5

NTPd listens on UDP port 123 (all IP addresses), by default. Is this necessary for just updating the server time?

If it's necessary to listen on an address, what single address should be used? The possible addresses it can listen on are:

  • 127.0.0.1
  • server IP
  • ::1 (IPv6)
  • server IP (IPv6)

Why does it even have to listen on localhost (127.0.0.1 and ::1)? Nobody can reach the server on that address.


To bind NTPd to a single address, the -I option can be used. For my Debian box, I had to edit /etc/default/ntp, and replace -g by:

-g -I 1.2.3.4 -I 127.0.0.1

This causes NTPd to listen on the public address 1.2.3.4 (replace it by your own) and 127.0.0.1.

3
  • 1
    But it still listens on 0.0.0.0:123 with this config. Feb 5, 2013 at 14:33
  • 1
    @Ian I found that out a few days ago when checking the output of netstat. See serverfault.com/a/475639/51929
    – Lekensteyn
    Feb 5, 2013 at 14:48
  • It is unbelievable that a unix daemon comes with this insecure default setting in the 21 century. Listing on all network interfaces by default, just to act as a client. This makes no sense.
    – guettli
    Aug 27, 2018 at 9:33

2 Answers 2

2

Listening on localhost makes sense if you want to run to queries on the local box. For examle, ntpq -p localhost will query the ntp service running on your local box.

In general you probably want ntpd to listen on all real addresses that it needs to send or receive updates on. If you are running ipv6 you need to list the ipv6 addresses as well, otherwise just list the real server ip addresses and ipv4 localhost.

4
  • So it's sufficient to listen on one public IPv4 address and 127.0.0.1 ?
    – Lekensteyn
    Feb 17, 2011 at 18:57
  • Yes, unless the machine is a router which gets time updates form the outside world and acts as an ntp server for your local network. Then you would want to listen on both inside and outside ip addresses. Feb 17, 2011 at 19:02
  • Thank you, the server receives updates only, it is not a NTP server.
    – Lekensteyn
    Feb 17, 2011 at 19:09
  • In general I want my servers and network to be secure. This means I open only the ports which are needed. Not more. I think quering the local ntp (and listening on adresses) makes no sense in everyday life. It might make sense for developing and debugging. But this should not be the default settings.
    – guettli
    Aug 27, 2018 at 9:30
9

If you just want to update the local time you should probably restrict access to the server, since ntpd doesn't support configuring the listen adresses.

First thing to configure is the default policy. You can either block all communication not enabled afterwards, but remember that restrictions work for client and server bothway.

restrict default ignore
# Allow access to localhost
restrict 127.0.0.1
restrict IP.OF.UPSTREAM.SERVER

Or you could allow the exchange of time by default and allow querying the server only to the localhost:

restrict -4 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1

Also ntpd allows chosing the interface it runs on via the -I switch. If you are running Debian you can simply add that -I switch to the NTPD_OPTS variable in /etc/defaults/ntpd.

ntpd -I eth0
1
  • ntpd does allow me to choose the listen address, using the -I option. See the bottom of my answer.
    – Lekensteyn
    Feb 17, 2011 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .