Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On ubuntu server my usual solution is just to install the ntp package and call it a day. This installs all the binaries I need and has ntpd start at boot time.

Right now I'm working on a server configuration that will be replicated across many servers, and in general needs to be as lean as possible. I'm noticing that in the default configuration for ntpd, requests can be made to the server to ask it what time it is. I don't need this. I only need the server's own time to be kept up to date.

share|improve this question
    
Your server should have a firewall blocking by default; thus the ntpd service should never get any requests unless you explicitly open the firewall. –  Chris S Aug 11 '10 at 14:43
    
Sure, but I'd like to get the config as tight as possible independent of the firewall. (and right now during development we haven't set up a firewall yet) –  John Bachir Aug 11 '10 at 14:46

3 Answers 3

up vote 3 down vote accepted

ntpdate as a cron job is NOT a substitute for ntpd as stated above.

If you are replicating this configuration accross many servers, why won't you just comment out the lines in ntpd.conf that serve time then repackage, or use some configuration management like puppet to push it to all the boxes once they have an OS on them?

share|improve this answer
    
that's the fallback solution, it just seems excessive to fire up an entire binary that has a full stack of server functionality and then comment-out all the server functionality. –  John Bachir Aug 11 '10 at 14:34
1  
Understood, it feels like overkill but is almost certainly the best practice. –  matt Aug 11 '10 at 14:45
1  
+1, The computer I'm on right now ntpd is using 1980K of RAM and is averaging 6 second of processor time per day. –  Chris S Aug 11 '10 at 20:32

You could try the OpenBSD implementation, OpenNTPD; although it's been criticised for not fully implementing the NTP protocol (and perhaps somewhat fudging it), it's possibly a better fit than the official ntpd.

share|improve this answer

So it seems there is no way to get all the ntpd functionality without ntpd. So I'm just running that with these modifications to /etc/ntp.conf. Do I still need those last two lines?

# Commenting out these lines that came standard
# # By default, exchange time with everybody, but don't allow configuration.                     
# restrict -4 default kod notrap nomodify nopeer noquery                                         
# restrict -6 default kod notrap nomodify nopeer noquery                                         

# Adding this one line
restrict default ignore

# Do I still need this? Does ntpd query itself when setting the local server's time?
# Local users may interrogate the ntp server more closely.                                       
restrict 127.0.0.1
restrict ::1
share|improve this answer
1  
hmm, maybe i should be modifying my original question... –  John Bachir Aug 11 '10 at 14:44
    
Keep the last two lines: they do not hurt and let you locally monitor (ntpq) and reconfigure (ntpdc) the ntpd. –  marcoc Oct 26 '10 at 15:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.