9

I have a clean Debian 7 installation, and I manually entered the following lines in /etc/ntp.conf:

interface ignore wildcard
interface listen <local_nic_ip>

Hoping that NTP will no longer listen on UDP6, but after a restart, it still does:

5:udp        0      0 <local_nic_ip>:123       0.0.0.0:*                           9172/ntpd       
6:udp        0      0 127.0.0.1:123           0.0.0.0:*                           9172/ntpd       
8:udp6       0      0 ::1:123                 :::*                                9172/ntpd

The command line of NTP shows nothing unusual:

/usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 121:130

How to stop NTP from listening on that UDP6 port?

3
  • What is your problem with listening? Isnt it enough for you if ntpd uses ipv4 for DNS resolution? Im asking this as ntpd will always bind to all wildcard addressess. But you can specify IPv4 only DNS, use firewall to block ip6 traffic, or use ntp.conf to restrict ipv6 traffic.
    – Semirke
    Feb 5, 2014 at 13:44
  • 3
    @Semirke It makes me nervous when I tell a program to do something, yet it does something totally unexpected. Why does NTP listen on UDP6 when I told it not to?
    – Howard
    Feb 5, 2014 at 13:49
  • 3
    It's listening on localhost on both IPv4 (127.0.0.1) and IPv6 (::1). Are you sure you haven't configured it to listen on localhost? Or maybe it always listens on localhost. Not sure about that. In either case it will not hurt. Feb 5, 2014 at 15:10

3 Answers 3

17

I have been able to disable IPv6 for NTP on my Debian 5/6/7 and Ubuntu 12.04 this way :

Edit file /etc/default/ntp and replace

NTPD_OPTS='-g'

by

NTPD_OPTS='-4 -g'

Then, you can keep your directives in ntp.conf, they are not ignored :

interface ignore wildcard
interface listen <local_nic_ip>
  • Without interface ignore wildcard NTP will also listen on 0.0.0.0
  • Without interface listen <local_nic_ip> NTP will only listen on 127.0.0.1 (of course)

This will results in :

# netstat -anp | grep :123
udp    0      0 192.168.0.38:123     0.0.0.0:*                 2901/ntpd
udp    0      0 127.0.0.1:123        0.0.0.0:*                 2901/ntpd

Also, i confirm that OpenNTPD listens where you ask him to listen more friendly (no need to edit multiple config files). By default it listens nowhere until you configure it to do so (very secure) ;)

In config file, just uncomment line

listen on 127.0.0.1

And add line

listen on <local_nic_ip>

Results in :

# netstat -anp | grep :123
udp   0    0 192.168.0.38:123     0.0.0.0:*                 8581/ntpd
udp   0    0 127.0.0.1:123        0.0.0.0:*                 8581/ntpd
4
  • 1
    hi, ntpd -4 will only make it to do ipv4 DNS queries. Ntpd will keep listening on IPV6. Also I agree with your OpenNTPD notion, that you can configure to not listen on ipv6.
    – Semirke
    Feb 5, 2014 at 21:22
  • 2
    @Semirke I agree with you about the -4 option and DNS queries, but the fact is that, by doing this, i have no more listener on my ipv6 interfaces for ntp (assuming i trust netstat output).
    – krisFR
    Feb 5, 2014 at 21:31
  • 3
    Thanks. In case this helps someone, on CentOS 6.6 (and, thus, probably on Fedora and RHEL) the options are in this file: /etc/sysconfig/ntpd.
    – JJC
    Jun 4, 2015 at 0:30
  • @krisFR Thanks for the suggestion. Where is OpenNTPD configuration file?
    – Cloud Cho
    Nov 23, 2022 at 19:41
4

If you consider this a bug (and I certainly do: ntpd is ignoring a configuration directive) you're going to have to take it up with the package maintainer or upstream authors. I don't believe any of them hang out here - refer to the package information for their contact details.

Alternatively you could try another NTP implementation (like OpenNTPD - I've not used it personally, but the OpenBSD folks tend to be absolutely paranoid about security, so I imagine it only listens where it's told to).

As Sander pointed out though, your NTP daemon is listening on localhost (127.0.0.1 & ::1) - If you're worried about being hacked from localhost you probably have bigger problems than your NTP daemon.
I'm a bit miffed that the daemon is ignoring a configuration directive, but I wouldn't consider this a serious security concern.

2
  • 1
    Always be wary of recommendations/suggestions when the person giving the recommendation confesses to never having used the product in question. If you need an alternative to ntp reference implementation try chrony. It is important to note that chrony and openntpd do not support a lot of the extended features of the reference implementation.
    – dfc
    Feb 6, 2014 at 2:24
  • 1
    @dfc Beware of recommendations in general: All software recommendations should be evaluated for suitability in a given environment before blindly implementing them. In this case I know a number of folks who use OpenNTPD (on OpenBSD), and they speak very well of it as a "basic NTP daemon". Obviously if you're using features of the reference implementation that it doesn't support it's not going to work for you.
    – voretaq7
    Feb 6, 2014 at 20:50
-2

ntpd is not doing that; ntpdate is. See below for explanation. I didn't have either of these in my conf file:

    interface ignore wildcard
    interface listen <local_nic_ip>

I booted and sudo netstat -tunlp gave me this:

    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    udp        0      0 127.0.0.1:123           0.0.0.0:*                           1433/ntpd       
    udp        0      0 0.0.0.0:123             0.0.0.0:*                           1433/ntpd       

I turned on my network connection and netstat gave me this:

    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      4432/dnsmasq    
    udp        0      0 127.0.1.1:53            0.0.0.0:*                           4432/dnsmasq    
    udp        0      0 0.0.0.0:123             0.0.0.0:*                           4501/ntpdate    
    udp6       0      0 :::123                  :::*                                4501/ntpdate    

Note the first two are DNS, not ntp. Scroll right to see the program name.

I waited a bit, then netstat gave me this:

    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      4432/dnsmasq    
    udp        0      0 127.0.1.1:53            0.0.0.0:*                           4432/dnsmasq    
    udp        0      0 192.168.5.5:123         0.0.0.0:*                           4542/ntpd       
    udp        0      0 127.0.0.1:123           0.0.0.0:*                           4542/ntpd       
    udp        0      0 0.0.0.0:123             0.0.0.0:*                           4542/ntpd       

Strange. Anyway it looks like ntpdate is what (temporarily) gives you the udp6 connection. You have to use sudo to see the PID and program name, otherwise it is very misleading.

(later) Ah, never mind, it looks like yours really is ntp...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .