I have a CentOS 6.4 server, it does not have any iptable rules, it runs NTP daemon as service using the following configuration:

  driftfile /var/lib/ntp/drift

  server 0.pool.ntp.org
  server 1.pool.ntp.org
  server 2.pool.ntp.org
  server 3.pool.ntp.org

  restrict default ignore
  restrict 127.0.0.1

When I run ntpq to query peers, the following response is received:

ntpq> peers
localhost.localdomain: timed out, nothing received

dig shows that:

localhost.localdomain.  86400   IN  A   127.0.0.1

Why doesn't ntp query work?

  • 1
    Do you have a local IPtables running? – Sami Laine Dec 2 '13 at 7:08
  • iptable is running, but there isnt any rule. – Howard Dec 2 '13 at 7:10
  • 1
    And ntp-daemon is actually running? Try grep ntp /var/log* to see if there are some notices which might help? – Sami Laine Dec 2 '13 at 7:27
  • are you able to ping 0.pool.ntp.org and others in the list ? – slayedbylucifer Dec 2 '13 at 8:42
  • Do you have an entry for localhost or localhost.localdomain in /etc/hosts? The system will look here first, before checking DNS. – user215543 Apr 8 '14 at 11:26

On RHEL / CentOS 6 and 7, for whatever reason ntpq tries to query the IPv6 loopback at ::1 instead of the IPv4 loopback at 127.0.0.1. With this in mind, I added this line to my /etc/ntp.conf file:

restrict ::1

Saved the file then restarted ntpd

service ntpd restart

now the command:

ntpq -p

works as expected. (This is the same as running ntpq in command-line mode and then issuing the peers command.)

I prefer this solution since you do not have to enable communications with ntpd via a potentially public Ethernet interface, which may be a security concern.

up vote 2 down vote accepted

I was expecting ntpq to query local server via 127.0.0.1, but it turns out to be querying local server via ethernet network interface.

Although I have no idea why a local ntp query would have to go through ethernet, but in configuration file I added

restrict <eht0 ip address>

And now NTP works fine.

  • Is this actually safe? Ie would that give public access somehow? – Tuinslak Dec 28 '16 at 7:32

When read the second answer, I realize the reason of this issue which maybe on /etc/hosts. Then add localhost on /etc/hosts and retry, it works.

127.0.0.1       localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Before:

ems@rack6-storage-2:~$ sudo service ntp stop ; sudo ntpdate 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org ; sudo service ntp start ; PATH=/usr/bin:/usr/sbin ntpdc -p
 * Stopping NTP server ntpd
   ...done.
18 Dec 08:18:31 ntpdate[35729]: adjust time server 202.156.0.34 offset -0.000467 sec
 * Starting NTP server ntpd
   ...done.
localhost.sdcorp.global.sandisk.com: timed out, nothing received
***Request timed out

After:

ems@rack6-storage-2:~$ sudo vim /etc/hosts
ems@rack6-storage-2:~$ sudo service ntp stop ; sudo ntpdate 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org ; sudo service ntp start ; PATH=/usr/bin:/usr/sbin ntpdc -p
 * Stopping NTP server ntpd
   ...done.
18 Dec 08:27:09 ntpdate[36056]: adjust time server 202.156.0.34 offset 0.015872 sec
 * Starting NTP server ntpd
   ...done.
     remote           local      st poll reach  delay   offset    disp
=======================================================================
=golem.canonical 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=frontier.innola 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=sg01.7asecond.c 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=time2.maxonline 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=pontoon.latt.ne 10.242.43.103   16   64    0 0.00000  0.000000 4.00000

People should read more carefully given configs before they are suggesting "reinstall". The mistake is very obvious.

From what I see, you have configured an NTP SERVER but you are pointing that to a POOL

server 0.pool.ntp.org

Try

pool 0.pool.ntp.org

instead or use "server" with a dedicated server, not a pool.

  • That just shouldn't matter, as the pool directive just resolves more IP addresses behind the 0.pool.ntp.org alias, where as the server directive just resolves one address from DNS and sticks to it. – Thomas Apr 12 '17 at 8:52

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.