    
+
+
    
+
    
+
+
    Cryptographic
    
+
+     
    Cryptographic
 Data
 Files
 All other file formats begin with two lines. 
@@ -1126,7 +1023,7 @@ Cryptographic values are encoded first using ASN.1 rules,
 then encrypted if necessary, and finally written PEM-encoded
 printable ASCII format preceded and followed by MIME content identifier lines.
 
-     
    The format of the symmetric keys file is somewhat different
+       
    The format of the symmetric keys file is somewhat different
 than the other files in the interest of backward compatibility. 
 Since DES-CBC is deprecated in NTPv4, the only key format of interest
 is MD5 alphanumeric strings. 
@@ -1138,23 +1035,16 @@ keyno
 type
 key
 where
-.Ar
-keyno
-is a positive integer in the range 1-65,535,
-.Ar
-type
-is the string MD5 defining the key format and
-.Ar
-key
-is the key itself,
+keyno is a positive integer in the range 1-65,535,
+type is the string MD5 defining the key format and
+key is the key itself,
 which is a printable ASCII string 16 characters or less in length. 
 Each character is chosen from the 93 printable characters
 in the range 0x21 through 0x7f excluding space and the
-.Ql
 #
 character.
 
-     
    Note that the keys used by the
+       
    Note that the keys used by the
 ntpq(8)
 and
 ntpdc(8)
@@ -1163,11 +1053,10 @@ are checked against passwords requested by the programs
 and entered by hand, so it is generally appropriate to specify these keys
 in human readable ASCII format.
 
-     
    The
+       
    The
 ntp-keygen
 program generates a MD5 symmetric keys file
-.Pa
-ntpkey_MD5key_
+ntpkey_MD5key_NsArhostname.filestamp. 
 Ns
 Ar
 hostname.filestamp
@@ -1176,8 +1065,7 @@ Since the file contains private shared keys,
 it should be visible only to root and distributed by secure means
 to other subnet hosts. 
 The NTP daemon loads the file
-.Pa
-ntp.keys
+ntp.keys,
 ,
 so
 ntp-keygen
@@ -1192,7 +1080,7 @@ and
 ntpdc(8)
 utilities.
 
-     
    This section was generated by AutoGen,
+       
    This section was generated by AutoGen,
 using the agtexi-cmd template and the option descriptions for the ntp-keygen program. 
 This software is released under the NTP license, <http://ntp.org/license>.
 
@@ -1227,7 +1115,7 @@ This software is released under the NTP license, <http://ntp.org/license>.
 
    
 
    
 Next: ,
-Up: ntp-keygen Invocation
+Up: Cryptographic
 
    
 
    
 
@@ -1244,7 +1132,7 @@ the usage text by passing it through a pager program.
 used to select the program, defaulting to more.  Both will exit
 with a status code of 0.
 
-     
         ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p334
+     
         ntp-keygen (ntp) - Create a NTP host key - Ver. 4.2.7p335
      USAGE:  ntp-keygen [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
        Flg Arg Option-Name    Description
         -b Num imbits         identity modulus bits
@@ -1298,7 +1186,7 @@ with a status code of 0.
 
    
 Next: ,
 Previous: ntp-keygen usage,
-Up: ntp-keygen Invocation
+Up: Cryptographic
 
    
 
    
 
@@ -1318,7 +1206,7 @@ This option takes an argument number imbits.
 
    
 Next: ,
 Previous: ntp-keygen imbits,
-Up: ntp-keygen Invocation
+Up: Cryptographic
 
    
 
    
 
@@ -1345,7 +1233,7 @@ this option is RSA-MD5.
 
    
 Next: ,
 Previous: ntp-keygen certificate,
-Up: ntp-keygen Invocation
+Up: Cryptographic
    @@ -1368,7 +1256,7 @@ available in "openssl -h" output.

    Next: , Previous: ntp-keygen cipher, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1388,7 +1276,7 @@ intended for automatic key distribution by mail.

    Next: , Previous: ntp-keygen id-key, -Up: ntp-keygen Invocation +Up: Cryptographic
    • @@ -1408,7 +1296,7 @@ obsoleting any that may exist.

    Next: , Previous: ntp-keygen gq-params, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1427,7 +1315,7 @@ This is the “generate rsa host key” option.

    Next: , Previous: ntp-keygen host-key, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1447,7 +1335,7 @@ any that may exist.

    Next: , Previous: ntp-keygen iffkey, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1474,7 +1362,7 @@ names in the form host

    Next: , Previous: ntp-keygen ident, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1494,7 +1382,7 @@ This option takes an argument number lifetime.

    Next: , Previous: ntp-keygen lifetime, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1507,7 +1395,7 @@ Generate MD5 keys, obsoleting any that may exist.

    Next: , Previous: ntp-keygen md5key, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1527,7 +1415,7 @@ This option takes an argument number modulus.

    Next: , Previous: ntp-keygen modulus, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1547,7 +1435,7 @@ public certificates.

    Next: , Previous: ntp-keygen pvt-cert, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1568,7 +1456,7 @@ password and the cipher selected with -C/–cipher.

    Next: , Previous: ntp-keygen pvt-passwd, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1588,7 +1476,7 @@ This option takes an argument string passwd.

    Next: , Previous: ntp-keygen get-pvt-passwd, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1610,7 +1498,7 @@ sign key.

    Next: , Previous: ntp-keygen sign-key, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1639,7 +1527,7 @@ of IFF, GQ, and MV client parameter files.

    Next: , Previous: ntp-keygen subject-name, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1659,7 +1547,7 @@ a non-trusted certificate.

    Next: , Previous: ntp-keygen trusted-cert, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1680,7 +1568,7 @@ identification scheme.

    Next: , Previous: ntp-keygen mv-params, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1701,7 +1589,7 @@ This option takes an argument number num.

    Next: , Previous: ntp-keygen mv-keys, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1773,7 +1661,7 @@ first letter of the argument is examined:

    Next: , Previous: ntp-keygen config, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1791,7 +1679,7 @@ it to autogen-users@lists.sourceforge.net. Thank you.

    Next: , Previous: ntp-keygen exit status, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1811,7 +1699,7 @@ as the write password by default.

    Next: , Previous: ntp-keygen Usage, -Up: ntp-keygen Invocation +Up: Cryptographic
    @@ -1822,7 +1710,7 @@ Portions of this document came from FreeBSD.

    Previous: ntp-keygen Notes, -Up: ntp-keygen Invocation +Up: Cryptographic
    diff --git a/util/ntp-keygen.man.in b/util/ntp-keygen.man.in index 7aa76ec995..8894a8697b 100644 --- a/util/ntp-keygen.man.in +++ b/util/ntp-keygen.man.in @@ -1,8 +1,8 @@ -.TH ntp-keygen @NTP_KEYGEN_MS@ "18 Dec 2012" "ntp (4.2.7p335)" "User Commands" +.TH ntp-keygen @NTP_KEYGEN_MS@ "21 Dec 2012" "ntp (4.2.7p336)" "User Commands" .\" .\" EDIT THIS FILE WITH CAUTION (ntp-keygen-opts.man) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:58:44 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:21:15 PM by AutoGen 5.16.2 .\" From the definitions ntp-keygen-opts.def .\" and the template file agman-cmd.tpl .\" diff --git a/util/ntp-keygen.mdoc.in b/util/ntp-keygen.mdoc.in index 08e8be9c66..7e3ef9aaa3 100644 --- a/util/ntp-keygen.mdoc.in +++ b/util/ntp-keygen.mdoc.in @@ -1,9 +1,9 @@ -.Dd December 18 2012 +.Dd December 21 2012 .Dt NTP_KEYGEN @NTP_KEYGEN_MS@ User Commands .Os SunOS 5.10 .\" EDIT THIS FILE WITH CAUTION (ntp-keygen-opts.mdoc) .\" -.\" It has been AutoGen-ed December 18, 2012 at 03:58:51 AM by AutoGen 5.16.2 +.\" It has been AutoGen-ed December 21, 2012 at 06:21:23 PM by AutoGen 5.16.2 .\" From the definitions ntp-keygen-opts.def .\" and the template file agmdoc-cmd.tpl .Sh NAME