Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

NTPd listens on UDP port 123 (all IP addresses), by default. Is this necessary for just updating the server time?

If it's necessary to listen on an address, what single address should be used? The possible addresses it can listen on are:

  • 127.0.0.1
  • server IP
  • ::1 (IPv6)
  • server IP (IPv6)

Why does it even have to listen on localhost (127.0.0.1 and ::1)? Nobody can reach the server on that address.


To bind NTPd to a single address, the -I option can be used. For my Debian box, I had to edit /etc/default/ntp, and replace -g by:

-g -I 1.2.3.4 -I 127.0.0.1

This causes NTPd to listen on the public address 1.2.3.4 (replace it by your own) and 127.0.0.1.

share|improve this question
1  
But it still listens on 0.0.0.0:123 with this config. –  Ian Feb 5 '13 at 14:33
1  
@Ian I found that out a few days ago when checking the output of netstat. See serverfault.com/a/475639/51929 –  Lekensteyn Feb 5 '13 at 14:48

2 Answers 2

up vote 1 down vote accepted

Listening on localhost makes sense if you want to run to queries on the local box. For examle, ntpq -p localhost will query the ntp service running on your local box.

In general you probably want ntpd to listen on all real addresses that it needs to send or receive updates on. If you are running ipv6 you need to list the ipv6 addresses as well, otherwise just list the real server ip addresses and ipv4 localhost.

share|improve this answer
    
So it's sufficient to listen on one public IPv4 address and 127.0.0.1 ? –  Lekensteyn Feb 17 '11 at 18:57
    
Yes, unless the machine is a router which gets time updates form the outside world and acts as an ntp server for your local network. Then you would want to listen on both inside and outside ip addresses. –  Phil Hollenback Feb 17 '11 at 19:02
    
Thank you, the server receives updates only, it is not a NTP server. –  Lekensteyn Feb 17 '11 at 19:09

If you just want to update the local time you should probably restrict access to the server, since ntpd doesn't support configuring the listen adresses.

First thing to configure is the default policy. You can either block all communication not enabled afterwards, but remember that restrictions work for client and server bothway.

restrict default ignore
# Allow access to localhost
restrict 127.0.0.1
restrict IP.OF.UPSTREAM.SERVER

Or you could allow the exchange of time by default and allow querying the server only to the localhost:

restrict -4 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1

Also ntpd allows chosing the interface it runs on via the -I switch. If you are running Debian you can simply add that -I switch to the NTPD_OPTS variable in /etc/defaults/ntpd.

ntpd -I eth0
share|improve this answer
    
ntpd does allow me to choose the listen address, using the -I option. See the bottom of my answer. –  Lekensteyn Feb 17 '11 at 20:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.