1

On ubuntu server my usual solution is just to install the ntp package and call it a day. This installs all the binaries I need and has ntpd start at boot time.

Right now I'm working on a server configuration that will be replicated across many servers, and in general needs to be as lean as possible. I'm noticing that in the default configuration for ntpd, requests can be made to the server to ask it what time it is. I don't need this. I only need the server's own time to be kept up to date.

2
  • Your server should have a firewall blocking by default; thus the ntpd service should never get any requests unless you explicitly open the firewall.
    – Chris S
    Aug 11, 2010 at 14:43
  • Sure, but I'd like to get the config as tight as possible independent of the firewall. (and right now during development we haven't set up a firewall yet) Aug 11, 2010 at 14:46

3 Answers 3

3

ntpdate as a cron job is NOT a substitute for ntpd as stated above.

If you are replicating this configuration accross many servers, why won't you just comment out the lines in ntpd.conf that serve time then repackage, or use some configuration management like puppet to push it to all the boxes once they have an OS on them?

3
  • that's the fallback solution, it just seems excessive to fire up an entire binary that has a full stack of server functionality and then comment-out all the server functionality. Aug 11, 2010 at 14:34
  • 1
    Understood, it feels like overkill but is almost certainly the best practice.
    – matt
    Aug 11, 2010 at 14:45
  • 1
    +1, The computer I'm on right now ntpd is using 1980K of RAM and is averaging 6 second of processor time per day.
    – Chris S
    Aug 11, 2010 at 20:32
1

You could try the OpenBSD implementation, OpenNTPD; although it's been criticised for not fully implementing the NTP protocol (and perhaps somewhat fudging it), it's possibly a better fit than the official ntpd.

0

So it seems there is no way to get all the ntpd functionality without ntpd. So I'm just running that with these modifications to /etc/ntp.conf. Do I still need those last two lines?

# Commenting out these lines that came standard
# # By default, exchange time with everybody, but don't allow configuration.                     
# restrict -4 default kod notrap nomodify nopeer noquery                                         
# restrict -6 default kod notrap nomodify nopeer noquery                                         

# Adding this one line
restrict default ignore

# Do I still need this? Does ntpd query itself when setting the local server's time?
# Local users may interrogate the ntp server more closely.                                       
restrict 127.0.0.1
restrict ::1
2
  • 1
    hmm, maybe i should be modifying my original question... Aug 11, 2010 at 14:44
  • Keep the last two lines: they do not hurt and let you locally monitor (ntpq) and reconfigure (ntpdc) the ntpd.
    – marcoc
    Oct 26, 2010 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .