New answers tagged ntp
I finally figure it out. The key to understand the VMware KB statements in Q1 is the meaning of dispersion. It actually refers to the Root Dispersion field in NTP response packet. Windows advertises a Root Dispersion field of around 10 seconds, while Linux ntpd advertises around 0.01 second. I think Microsoft does this deliberately and announces this ...
If you have real NTP servers available, those lines are doing nothing useful and should be removed.
Running the following from the command line should force an update despite any time difference. ntpd -gq
That's a pretty perverse setup there, ESXi inside VMWare Workstation. Hats off to you. NTPD won't make enormous time adjustments like that if it "thinks" it's been running (by, say, being put to sleep). ESXi, unfortunately, doesn't seem to have a ntpdate binary (which you could just run via cron every half hour or so and disable ntpd entirely). I have ...
If the time difference is too great NTP will not sync. That's expected behavior. Normally this is not an issue as the VMware Tools installed in a guest OS will sync the time to the host regardless of how far the time drifted. Since you are using the experimental and unsupported option to run ESXi as VM you don't get the VMware Tools functionality, and ...
Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose there must be some kind of forged packet somewhere? The US-CERT has a great description of this attack at "Alert (TA14-017A) UDP-based Amplification Attacks" and "Alert (TA14-013A) NTP Amplification Attacks Using CVE-2013-5211". TA14-013A says it ...
I don't know if you can stop the daemon entirely, but you can just delete the NTP section of the configuration. From configuration mode: delete system ntp commit
The answer can be found in this blog post. All you need to do is disable the "monlist" command, which by the way was removed in ntpd 4.2.7 (our ESXi 5.1.0u2 servers are running 4.2.6p2). Access your server's console, either by enabling the local console or SSH. Edit /etc/ntp.conf by adding noquery to the first restrict line. Restart the NTP service with ...
I'm really puzzled by all the long but irrelevant answers here ... The answer is easy: Enable the ESXi bultin firewall! By default it is enabled and blocks incoming NTP traffic. So why the heck have you disabled it in the first place??
First of all, you should not have your ESXi retrieving its time from an outer source to avoid this. I recommend you to create a NTP Server internally which will themself be pooled by the ntp.org servers and protected correctly to mitigate NTPD DDOS attack.
The question is not answerable - and you may not like the answers that can be given. 2 scenarios, you fail to mention any detail to filter out: 1 - you were used to amplify. In this case I wonder why the ESXi host was accessible from the internet. It should not be. It should not have a public IP. I do not run ESX but maintain a number of Hyper-V servers ...
How do I configure the NTP server on ESXi to not be exposed to this DDoS attack? At the moment, you can't, really. The ntpd in ESXi isn't really configurable (at least in a VMware-supported fashion), so your options are really on or off. Presumably, VMware will release a patch or update sometime soon to address the issue, (I don't see one that says ...
I have been able to disable IPv6 for NTP on my Debian 5/6/7 and Ubuntu 12.04 this way : Edit file /etc/default/ntp and replace NTPD_OPTS='-g' by NTPD_OPTS='-4 -g' Then, you can keep your directives in ntp.conf, they are not ignored : interface ignore wildcard interface listen <local_nic_ip> Without interface ignore wildcard NTP will also ...
Top 50 recent answers are included