NTP version installed: ntp-4.2.6p5-5

I'm trying to understand the usage and meaning of the ntp restrict along with restrict default nopeer

Quoting the NTP documentation:

nopeer: Deny packets that might mobilize an association unless authenticated. This includes broadcast, symmetric-active and manycast server packets when a configured association does not exist. It also includes pool associations, so if you want to use servers from a pool directive and also want to use nopeer by default, you'll want a "restrict source ..." line as well that does not include the nopeer directive. Note that this flag does not apply to packets that do not attempt to mobilize an association.

Does it mean, when we are using restrict default nopeer, we can't associate peers without authentication. (without using keys) ?

Consider the following scenario:

Server config: ip-

[root@sdp_1 ~]# cat /etc/ntp.conf

    #restrict default kod nomodify nopeer noquery notrap
    #restrict -6 default kod nomodify nopeer noquery notrap
    #restrict -6 ::1
    restrict default nopeer
    keys /etc/ntp/keys

Peer config: ip-

[root@sdp_2 ~]# cat /etc/ntp.conf

#restrict default kod nomodify nopeer noquery notrap
#restrict -6 default kod nomodify nopeer noquery notrap
#restrict -6 ::1
restrict default nopeer
peer minpoll 4
keys /etc/ntp/keys

Still i can see PEER associations at as below:

ntpq> associations

ind assid status  conf reach auth condition  last_event cnt
  1 48387  961a   yes   yes  none  sys.peer    sys_peer  1

[root@sdp_2 ~]# ntpq -np
     remote           refid      st t when poll reach   delay   offset  jitter
*     5 u   13   16  377    0.211    8.953   0.842

Are my assumptions are right ?


The following is from man ntp_aac:

A default entry is also always present, though if it is otherwise unconfigured; no flags are associated with the default entry (i.e., everything besides your own NTP server is unrestricted).

Since the logic of ntp conf, restrict actually means permit. restrict default nomodify notrap nopeer noquery means does not permit any entry modify\trap\peer\query to this daemon. Even though this statement is omitted, it still comes into action.

  • If that is the case, in the above scenario I've configured restrict default nopeer ,and expecting peer association should not permit, Right? – Sandeeph Ramdass Feb 12 '19 at 12:25
  • right. Unless you have other ristrict without nopeer, then that one is allowed to peer – Tiina Feb 13 '19 at 6:51
  • @Tina, In above scenario which i tried, I've used only one 'restrict default nopeer' and remaining conf is commented... – Sandeeph Ramdass Feb 14 '19 at 10:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.