I have a private server on AWS that has no publicly open inbound ports. The only open port is SSH, and it's only accessible from other machines in the same subnet.
This machine reads files from S3 over the network. Recently it stopped working because the server's time had drifted by more than 15 minutes and the requests to S3 were rejected:
<Code>RequestTimeTooSkewed</Code> <Message> The difference between the request time and the current time is too large. </Message> <MaxAllowedSkewMilliseconds>900000</MaxAllowedSkewMilliseconds>
The easy fix is to install
ntp, but it requires opening UDP port 123. Because UDP is stateless, both inbound and outbound ports must be open.
How can I automatically update the system time using only TCP connections initiated by my server? Is there a standard TCP-based daemon like NTP? I don't care if it's not as precise: even a skew of up to 10 minutes would be acceptable.
Edit 2 Jun 2017
This is how the security groups are set up:
Type Protocol Port Range Source SSH TCP 22 172.31.0.0/16
Type Protocol Port range Destination All traffic All All 0.0.0.0/0
This is the network ACL for the subnet - just the default ACL:
Rule # Type Protocol Port Range Source Allow / Deny 100 ALL Traffic ALL ALL 0.0.0.0/0 ALLOW * ALL Traffic ALL ALL 0.0.0.0/0 DENY
Rule # Type Protocol Port Range Destination Allow / Deny 100 ALL Traffic ALL ALL 0.0.0.0/0 ALLOW * ALL Traffic ALL ALL 0.0.0.0/0 DENY
Edit 2 Jun 2017 #2
Alright now it works without any special security groups, as prediceted by @Tim. I think I was just not testing it properly:
ntpdatedoesn't use the servers in
/etc/ntp.conf, so it was reporting an error:
no servers can be used, exiting
ntpddoes not attempt to update the clock as soon as it starts; it waits for a minute or so.
Testing instead with
ntpdate-debian, and without port 123 open in a security group, works fine; and
ntpd updates the time properly if I let it run for a while.