Add access restrictions to ntpd

gogol

I would add the line:

restrict default kod nomodify notrap nopeer

to the ntpd.conf for security, so users are unable to modify the daemon.

jimp

Here ya go:

https://github.com/bsdperimeter/pfsense/commit/7b27db030c373778a727195e77928e7301b4c6d6
(added a -6 line too)

johnpoz

so that modifies the default - what if we don't want the same settings as him ;)

Can we get some method to edit these types of restrictions - there was another thread where someone was asking for that as well. I currently don't have any issues with those settings currently. But other users might.

jimp

patches accepted…

If someone wants to make gui knobs, have at it. :-)

gogol

@jimp:

Here ya go:

https://github.com/bsdperimeter/pfsense/commit/7b27db030c373778a727195e77928e7301b4c6d6
(added a -6 line too)

According to the manual a -6 line is not necessary:http://www.eecis.udel.edu/~mills/ntp/html/access.html

A default entry (address 0.0.0.0, mask 0.0.0.0 for IPv4 and address :: mask :: for IPv6) is always the first entry in the list. restrict default, with no mask option, modifies both IPv4 and IPv6 default entries.

Thanks for the modification. I will try to dive into it how to change settings in the GUI.

jimp

Other pages specifically mention requiring it, and it doesn't seem to hurt, so better safe than sorry.

But if someone wants to test it, feel free…

charliem

@jimp:

patches accepted…

If someone wants to make gui knobs, have at it. :-)

I've done some minimal additions to generate offset and frequency graphs with rrdtool, for testing the 2.1 ntp daemon. I can supply the shell lines to generate the ntpd stats (below), but I'm not too sure I could integrate rrdtool ntp info into the existing GUI rddtool graphs. Would be great to be able to track the performance of your ntpd server with a tab on the RRD graph page. Where are the RRD databases first initialized? Need to create one before using script below.

BTW, I noticed ntpd offset swings of about -600 to +700 microseconds with /usr/local/bin/ntpd (running 2.1snapshot ova in virtual box, syncing to a stratum 1 server on a local subnet). The swings went down to -150 to +150 microseconds when I reverted to /usr/bin/ntpd.

SImple shell script for offset & frequency; change as needed:


#!/bin/sh
counter=1
while [ "$counter" -ne 0 ]
do
DATA=`ntpdc -c kerninfo | awk '/^pll offset/ {printf $3*1000000}; /pll frequency/ {printf ":"$3}'`
#echo ${DATA}
/usr/bin/nice -n 20 /usr/local/bin/rrdtool update /var/db/rrd/ntp_stats.rrd N:${DATA}
sleep 60
done