10

I have a CentOS 6.4 server, it does not have any iptable rules, it runs NTP daemon as service using the following configuration:

  driftfile /var/lib/ntp/drift

  server 0.pool.ntp.org
  server 1.pool.ntp.org
  server 2.pool.ntp.org
  server 3.pool.ntp.org

  restrict default ignore
  restrict 127.0.0.1

When I run ntpq to query peers, the following response is received:

ntpq> peers
localhost.localdomain: timed out, nothing received

dig shows that:

localhost.localdomain.  86400   IN  A   127.0.0.1

Why doesn't ntp query work?

5
  • 2
    Do you have a local IPtables running?
    – user192911
    Dec 2, 2013 at 7:08
  • iptable is running, but there isnt any rule.
    – Howard
    Dec 2, 2013 at 7:10
  • 1
    And ntp-daemon is actually running? Try grep ntp /var/log* to see if there are some notices which might help?
    – user192911
    Dec 2, 2013 at 7:27
  • are you able to ping 0.pool.ntp.org and others in the list ? Dec 2, 2013 at 8:42
  • Do you have an entry for localhost or localhost.localdomain in /etc/hosts? The system will look here first, before checking DNS.
    – user215543
    Apr 8, 2014 at 11:26

5 Answers 5

11

On RHEL / CentOS 6 and 7, for whatever reason ntpq tries to query the IPv6 loopback at ::1 instead of the IPv4 loopback at 127.0.0.1. With this in mind, I added this line to my /etc/ntp.conf file:

restrict ::1

Saved the file then restarted ntpd

service ntpd restart

now the command:

ntpq -p

works as expected. (This is the same as running ntpq in command-line mode and then issuing the peers command.)

I prefer this solution since you do not have to enable communications with ntpd via a potentially public Ethernet interface, which may be a security concern.

2

I was expecting ntpq to query local server via 127.0.0.1, but it turns out to be querying local server via ethernet network interface.

Although I have no idea why a local ntp query would have to go through ethernet, but in configuration file I added

restrict <eht0 ip address>

And now NTP works fine.

1
  • Is this actually safe? Ie would that give public access somehow?
    – Tuinslak
    Dec 28, 2016 at 7:32
0

When read the second answer, I realize the reason of this issue which maybe on /etc/hosts. Then add localhost on /etc/hosts and retry, it works.

127.0.0.1       localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Before:

ems@rack6-storage-2:~$ sudo service ntp stop ; sudo ntpdate 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org ; sudo service ntp start ; PATH=/usr/bin:/usr/sbin ntpdc -p
 * Stopping NTP server ntpd
   ...done.
18 Dec 08:18:31 ntpdate[35729]: adjust time server 202.156.0.34 offset -0.000467 sec
 * Starting NTP server ntpd
   ...done.
localhost.sdcorp.global.sandisk.com: timed out, nothing received
***Request timed out

After:

ems@rack6-storage-2:~$ sudo vim /etc/hosts
ems@rack6-storage-2:~$ sudo service ntp stop ; sudo ntpdate 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org ; sudo service ntp start ; PATH=/usr/bin:/usr/sbin ntpdc -p
 * Stopping NTP server ntpd
   ...done.
18 Dec 08:27:09 ntpdate[36056]: adjust time server 202.156.0.34 offset 0.015872 sec
 * Starting NTP server ntpd
   ...done.
     remote           local      st poll reach  delay   offset    disp
=======================================================================
=golem.canonical 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=frontier.innola 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=sg01.7asecond.c 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=time2.maxonline 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=pontoon.latt.ne 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
0

Disable IPv6 if you do not use it, add the following in interface configuration file:

# cat /etc/sysconfig/network-scripts/ifcfg-eth0           
....
IPV6INIT="no"
....

Then apply via restarting network and ntpd services. This helped to me.

-2

People should read more carefully given configs before they are suggesting "reinstall". The mistake is very obvious.

From what I see, you have configured an NTP SERVER but you are pointing that to a POOL

server 0.pool.ntp.org

Try

pool 0.pool.ntp.org

instead or use "server" with a dedicated server, not a pool.

1
  • 2
    That just shouldn't matter, as the pool directive just resolves more IP addresses behind the 0.pool.ntp.org alias, where as the server directive just resolves one address from DNS and sticks to it.
    – Thomas
    Apr 12, 2017 at 8:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .