2

NTP version installed: ntp-4.2.6p5-5

I'm trying to understand the usage and meaning of the ntp restrict along with restrict default nopeer

Quoting the NTP documentation:

nopeer: Deny packets that might mobilize an association unless authenticated. This includes broadcast, symmetric-active and manycast server packets when a configured association does not exist. It also includes pool associations, so if you want to use servers from a pool directive and also want to use nopeer by default, you'll want a "restrict source ..." line as well that does not include the nopeer directive. Note that this flag does not apply to packets that do not attempt to mobilize an association.

Does it mean, when we are using restrict default nopeer, we can't associate peers without authentication. (without using keys) ?

Consider the following scenario:

Server config: ip- 10.12.12.12

[root@sdp_1 ~]# cat /etc/ntp.conf

server 10.12.10.53
    #restrict default kod nomodify nopeer noquery notrap
    #restrict -6 default kod nomodify nopeer noquery notrap
    #restrict 127.0.0.1
    #restrict -6 ::1
    restrict default nopeer
    keys /etc/ntp/keys

Peer config: ip- 10.12.12.11

[root@sdp_2 ~]# cat /etc/ntp.conf

#server 10.12.10.53
#restrict default kod nomodify nopeer noquery notrap
#restrict -6 default kod nomodify nopeer noquery notrap
#restrict 127.0.0.1  
#restrict -6 ::1
restrict default nopeer
peer 10.12.12.12 minpoll 4
keys /etc/ntp/keys

Still i can see PEER associations at 10.12.12.11 as below:

ntpq> associations

ind assid status  conf reach auth condition  last_event cnt
===========================================================
  1 48387  961a   yes   yes  none  sys.peer    sys_peer  1
ntpq>

[root@sdp_2 ~]# ntpq -np
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*10.12.12.12    10.12.10.53     5 u   13   16  377    0.211    8.953   0.842

Are my assumptions are right ?

2 Answers 2

1

On your 10.12.12.11 system, you have used the config

peer 10.12.12.12 minpoll 4

This attempts to set up a two-way NTP relationship, i.e. 10.12.12.11 will use 10.12.12.12 as a time source, but it will also cause 10.12.12.11 to tell 10.12.12.12: "hey, you can use me as a server too if you wish".

Without the restrict default nopeer, after both systems had NTP running for a while, you would also see 10.12.12.11 as a remote NTP source in ntpq -np listing of 10.12.12.12. Since 10.12.12.11 has only 10.12.12.12 as its NTP source, 10.12.12.12 would still prefer 10.12.10.53 because of its better stratum value, but if connection to 10.12.10.53 was lost, then 10.12.12.12 and 10.12.12.11 would both cross-check with each other to minimize time errors. (Or if 10.12.12.11 was evil, it could use this two-way relationship to skew 10.12.12.12's clock further and further away from true time.)

The restrict default nopeer on 10.12.12.12 tells it to not trust any NTP server that offers a two-way NTP relationship unless it is successfully authenticated (or explicitly listed in 10.12.12.12's ntp.conf), so it becomes a one-way client-server relationship instead. So 10.12.12.11 still gets its time from 10.12.12.12, but if 10.12.12.12 loses its connection to 10.12.10.53, it will not cross-check with 10.12.12.11 and will rely on its own timekeeping only until connection to 10.12.10.53 is restored.

0

The following is from man ntp_aac:

A default entry is also always present, though if it is otherwise unconfigured; no flags are associated with the default entry (i.e., everything besides your own NTP server is unrestricted).

Since the logic of ntp conf, restrict actually means permit. restrict default nomodify notrap nopeer noquery means does not permit any entry modify\trap\peer\query to this daemon. Even though this statement is omitted, it still comes into action.

4
  • If that is the case, in the above scenario I've configured restrict default nopeer ,and expecting peer association should not permit, Right? Feb 12, 2019 at 12:25
  • right. Unless you have other ristrict without nopeer, then that one is allowed to peer
    – Tiina
    Feb 13, 2019 at 6:51
  • @Tina, In above scenario which i tried, I've used only one 'restrict default nopeer' and remaining conf is commented... Feb 14, 2019 at 10:48
  • what does it mean to nopeer?
    – Avv
    Sep 15, 2022 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .