Access Control Options
Access Control Support
The ntpd daemon provides an access control mechanism based on a
restriction list. Each entry in the list includes a 32-bit IP address,
32-bit mask and a set of restriction flags. The list is sorted first by
address and then by mask. The source address of every incoming NTP
packet is matched with each entry of the list in order. The matching
operation consists of first computing the bitwise AND of the packet IP
address and mask, then the bitwise AND of the entry IP address and mask.
If the results of the two AND operations agree, the restriction flags of
the entry define the restrictions for the packet. In the case of
multiple matches, the last match found is used. This allows default
restrictions to be defined, then exceptions for networks, subnets and
individual hosts defined as needed. Additional information and examples
can be found in the Notes on Configuring NTP and
Setting up a NTP Subnet page.
Access Control Commands
- restrict numeric_address [mask numeric_mask]
[flag]
[...]
- The numeric_address argument, expressed in
dotted-quad form, is the IP address of a network, subnet or individual
host. The mask argument, also expressed in dotted-quad
form, defaults to 255.255.255.255, so that a
numeric_address without mask is treated as the address
of an individual host. The special numeric_address
value specified as the string default is interpreted as address
0.0.0.0) and mask 255.255.255.255. Since the
restriction list entries are sorted by IP address and mask, this is
always the first entry in the list.
- The flag always restricts access, i.e., an entry
with no flags indicates that no restrictions are defined. The flags
are not orthogonal, in that more restrictive flags will often make less
restrictive ones redundant. The flags can generally be classed into two
categories, those which restrict time service and those which restrict
informational queries and attempts to do run-time reconfiguration of the
server. One or more of the following flags may be specified:
- ignore
- Ignore all packets from hosts which match this entry. If this flag
is specified neither queries nor time server polls will be responded
to.
- noquery
- Ignore all NTP mode 6 and 7 packets (i.e. information queries and
configuration requests) from the source. Time service is not
affected.
- nomodify
- Ignore all NTP mode 6 and 7 packets which attempt to modify the
state of the server (i.e. run time reconfiguration). Queries which
return information are permitted.
- notrap
- Decline to provide mode 6 control message trap service to matching
hosts. The trap service is a subsystem of the mode 6 control message
protocol which is intended for use by remote event logging
programs.
- lowpriotrap
- Declare traps set by matching hosts to be low priority. The number
of traps a server can maintain is limited (the current limit is 3).
Traps are usually assigned on a first come, first served basis, with
later trap requestors being denied service. This flag modifies the
assignment algorithm by allowing low priority traps to be overridden by
later requests for normal priority
traps.
- noserve
- Ignore NTP packets whose mode is other than 6 or 7. In effect, time
service is denied, though queries may still be permitted.
- nopeer
- Provide stateless time service to polling hosts, but do not allocate
peer memory resources to these hosts even if they otherwise might be
considered useful as future synchronization partners.
- notrust
- Treat these hosts normally in other respects, but never use them as
synchronization sources.
- limited
- These hosts are subject to limitation of number of clients from the
same net. Net in this context refers to the IP notion of net (class A,
class B, class C, etc.). Only the first client_limit hosts that
have shown up at the server and that have been active during the last
client_limit_period seconds are accepted. Requests from other
clients from the same net are rejected. Only time request packets are
taken into account. Query packets sent by the ntpq and
ntpdc programs are not subject to these limits. A history of
clients is kept using the monitoring capability of ntpd. Thus,
monitoring is always active as long as there is a restriction entry with
the limited flag.
- ntpport
- This is actually a match algorithm modifier, rather than a
restriction flag. Its presence causes the restriction entry to be
matched only if the source port in the packet is the standard NTP UDP
port (123). Both ntpport and non-ntpport may be
specified. The ntpport is considered more specific and is
sorted later in the list.
- Default restriction list entries, with the flags ignore,
ntpport, for each of the local host's interface addresses are
inserted into the table at startup to prevent the server from attempting
to synchronize to its own time. A default entry is also always present,
though if it is otherwise unconfigured; no flags are associated with the
default entry (i.e., everything besides your own NTP server is
unrestricted).
- clientlimit limit
- Set the client_limit variable, which limits the number of
simultaneous access-controlled clients. The default value for this
variable is 3.
- clientperiod period
- Set the client_limit_period variable, which specifies the
number of seconds after which a client is considered inactive and thus
no longer is counted for client limit restriction. The default value for
this variable is 3600 seconds.
David L. Mills <mills@udel.edu>