1310419Sdelphij.Dd November 21 2016 2290001Sglebius.Dt NTP_CONF 5 File Formats 3290001Sglebius.Os 4290001Sglebius.\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) 5290001Sglebius.\" 6310419Sdelphij.\" It has been AutoGen-ed November 21, 2016 at 08:02:03 AM by AutoGen 5.18.5 7290001Sglebius.\" From the definitions ntp.conf.def 8290001Sglebius.\" and the template file agmdoc-cmd.tpl 9290001Sglebius.Sh NAME 10290001Sglebius.Nm ntp.conf 11290001Sglebius.Nd Network Time Protocol (NTP) daemon configuration file format 12290001Sglebius.Sh SYNOPSIS 13290001Sglebius.Nm 14290001Sglebius.Op Fl \-option\-name 15290001Sglebius.Op Fl \-option\-name Ar value 16290001Sglebius.Pp 17290001SglebiusAll arguments must be options. 18290001Sglebius.Pp 19290001Sglebius.Sh DESCRIPTION 20290001SglebiusThe 21290001Sglebius.Nm 22290001Sglebiusconfiguration file is read at initial startup by the 23290001Sglebius.Xr ntpd @NTPD_MS@ 24290001Sglebiusdaemon in order to specify the synchronization sources, 25290001Sglebiusmodes and other related information. 26290001SglebiusUsually, it is installed in the 27290001Sglebius.Pa /etc 28290001Sglebiusdirectory, 29290001Sglebiusbut could be installed elsewhere 30290001Sglebius(see the daemon's 31290001Sglebius.Fl c 32290001Sglebiuscommand line option). 33290001Sglebius.Pp 34290001SglebiusThe file format is similar to other 35290001Sglebius.Ux 36290001Sglebiusconfiguration files. 37290001SglebiusComments begin with a 38290001Sglebius.Ql # 39290001Sglebiuscharacter and extend to the end of the line; 40290001Sglebiusblank lines are ignored. 41290001SglebiusConfiguration commands consist of an initial keyword 42290001Sglebiusfollowed by a list of arguments, 43290001Sglebiussome of which may be optional, separated by whitespace. 44290001SglebiusCommands may not be continued over multiple lines. 45290001SglebiusArguments may be host names, 46290001Sglebiushost addresses written in numeric, dotted\-quad form, 47290001Sglebiusintegers, floating point numbers (when specifying times in seconds) 48290001Sglebiusand text strings. 49290001Sglebius.Pp 50290001SglebiusThe rest of this page describes the configuration and control options. 51290001SglebiusThe 52290001Sglebius.Qq Notes on Configuring NTP and Setting up an NTP Subnet 53290001Sglebiuspage 54290001Sglebius(available as part of the HTML documentation 55290001Sglebiusprovided in 56290001Sglebius.Pa /usr/share/doc/ntp ) 57290001Sglebiuscontains an extended discussion of these options. 58290001SglebiusIn addition to the discussion of general 59290001Sglebius.Sx Configuration Options , 60290001Sglebiusthere are sections describing the following supported functionality 61290001Sglebiusand the options used to control it: 62290001Sglebius.Bl -bullet -offset indent 63290001Sglebius.It 64290001Sglebius.Sx Authentication Support 65290001Sglebius.It 66290001Sglebius.Sx Monitoring Support 67290001Sglebius.It 68290001Sglebius.Sx Access Control Support 69290001Sglebius.It 70290001Sglebius.Sx Automatic NTP Configuration Options 71290001Sglebius.It 72290001Sglebius.Sx Reference Clock Support 73290001Sglebius.It 74290001Sglebius.Sx Miscellaneous Options 75290001Sglebius.El 76290001Sglebius.Pp 77290001SglebiusFollowing these is a section describing 78290001Sglebius.Sx Miscellaneous Options . 79290001SglebiusWhile there is a rich set of options available, 80290001Sglebiusthe only required option is one or more 81290001Sglebius.Ic pool , 82290001Sglebius.Ic server , 83290001Sglebius.Ic peer , 84290001Sglebius.Ic broadcast 85290001Sglebiusor 86290001Sglebius.Ic manycastclient 87290001Sglebiuscommands. 88290001Sglebius.Sh Configuration Support 89290001SglebiusFollowing is a description of the configuration commands in 90290001SglebiusNTPv4. 91290001SglebiusThese commands have the same basic functions as in NTPv3 and 92290001Sglebiusin some cases new functions and new arguments. 93290001SglebiusThere are two 94290001Sglebiusclasses of commands, configuration commands that configure a 95290001Sglebiuspersistent association with a remote server or peer or reference 96290001Sglebiusclock, and auxiliary commands that specify environmental variables 97290001Sglebiusthat control various related operations. 98290001Sglebius.Ss Configuration Commands 99290001SglebiusThe various modes are determined by the command keyword and the 100290001Sglebiustype of the required IP address. 101290001SglebiusAddresses are classed by type as 102290001Sglebius(s) a remote server or peer (IPv4 class A, B and C), (b) the 103290001Sglebiusbroadcast address of a local interface, (m) a multicast address (IPv4 104290001Sglebiusclass D), or (r) a reference clock address (127.127.x.x). 105290001SglebiusNote that 106290001Sglebiusonly those options applicable to each command are listed below. 107290001SglebiusUse 108290001Sglebiusof options not listed may not be caught as an error, but may result 109290001Sglebiusin some weird and even destructive behavior. 110290001Sglebius.Pp 111290001SglebiusIf the Basic Socket Interface Extensions for IPv6 (RFC\-2553) 112290001Sglebiusis detected, support for the IPv6 address family is generated 113290001Sglebiusin addition to the default support of the IPv4 address family. 114298770SdelphijIn a few cases, including the 115298770Sdelphij.Cm reslist 116298770Sdelphijbillboard generated 117298770Sdelphijby 118298770Sdelphij.Xr ntpq @NTPQ_MS@ 119298770Sdelphijor 120298770Sdelphij.Xr ntpdc @NTPDC_MS@ , 121298770SdelphijIPv6 addresses are automatically generated. 122290001SglebiusIPv6 addresses can be identified by the presence of colons 123290001Sglebius.Dq \&: 124290001Sglebiusin the address field. 125290001SglebiusIPv6 addresses can be used almost everywhere where 126290001SglebiusIPv4 addresses can be used, 127290001Sglebiuswith the exception of reference clock addresses, 128290001Sglebiuswhich are always IPv4. 129290001Sglebius.Pp 130290001SglebiusNote that in contexts where a host name is expected, a 131290001Sglebius.Fl 4 132290001Sglebiusqualifier preceding 133290001Sglebiusthe host name forces DNS resolution to the IPv4 namespace, 134290001Sglebiuswhile a 135290001Sglebius.Fl 6 136290001Sglebiusqualifier forces DNS resolution to the IPv6 namespace. 137290001SglebiusSee IPv6 references for the 138290001Sglebiusequivalent classes for that address family. 139290001Sglebius.Bl -tag -width indent 140290001Sglebius.It Xo Ic pool Ar address 141290001Sglebius.Op Cm burst 142290001Sglebius.Op Cm iburst 143290001Sglebius.Op Cm version Ar version 144290001Sglebius.Op Cm prefer 145290001Sglebius.Op Cm minpoll Ar minpoll 146290001Sglebius.Op Cm maxpoll Ar maxpoll 147290001Sglebius.Xc 148290001Sglebius.It Xo Ic server Ar address 149290001Sglebius.Op Cm key Ar key \&| Cm autokey 150290001Sglebius.Op Cm burst 151290001Sglebius.Op Cm iburst 152290001Sglebius.Op Cm version Ar version 153290001Sglebius.Op Cm prefer 154290001Sglebius.Op Cm minpoll Ar minpoll 155290001Sglebius.Op Cm maxpoll Ar maxpoll 156298770Sdelphij.Op Cm true 157290001Sglebius.Xc 158290001Sglebius.It Xo Ic peer Ar address 159290001Sglebius.Op Cm key Ar key \&| Cm autokey 160290001Sglebius.Op Cm version Ar version 161290001Sglebius.Op Cm prefer 162290001Sglebius.Op Cm minpoll Ar minpoll 163290001Sglebius.Op Cm maxpoll Ar maxpoll 164298770Sdelphij.Op Cm true 165298770Sdelphij.Op Cm xleave 166290001Sglebius.Xc 167290001Sglebius.It Xo Ic broadcast Ar address 168290001Sglebius.Op Cm key Ar key \&| Cm autokey 169290001Sglebius.Op Cm version Ar version 170290001Sglebius.Op Cm prefer 171290001Sglebius.Op Cm minpoll Ar minpoll 172290001Sglebius.Op Cm ttl Ar ttl 173298770Sdelphij.Op Cm xleave 174290001Sglebius.Xc 175290001Sglebius.It Xo Ic manycastclient Ar address 176290001Sglebius.Op Cm key Ar key \&| Cm autokey 177290001Sglebius.Op Cm version Ar version 178290001Sglebius.Op Cm prefer 179290001Sglebius.Op Cm minpoll Ar minpoll 180290001Sglebius.Op Cm maxpoll Ar maxpoll 181290001Sglebius.Op Cm ttl Ar ttl 182290001Sglebius.Xc 183290001Sglebius.El 184290001Sglebius.Pp 185290001SglebiusThese five commands specify the time server name or address to 186290001Sglebiusbe used and the mode in which to operate. 187290001SglebiusThe 188290001Sglebius.Ar address 189290001Sglebiuscan be 190290001Sglebiuseither a DNS name or an IP address in dotted\-quad notation. 191290001SglebiusAdditional information on association behavior can be found in the 192290001Sglebius.Qq Association Management 193290001Sglebiuspage 194290001Sglebius(available as part of the HTML documentation 195290001Sglebiusprovided in 196290001Sglebius.Pa /usr/share/doc/ntp ) . 197290001Sglebius.Bl -tag -width indent 198290001Sglebius.It Ic pool 199290001SglebiusFor type s addresses, this command mobilizes a persistent 200290001Sglebiusclient mode association with a number of remote servers. 201290001SglebiusIn this mode the local clock can synchronized to the 202290001Sglebiusremote server, but the remote server can never be synchronized to 203290001Sglebiusthe local clock. 204290001Sglebius.It Ic server 205290001SglebiusFor type s and r addresses, this command mobilizes a persistent 206290001Sglebiusclient mode association with the specified remote server or local 207290001Sglebiusradio clock. 208290001SglebiusIn this mode the local clock can synchronized to the 209290001Sglebiusremote server, but the remote server can never be synchronized to 210290001Sglebiusthe local clock. 211290001SglebiusThis command should 212290001Sglebius.Em not 213290001Sglebiusbe used for type 214290001Sglebiusb or m addresses. 215290001Sglebius.It Ic peer 216290001SglebiusFor type s addresses (only), this command mobilizes a 217290001Sglebiuspersistent symmetric\-active mode association with the specified 218290001Sglebiusremote peer. 219290001SglebiusIn this mode the local clock can be synchronized to 220290001Sglebiusthe remote peer or the remote peer can be synchronized to the local 221290001Sglebiusclock. 222290001SglebiusThis is useful in a network of servers where, depending on 223290001Sglebiusvarious failure scenarios, either the local or remote peer may be 224290001Sglebiusthe better source of time. 225290001SglebiusThis command should NOT be used for type 226290001Sglebiusb, m or r addresses. 227290001Sglebius.It Ic broadcast 228290001SglebiusFor type b and m addresses (only), this 229290001Sglebiuscommand mobilizes a persistent broadcast mode association. 230290001SglebiusMultiple 231290001Sglebiuscommands can be used to specify multiple local broadcast interfaces 232290001Sglebius(subnets) and/or multiple multicast groups. 233290001SglebiusNote that local 234290001Sglebiusbroadcast messages go only to the interface associated with the 235290001Sglebiussubnet specified, but multicast messages go to all interfaces. 236290001SglebiusIn broadcast mode the local server sends periodic broadcast 237290001Sglebiusmessages to a client population at the 238290001Sglebius.Ar address 239290001Sglebiusspecified, which is usually the broadcast address on (one of) the 240290001Sglebiuslocal network(s) or a multicast address assigned to NTP. 241290001SglebiusThe IANA 242290001Sglebiushas assigned the multicast group address IPv4 224.0.1.1 and 243290001SglebiusIPv6 ff05::101 (site local) exclusively to 244290001SglebiusNTP, but other nonconflicting addresses can be used to contain the 245290001Sglebiusmessages within administrative boundaries. 246290001SglebiusOrdinarily, this 247290001Sglebiusspecification applies only to the local server operating as a 248290001Sglebiussender; for operation as a broadcast client, see the 249290001Sglebius.Ic broadcastclient 250290001Sglebiusor 251290001Sglebius.Ic multicastclient 252290001Sglebiuscommands 253290001Sglebiusbelow. 254290001Sglebius.It Ic manycastclient 255290001SglebiusFor type m addresses (only), this command mobilizes a 256290001Sglebiusmanycast client mode association for the multicast address 257290001Sglebiusspecified. 258290001SglebiusIn this case a specific address must be supplied which 259290001Sglebiusmatches the address used on the 260290001Sglebius.Ic manycastserver 261290001Sglebiuscommand for 262290001Sglebiusthe designated manycast servers. 263290001SglebiusThe NTP multicast address 264290001Sglebius224.0.1.1 assigned by the IANA should NOT be used, unless specific 265290001Sglebiusmeans are taken to avoid spraying large areas of the Internet with 266290001Sglebiusthese messages and causing a possibly massive implosion of replies 267290001Sglebiusat the sender. 268290001SglebiusThe 269290001Sglebius.Ic manycastserver 270290001Sglebiuscommand specifies that the local server 271290001Sglebiusis to operate in client mode with the remote servers that are 272290001Sglebiusdiscovered as the result of broadcast/multicast messages. 273290001SglebiusThe 274290001Sglebiusclient broadcasts a request message to the group address associated 275290001Sglebiuswith the specified 276290001Sglebius.Ar address 277290001Sglebiusand specifically enabled 278290001Sglebiusservers respond to these messages. 279290001SglebiusThe client selects the servers 280290001Sglebiusproviding the best time and continues as with the 281290001Sglebius.Ic server 282290001Sglebiuscommand. 283290001SglebiusThe remaining servers are discarded as if never 284290001Sglebiusheard. 285290001Sglebius.El 286290001Sglebius.Pp 287290001SglebiusOptions: 288290001Sglebius.Bl -tag -width indent 289290001Sglebius.It Cm autokey 290290001SglebiusAll packets sent to and received from the server or peer are to 291290001Sglebiusinclude authentication fields encrypted using the autokey scheme 292290001Sglebiusdescribed in 293290001Sglebius.Sx Authentication Options . 294290001Sglebius.It Cm burst 295290001Sglebiuswhen the server is reachable, send a burst of eight packets 296290001Sglebiusinstead of the usual one. 297290001SglebiusThe packet spacing is normally 2 s; 298290001Sglebiushowever, the spacing between the first and second packets 299298770Sdelphijcan be changed with the 300298770Sdelphij.Ic calldelay 301298770Sdelphijcommand to allow 302290001Sglebiusadditional time for a modem or ISDN call to complete. 303290001SglebiusThis is designed to improve timekeeping quality 304290001Sglebiuswith the 305290001Sglebius.Ic server 306290001Sglebiuscommand and s addresses. 307290001Sglebius.It Cm iburst 308290001SglebiusWhen the server is unreachable, send a burst of eight packets 309290001Sglebiusinstead of the usual one. 310290001SglebiusThe packet spacing is normally 2 s; 311290001Sglebiushowever, the spacing between the first two packets can be 312298770Sdelphijchanged with the 313298770Sdelphij.Ic calldelay 314298770Sdelphijcommand to allow 315290001Sglebiusadditional time for a modem or ISDN call to complete. 316290001SglebiusThis is designed to speed the initial synchronization 317290001Sglebiusacquisition with the 318290001Sglebius.Ic server 319290001Sglebiuscommand and s addresses and when 320290001Sglebius.Xr ntpd @NTPD_MS@ 321290001Sglebiusis started with the 322290001Sglebius.Fl q 323290001Sglebiusoption. 324290001Sglebius.It Cm key Ar key 325290001SglebiusAll packets sent to and received from the server or peer are to 326290001Sglebiusinclude authentication fields encrypted using the specified 327290001Sglebius.Ar key 328290001Sglebiusidentifier with values from 1 to 65534, inclusive. 329290001SglebiusThe 330290001Sglebiusdefault is to include no encryption field. 331290001Sglebius.It Cm minpoll Ar minpoll 332290001Sglebius.It Cm maxpoll Ar maxpoll 333290001SglebiusThese options specify the minimum and maximum poll intervals 334290001Sglebiusfor NTP messages, as a power of 2 in seconds 335290001SglebiusThe maximum poll 336290001Sglebiusinterval defaults to 10 (1,024 s), but can be increased by the 337290001Sglebius.Cm maxpoll 338290001Sglebiusoption to an upper limit of 17 (36.4 h). 339290001SglebiusThe 340290001Sglebiusminimum poll interval defaults to 6 (64 s), but can be decreased by 341290001Sglebiusthe 342290001Sglebius.Cm minpoll 343290001Sglebiusoption to a lower limit of 4 (16 s). 344290001Sglebius.It Cm noselect 345290001SglebiusMarks the server as unused, except for display purposes. 346290001SglebiusThe server is discarded by the selection algroithm. 347298770Sdelphij.It Cm preempt 348298770SdelphijSays the association can be preempted. 349298770Sdelphij.It Cm true 350298770SdelphijMarks the server as a truechimer. 351298770SdelphijUse this option only for testing. 352290001Sglebius.It Cm prefer 353290001SglebiusMarks the server as preferred. 354290001SglebiusAll other things being equal, 355290001Sglebiusthis host will be chosen for synchronization among a set of 356290001Sglebiuscorrectly operating hosts. 357290001SglebiusSee the 358290001Sglebius.Qq Mitigation Rules and the prefer Keyword 359290001Sglebiuspage 360290001Sglebius(available as part of the HTML documentation 361290001Sglebiusprovided in 362290001Sglebius.Pa /usr/share/doc/ntp ) 363290001Sglebiusfor further information. 364298770Sdelphij.It Cm true 365298770SdelphijForces the association to always survive the selection and clustering algorithms. 366298770SdelphijThis option should almost certainly 367298770Sdelphij.Em only 368298770Sdelphijbe used while testing an association. 369290001Sglebius.It Cm ttl Ar ttl 370290001SglebiusThis option is used only with broadcast server and manycast 371290001Sglebiusclient modes. 372290001SglebiusIt specifies the time\-to\-live 373290001Sglebius.Ar ttl 374290001Sglebiusto 375290001Sglebiususe on broadcast server and multicast server and the maximum 376290001Sglebius.Ar ttl 377290001Sglebiusfor the expanding ring search with manycast 378290001Sglebiusclient packets. 379290001SglebiusSelection of the proper value, which defaults to 380290001Sglebius127, is something of a black art and should be coordinated with the 381290001Sglebiusnetwork administrator. 382290001Sglebius.It Cm version Ar version 383290001SglebiusSpecifies the version number to be used for outgoing NTP 384290001Sglebiuspackets. 385290001SglebiusVersions 1\-4 are the choices, with version 4 the 386290001Sglebiusdefault. 387298770Sdelphij.It Cm xleave 388298770SdelphijValid in 389298770Sdelphij.Cm peer 390298770Sdelphijand 391298770Sdelphij.Cm broadcast 392298770Sdelphijmodes only, this flag enables interleave mode. 393290001Sglebius.El 394290001Sglebius.Ss Auxiliary Commands 395290001Sglebius.Bl -tag -width indent 396290001Sglebius.It Ic broadcastclient 397290001SglebiusThis command enables reception of broadcast server messages to 398290001Sglebiusany local interface (type b) address. 399290001SglebiusUpon receiving a message for 400290001Sglebiusthe first time, the broadcast client measures the nominal server 401290001Sglebiuspropagation delay using a brief client/server exchange with the 402290001Sglebiusserver, then enters the broadcast client mode, in which it 403290001Sglebiussynchronizes to succeeding broadcast messages. 404290001SglebiusNote that, in order 405290001Sglebiusto avoid accidental or malicious disruption in this mode, both the 406290001Sglebiusserver and client should operate using symmetric\-key or public\-key 407290001Sglebiusauthentication as described in 408290001Sglebius.Sx Authentication Options . 409290001Sglebius.It Ic manycastserver Ar address ... 410290001SglebiusThis command enables reception of manycast client messages to 411290001Sglebiusthe multicast group address(es) (type m) specified. 412290001SglebiusAt least one 413290001Sglebiusaddress is required, but the NTP multicast address 224.0.1.1 414290001Sglebiusassigned by the IANA should NOT be used, unless specific means are 415290001Sglebiustaken to limit the span of the reply and avoid a possibly massive 416290001Sglebiusimplosion at the original sender. 417290001SglebiusNote that, in order to avoid 418290001Sglebiusaccidental or malicious disruption in this mode, both the server 419290001Sglebiusand client should operate using symmetric\-key or public\-key 420290001Sglebiusauthentication as described in 421290001Sglebius.Sx Authentication Options . 422290001Sglebius.It Ic multicastclient Ar address ... 423290001SglebiusThis command enables reception of multicast server messages to 424290001Sglebiusthe multicast group address(es) (type m) specified. 425290001SglebiusUpon receiving 426290001Sglebiusa message for the first time, the multicast client measures the 427290001Sglebiusnominal server propagation delay using a brief client/server 428290001Sglebiusexchange with the server, then enters the broadcast client mode, in 429290001Sglebiuswhich it synchronizes to succeeding multicast messages. 430290001SglebiusNote that, 431290001Sglebiusin order to avoid accidental or malicious disruption in this mode, 432290001Sglebiusboth the server and client should operate using symmetric\-key or 433290001Sglebiuspublic\-key authentication as described in 434290001Sglebius.Sx Authentication Options . 435290001Sglebius.It Ic mdnstries Ar number 436290001SglebiusIf we are participating in mDNS, 437290001Sglebiusafter we have synched for the first time 438290001Sglebiuswe attempt to register with the mDNS system. 439290001SglebiusIf that registration attempt fails, 440290001Sglebiuswe try again at one minute intervals for up to 441290001Sglebius.Ic mdnstries 442290001Sglebiustimes. 443290001SglebiusAfter all, 444290001Sglebius.Ic ntpd 445290001Sglebiusmay be starting before mDNS. 446290001SglebiusThe default value for 447290001Sglebius.Ic mdnstries 448290001Sglebiusis 5. 449290001Sglebius.El 450290001Sglebius.Sh Authentication Support 451290001SglebiusAuthentication support allows the NTP client to verify that the 452290001Sglebiusserver is in fact known and trusted and not an intruder intending 453290001Sglebiusaccidentally or on purpose to masquerade as that server. 454290001SglebiusThe NTPv3 455290001Sglebiusspecification RFC\-1305 defines a scheme which provides 456290001Sglebiuscryptographic authentication of received NTP packets. 457290001SglebiusOriginally, 458290001Sglebiusthis was done using the Data Encryption Standard (DES) algorithm 459290001Sglebiusoperating in Cipher Block Chaining (CBC) mode, commonly called 460290001SglebiusDES\-CBC. 461290001SglebiusSubsequently, this was replaced by the RSA Message Digest 462290001Sglebius5 (MD5) algorithm using a private key, commonly called keyed\-MD5. 463290001SglebiusEither algorithm computes a message digest, or one\-way hash, which 464290001Sglebiuscan be used to verify the server has the correct private key and 465290001Sglebiuskey identifier. 466290001Sglebius.Pp 467290001SglebiusNTPv4 retains the NTPv3 scheme, properly described as symmetric key 468290001Sglebiuscryptography and, in addition, provides a new Autokey scheme 469290001Sglebiusbased on public key cryptography. 470290001SglebiusPublic key cryptography is generally considered more secure 471290001Sglebiusthan symmetric key cryptography, since the security is based 472290001Sglebiuson a private value which is generated by each server and 473290001Sglebiusnever revealed. 474290001SglebiusWith Autokey all key distribution and 475290001Sglebiusmanagement functions involve only public values, which 476290001Sglebiusconsiderably simplifies key distribution and storage. 477290001SglebiusPublic key management is based on X.509 certificates, 478290001Sglebiuswhich can be provided by commercial services or 479290001Sglebiusproduced by utility programs in the OpenSSL software library 480290001Sglebiusor the NTPv4 distribution. 481290001Sglebius.Pp 482290001SglebiusWhile the algorithms for symmetric key cryptography are 483290001Sglebiusincluded in the NTPv4 distribution, public key cryptography 484290001Sglebiusrequires the OpenSSL software library to be installed 485290001Sglebiusbefore building the NTP distribution. 486290001SglebiusDirections for doing that 487290001Sglebiusare on the Building and Installing the Distribution page. 488290001Sglebius.Pp 489290001SglebiusAuthentication is configured separately for each association 490290001Sglebiususing the 491290001Sglebius.Cm key 492290001Sglebiusor 493290001Sglebius.Cm autokey 494290001Sglebiussubcommand on the 495290001Sglebius.Ic peer , 496290001Sglebius.Ic server , 497290001Sglebius.Ic broadcast 498290001Sglebiusand 499290001Sglebius.Ic manycastclient 500290001Sglebiusconfiguration commands as described in 501290001Sglebius.Sx Configuration Options 502290001Sglebiuspage. 503290001SglebiusThe authentication 504290001Sglebiusoptions described below specify the locations of the key files, 505290001Sglebiusif other than default, which symmetric keys are trusted 506290001Sglebiusand the interval between various operations, if other than default. 507290001Sglebius.Pp 508290001SglebiusAuthentication is always enabled, 509290001Sglebiusalthough ineffective if not configured as 510290001Sglebiusdescribed below. 511290001SglebiusIf a NTP packet arrives 512290001Sglebiusincluding a message authentication 513290001Sglebiuscode (MAC), it is accepted only if it 514290001Sglebiuspasses all cryptographic checks. 515290001SglebiusThe 516290001Sglebiuschecks require correct key ID, key value 517290001Sglebiusand message digest. 518290001SglebiusIf the packet has 519290001Sglebiusbeen modified in any way or replayed 520290001Sglebiusby an intruder, it will fail one or more 521290001Sglebiusof these checks and be discarded. 522290001SglebiusFurthermore, the Autokey scheme requires a 523290001Sglebiuspreliminary protocol exchange to obtain 524290001Sglebiusthe server certificate, verify its 525290001Sglebiuscredentials and initialize the protocol 526290001Sglebius.Pp 527290001SglebiusThe 528290001Sglebius.Cm auth 529290001Sglebiusflag controls whether new associations or 530290001Sglebiusremote configuration commands require cryptographic authentication. 531290001SglebiusThis flag can be set or reset by the 532290001Sglebius.Ic enable 533290001Sglebiusand 534290001Sglebius.Ic disable 535290001Sglebiuscommands and also by remote 536290001Sglebiusconfiguration commands sent by a 537290001Sglebius.Xr ntpdc @NTPDC_MS@ 538298770Sdelphijprogram running on 539290001Sglebiusanother machine. 540290001SglebiusIf this flag is enabled, which is the default 541290001Sglebiuscase, new broadcast client and symmetric passive associations and 542290001Sglebiusremote configuration commands must be cryptographically 543290001Sglebiusauthenticated using either symmetric key or public key cryptography. 544290001SglebiusIf this 545290001Sglebiusflag is disabled, these operations are effective 546290001Sglebiuseven if not cryptographic 547290001Sglebiusauthenticated. 548290001SglebiusIt should be understood 549290001Sglebiusthat operating with the 550290001Sglebius.Ic auth 551290001Sglebiusflag disabled invites a significant vulnerability 552290001Sglebiuswhere a rogue hacker can 553290001Sglebiusmasquerade as a falseticker and seriously 554290001Sglebiusdisrupt system timekeeping. 555290001SglebiusIt is 556290001Sglebiusimportant to note that this flag has no purpose 557290001Sglebiusother than to allow or disallow 558290001Sglebiusa new association in response to new broadcast 559290001Sglebiusand symmetric active messages 560290001Sglebiusand remote configuration commands and, in particular, 561290001Sglebiusthe flag has no effect on 562290001Sglebiusthe authentication process itself. 563290001Sglebius.Pp 564290001SglebiusAn attractive alternative where multicast support is available 565290001Sglebiusis manycast mode, in which clients periodically troll 566290001Sglebiusfor servers as described in the 567290001Sglebius.Sx Automatic NTP Configuration Options 568290001Sglebiuspage. 569290001SglebiusEither symmetric key or public key 570290001Sglebiuscryptographic authentication can be used in this mode. 571290001SglebiusThe principle advantage 572290001Sglebiusof manycast mode is that potential servers need not be 573290001Sglebiusconfigured in advance, 574290001Sglebiussince the client finds them during regular operation, 575290001Sglebiusand the configuration 576290001Sglebiusfiles for all clients can be identical. 577290001Sglebius.Pp 578290001SglebiusThe security model and protocol schemes for 579290001Sglebiusboth symmetric key and public key 580290001Sglebiuscryptography are summarized below; 581290001Sglebiusfurther details are in the briefings, papers 582290001Sglebiusand reports at the NTP project page linked from 583290001Sglebius.Li http://www.ntp.org/ . 584290001Sglebius.Ss Symmetric\-Key Cryptography 585290001SglebiusThe original RFC\-1305 specification allows any one of possibly 586290001Sglebius65,534 keys, each distinguished by a 32\-bit key identifier, to 587290001Sglebiusauthenticate an association. 588290001SglebiusThe servers and clients involved must 589290001Sglebiusagree on the key and key identifier to 590290001Sglebiusauthenticate NTP packets. 591290001SglebiusKeys and 592290001Sglebiusrelated information are specified in a key 593290001Sglebiusfile, usually called 594290001Sglebius.Pa ntp.keys , 595290001Sglebiuswhich must be distributed and stored using 596290001Sglebiussecure means beyond the scope of the NTP protocol itself. 597290001SglebiusBesides the keys used 598290001Sglebiusfor ordinary NTP associations, 599290001Sglebiusadditional keys can be used as passwords for the 600290001Sglebius.Xr ntpq @NTPQ_MS@ 601290001Sglebiusand 602290001Sglebius.Xr ntpdc @NTPDC_MS@ 603290001Sglebiusutility programs. 604290001Sglebius.Pp 605290001SglebiusWhen 606290001Sglebius.Xr ntpd @NTPD_MS@ 607290001Sglebiusis first started, it reads the key file specified in the 608290001Sglebius.Ic keys 609290001Sglebiusconfiguration command and installs the keys 610290001Sglebiusin the key cache. 611290001SglebiusHowever, 612290001Sglebiusindividual keys must be activated with the 613290001Sglebius.Ic trusted 614290001Sglebiuscommand before use. 615290001SglebiusThis 616290001Sglebiusallows, for instance, the installation of possibly 617290001Sglebiusseveral batches of keys and 618290001Sglebiusthen activating or deactivating each batch 619290001Sglebiusremotely using 620290001Sglebius.Xr ntpdc @NTPDC_MS@ . 621290001SglebiusThis also provides a revocation capability that can be used 622290001Sglebiusif a key becomes compromised. 623290001SglebiusThe 624290001Sglebius.Ic requestkey 625290001Sglebiuscommand selects the key used as the password for the 626290001Sglebius.Xr ntpdc @NTPDC_MS@ 627290001Sglebiusutility, while the 628290001Sglebius.Ic controlkey 629290001Sglebiuscommand selects the key used as the password for the 630290001Sglebius.Xr ntpq @NTPQ_MS@ 631290001Sglebiusutility. 632290001Sglebius.Ss Public Key Cryptography 633290001SglebiusNTPv4 supports the original NTPv3 symmetric key scheme 634290001Sglebiusdescribed in RFC\-1305 and in addition the Autokey protocol, 635290001Sglebiuswhich is based on public key cryptography. 636290001SglebiusThe Autokey Version 2 protocol described on the Autokey Protocol 637290001Sglebiuspage verifies packet integrity using MD5 message digests 638290001Sglebiusand verifies the source with digital signatures and any of several 639290001Sglebiusdigest/signature schemes. 640290001SglebiusOptional identity schemes described on the Identity Schemes 641290001Sglebiuspage and based on cryptographic challenge/response algorithms 642290001Sglebiusare also available. 643290001SglebiusUsing all of these schemes provides strong security against 644290001Sglebiusreplay with or without modification, spoofing, masquerade 645290001Sglebiusand most forms of clogging attacks. 646290001Sglebius.\" .Pp 647290001Sglebius.\" The cryptographic means necessary for all Autokey operations 648290001Sglebius.\" is provided by the OpenSSL software library. 649290001Sglebius.\" This library is available from http://www.openssl.org/ 650290001Sglebius.\" and can be installed using the procedures outlined 651290001Sglebius.\" in the Building and Installing the Distribution page. 652290001Sglebius.\" Once installed, 653290001Sglebius.\" the configure and build 654290001Sglebius.\" process automatically detects the library and links 655290001Sglebius.\" the library routines required. 656290001Sglebius.Pp 657290001SglebiusThe Autokey protocol has several modes of operation 658290001Sglebiuscorresponding to the various NTP modes supported. 659290001SglebiusMost modes use a special cookie which can be 660290001Sglebiuscomputed independently by the client and server, 661290001Sglebiusbut encrypted in transmission. 662290001SglebiusAll modes use in addition a variant of the S\-KEY scheme, 663290001Sglebiusin which a pseudo\-random key list is generated and used 664290001Sglebiusin reverse order. 665290001SglebiusThese schemes are described along with an executive summary, 666290001Sglebiuscurrent status, briefing slides and reading list on the 667290001Sglebius.Sx Autonomous Authentication 668290001Sglebiuspage. 669290001Sglebius.Pp 670290001SglebiusThe specific cryptographic environment used by Autokey servers 671290001Sglebiusand clients is determined by a set of files 672290001Sglebiusand soft links generated by the 673290001Sglebius.Xr ntp\-keygen 1ntpkeygenmdoc 674290001Sglebiusprogram. 675290001SglebiusThis includes a required host key file, 676290001Sglebiusrequired certificate file and optional sign key file, 677290001Sglebiusleapsecond file and identity scheme files. 678290001SglebiusThe 679290001Sglebiusdigest/signature scheme is specified in the X.509 certificate 680290001Sglebiusalong with the matching sign key. 681290001SglebiusThere are several schemes 682290001Sglebiusavailable in the OpenSSL software library, each identified 683290001Sglebiusby a specific string such as 684290001Sglebius.Cm md5WithRSAEncryption , 685290001Sglebiuswhich stands for the MD5 message digest with RSA 686290001Sglebiusencryption scheme. 687290001SglebiusThe current NTP distribution supports 688290001Sglebiusall the schemes in the OpenSSL library, including 689290001Sglebiusthose based on RSA and DSA digital signatures. 690290001Sglebius.Pp 691290001SglebiusNTP secure groups can be used to define cryptographic compartments 692290001Sglebiusand security hierarchies. 693290001SglebiusIt is important that every host 694290001Sglebiusin the group be able to construct a certificate trail to one 695290001Sglebiusor more trusted hosts in the same group. 696290001SglebiusEach group 697290001Sglebiushost runs the Autokey protocol to obtain the certificates 698290001Sglebiusfor all hosts along the trail to one or more trusted hosts. 699290001SglebiusThis requires the configuration file in all hosts to be 700290001Sglebiusengineered so that, even under anticipated failure conditions, 701290001Sglebiusthe NTP subnet will form such that every group host can find 702290001Sglebiusa trail to at least one trusted host. 703290001Sglebius.Ss Naming and Addressing 704290001SglebiusIt is important to note that Autokey does not use DNS to 705290001Sglebiusresolve addresses, since DNS can't be completely trusted 706290001Sglebiusuntil the name servers have synchronized clocks. 707290001SglebiusThe cryptographic name used by Autokey to bind the host identity 708290001Sglebiuscredentials and cryptographic values must be independent 709290001Sglebiusof interface, network and any other naming convention. 710290001SglebiusThe name appears in the host certificate in either or both 711290001Sglebiusthe subject and issuer fields, so protection against 712290001SglebiusDNS compromise is essential. 713290001Sglebius.Pp 714290001SglebiusBy convention, the name of an Autokey host is the name returned 715290001Sglebiusby the Unix 716290001Sglebius.Xr gethostname 2 717290001Sglebiussystem call or equivalent in other systems. 718290001SglebiusBy the system design 719290001Sglebiusmodel, there are no provisions to allow alternate names or aliases. 720290001SglebiusHowever, this is not to say that DNS aliases, different names 721290001Sglebiusfor each interface, etc., are constrained in any way. 722290001Sglebius.Pp 723290001SglebiusIt is also important to note that Autokey verifies authenticity 724290001Sglebiususing the host name, network address and public keys, 725290001Sglebiusall of which are bound together by the protocol specifically 726290001Sglebiusto deflect masquerade attacks. 727290001SglebiusFor this reason Autokey 728298770Sdelphijincludes the source and destination IP addresses in message digest 729290001Sglebiuscomputations and so the same addresses must be available 730290001Sglebiusat both the server and client. 731290001SglebiusFor this reason operation 732290001Sglebiuswith network address translation schemes is not possible. 733290001SglebiusThis reflects the intended robust security model where government 734290001Sglebiusand corporate NTP servers are operated outside firewall perimeters. 735290001Sglebius.Ss Operation 736290001SglebiusA specific combination of authentication scheme (none, 737290001Sglebiussymmetric key, public key) and identity scheme is called 738290001Sglebiusa cryptotype, although not all combinations are compatible. 739290001SglebiusThere may be management configurations where the clients, 740290001Sglebiusservers and peers may not all support the same cryptotypes. 741290001SglebiusA secure NTPv4 subnet can be configured in many ways while 742290001Sglebiuskeeping in mind the principles explained above and 743290001Sglebiusin this section. 744290001SglebiusNote however that some cryptotype 745290001Sglebiuscombinations may successfully interoperate with each other, 746290001Sglebiusbut may not represent good security practice. 747290001Sglebius.Pp 748290001SglebiusThe cryptotype of an association is determined at the time 749290001Sglebiusof mobilization, either at configuration time or some time 750290001Sglebiuslater when a message of appropriate cryptotype arrives. 751290001SglebiusWhen mobilized by a 752290001Sglebius.Ic server 753290001Sglebiusor 754290001Sglebius.Ic peer 755290001Sglebiusconfiguration command and no 756290001Sglebius.Ic key 757290001Sglebiusor 758290001Sglebius.Ic autokey 759290001Sglebiussubcommands are present, the association is not 760290001Sglebiusauthenticated; if the 761290001Sglebius.Ic key 762290001Sglebiussubcommand is present, the association is authenticated 763290001Sglebiususing the symmetric key ID specified; if the 764290001Sglebius.Ic autokey 765290001Sglebiussubcommand is present, the association is authenticated 766290001Sglebiususing Autokey. 767290001Sglebius.Pp 768290001SglebiusWhen multiple identity schemes are supported in the Autokey 769290001Sglebiusprotocol, the first message exchange determines which one is used. 770290001SglebiusThe client request message contains bits corresponding 771290001Sglebiusto which schemes it has available. 772290001SglebiusThe server response message 773290001Sglebiuscontains bits corresponding to which schemes it has available. 774290001SglebiusBoth server and client match the received bits with their own 775290001Sglebiusand select a common scheme. 776290001Sglebius.Pp 777290001SglebiusFollowing the principle that time is a public value, 778290001Sglebiusa server responds to any client packet that matches 779290001Sglebiusits cryptotype capabilities. 780290001SglebiusThus, a server receiving 781290001Sglebiusan unauthenticated packet will respond with an unauthenticated 782290001Sglebiuspacket, while the same server receiving a packet of a cryptotype 783290001Sglebiusit supports will respond with packets of that cryptotype. 784290001SglebiusHowever, unconfigured broadcast or manycast client 785290001Sglebiusassociations or symmetric passive associations will not be 786290001Sglebiusmobilized unless the server supports a cryptotype compatible 787290001Sglebiuswith the first packet received. 788290001SglebiusBy default, unauthenticated associations will not be mobilized 789290001Sglebiusunless overridden in a decidedly dangerous way. 790290001Sglebius.Pp 791290001SglebiusSome examples may help to reduce confusion. 792290001SglebiusClient Alice has no specific cryptotype selected. 793290001SglebiusServer Bob has both a symmetric key file and minimal Autokey files. 794290001SglebiusAlice's unauthenticated messages arrive at Bob, who replies with 795290001Sglebiusunauthenticated messages. 796290001SglebiusCathy has a copy of Bob's symmetric 797290001Sglebiuskey file and has selected key ID 4 in messages to Bob. 798290001SglebiusBob verifies the message with his key ID 4. 799290001SglebiusIf it's the 800290001Sglebiussame key and the message is verified, Bob sends Cathy a reply 801290001Sglebiusauthenticated with that key. 802290001SglebiusIf verification fails, 803290001SglebiusBob sends Cathy a thing called a crypto\-NAK, which tells her 804290001Sglebiussomething broke. 805290001SglebiusShe can see the evidence using the 806290001Sglebius.Xr ntpq @NTPQ_MS@ 807290001Sglebiusprogram. 808290001Sglebius.Pp 809290001SglebiusDenise has rolled her own host key and certificate. 810290001SglebiusShe also uses one of the identity schemes as Bob. 811290001SglebiusShe sends the first Autokey message to Bob and they 812290001Sglebiusboth dance the protocol authentication and identity steps. 813290001SglebiusIf all comes out okay, Denise and Bob continue as described above. 814290001Sglebius.Pp 815290001SglebiusIt should be clear from the above that Bob can support 816290001Sglebiusall the girls at the same time, as long as he has compatible 817290001Sglebiusauthentication and identity credentials. 818290001SglebiusNow, Bob can act just like the girls in his own choice of servers; 819290001Sglebiushe can run multiple configured associations with multiple different 820290001Sglebiusservers (or the same server, although that might not be useful). 821290001SglebiusBut, wise security policy might preclude some cryptotype 822290001Sglebiuscombinations; for instance, running an identity scheme 823290001Sglebiuswith one server and no authentication with another might not be wise. 824290001Sglebius.Ss Key Management 825290001SglebiusThe cryptographic values used by the Autokey protocol are 826290001Sglebiusincorporated as a set of files generated by the 827290001Sglebius.Xr ntp\-keygen 1ntpkeygenmdoc 828290001Sglebiusutility program, including symmetric key, host key and 829290001Sglebiuspublic certificate files, as well as sign key, identity parameters 830290001Sglebiusand leapseconds files. 831290001SglebiusAlternatively, host and sign keys and 832290001Sglebiuscertificate files can be generated by the OpenSSL utilities 833290001Sglebiusand certificates can be imported from public certificate 834290001Sglebiusauthorities. 835290001SglebiusNote that symmetric keys are necessary for the 836290001Sglebius.Xr ntpq @NTPQ_MS@ 837290001Sglebiusand 838290001Sglebius.Xr ntpdc @NTPDC_MS@ 839290001Sglebiusutility programs. 840290001SglebiusThe remaining files are necessary only for the 841290001SglebiusAutokey protocol. 842290001Sglebius.Pp 843290001SglebiusCertificates imported from OpenSSL or public certificate 844290001Sglebiusauthorities have certian limitations. 845290001SglebiusThe certificate should be in ASN.1 syntax, X.509 Version 3 846290001Sglebiusformat and encoded in PEM, which is the same format 847290001Sglebiusused by OpenSSL. 848290001SglebiusThe overall length of the certificate encoded 849290001Sglebiusin ASN.1 must not exceed 1024 bytes. 850290001SglebiusThe subject distinguished 851290001Sglebiusname field (CN) is the fully qualified name of the host 852290001Sglebiuson which it is used; the remaining subject fields are ignored. 853290001SglebiusThe certificate extension fields must not contain either 854290001Sglebiusa subject key identifier or a issuer key identifier field; 855290001Sglebiushowever, an extended key usage field for a trusted host must 856290001Sglebiuscontain the value 857290001Sglebius.Cm trustRoot ; . 858290001SglebiusOther extension fields are ignored. 859290001Sglebius.Ss Authentication Commands 860290001Sglebius.Bl -tag -width indent 861290001Sglebius.It Ic autokey Op Ar logsec 862290001SglebiusSpecifies the interval between regenerations of the session key 863290001Sglebiuslist used with the Autokey protocol. 864290001SglebiusNote that the size of the key 865290001Sglebiuslist for each association depends on this interval and the current 866290001Sglebiuspoll interval. 867290001SglebiusThe default value is 12 (4096 s or about 1.1 hours). 868290001SglebiusFor poll intervals above the specified interval, a session key list 869290001Sglebiuswith a single entry will be regenerated for every message 870290001Sglebiussent. 871290001Sglebius.It Ic controlkey Ar key 872290001SglebiusSpecifies the key identifier to use with the 873290001Sglebius.Xr ntpq @NTPQ_MS@ 874290001Sglebiusutility, which uses the standard 875290001Sglebiusprotocol defined in RFC\-1305. 876290001SglebiusThe 877290001Sglebius.Ar key 878290001Sglebiusargument is 879290001Sglebiusthe key identifier for a trusted key, where the value can be in the 880290001Sglebiusrange 1 to 65,534, inclusive. 881290001Sglebius.It Xo Ic crypto 882290001Sglebius.Op Cm cert Ar file 883290001Sglebius.Op Cm leap Ar file 884290001Sglebius.Op Cm randfile Ar file 885290001Sglebius.Op Cm host Ar file 886290001Sglebius.Op Cm sign Ar file 887290001Sglebius.Op Cm gq Ar file 888290001Sglebius.Op Cm gqpar Ar file 889290001Sglebius.Op Cm iffpar Ar file 890290001Sglebius.Op Cm mvpar Ar file 891290001Sglebius.Op Cm pw Ar password 892290001Sglebius.Xc 893290001SglebiusThis command requires the OpenSSL library. 894290001SglebiusIt activates public key 895290001Sglebiuscryptography, selects the message digest and signature 896290001Sglebiusencryption scheme and loads the required private and public 897290001Sglebiusvalues described above. 898290001SglebiusIf one or more files are left unspecified, 899290001Sglebiusthe default names are used as described above. 900290001SglebiusUnless the complete path and name of the file are specified, the 901290001Sglebiuslocation of a file is relative to the keys directory specified 902290001Sglebiusin the 903290001Sglebius.Ic keysdir 904290001Sglebiuscommand or default 905290001Sglebius.Pa /usr/local/etc . 906290001SglebiusFollowing are the subcommands: 907290001Sglebius.Bl -tag -width indent 908290001Sglebius.It Cm cert Ar file 909290001SglebiusSpecifies the location of the required host public certificate file. 910290001SglebiusThis overrides the link 911290001Sglebius.Pa ntpkey_cert_ Ns Ar hostname 912290001Sglebiusin the keys directory. 913290001Sglebius.It Cm gqpar Ar file 914290001SglebiusSpecifies the location of the optional GQ parameters file. 915290001SglebiusThis 916290001Sglebiusoverrides the link 917290001Sglebius.Pa ntpkey_gq_ Ns Ar hostname 918290001Sglebiusin the keys directory. 919290001Sglebius.It Cm host Ar file 920290001SglebiusSpecifies the location of the required host key file. 921290001SglebiusThis overrides 922290001Sglebiusthe link 923290001Sglebius.Pa ntpkey_key_ Ns Ar hostname 924290001Sglebiusin the keys directory. 925290001Sglebius.It Cm iffpar Ar file 926298770SdelphijSpecifies the location of the optional IFF parameters file. 927298770SdelphijThis overrides the link 928290001Sglebius.Pa ntpkey_iff_ Ns Ar hostname 929290001Sglebiusin the keys directory. 930290001Sglebius.It Cm leap Ar file 931290001SglebiusSpecifies the location of the optional leapsecond file. 932290001SglebiusThis overrides the link 933290001Sglebius.Pa ntpkey_leap 934290001Sglebiusin the keys directory. 935290001Sglebius.It Cm mvpar Ar file 936290001SglebiusSpecifies the location of the optional MV parameters file. 937298770SdelphijThis overrides the link 938290001Sglebius.Pa ntpkey_mv_ Ns Ar hostname 939290001Sglebiusin the keys directory. 940290001Sglebius.It Cm pw Ar password 941290001SglebiusSpecifies the password to decrypt files containing private keys and 942290001Sglebiusidentity parameters. 943290001SglebiusThis is required only if these files have been 944290001Sglebiusencrypted. 945290001Sglebius.It Cm randfile Ar file 946290001SglebiusSpecifies the location of the random seed file used by the OpenSSL 947290001Sglebiuslibrary. 948290001SglebiusThe defaults are described in the main text above. 949290001Sglebius.It Cm sign Ar file 950290001SglebiusSpecifies the location of the optional sign key file. 951290001SglebiusThis overrides 952290001Sglebiusthe link 953290001Sglebius.Pa ntpkey_sign_ Ns Ar hostname 954290001Sglebiusin the keys directory. 955290001SglebiusIf this file is 956290001Sglebiusnot found, the host key is also the sign key. 957290001Sglebius.El 958290001Sglebius.It Ic keys Ar keyfile 959290001SglebiusSpecifies the complete path and location of the MD5 key file 960290001Sglebiuscontaining the keys and key identifiers used by 961290001Sglebius.Xr ntpd @NTPD_MS@ , 962290001Sglebius.Xr ntpq @NTPQ_MS@ 963290001Sglebiusand 964290001Sglebius.Xr ntpdc @NTPDC_MS@ 965290001Sglebiuswhen operating with symmetric key cryptography. 966290001SglebiusThis is the same operation as the 967290001Sglebius.Fl k 968290001Sglebiuscommand line option. 969290001Sglebius.It Ic keysdir Ar path 970290001SglebiusThis command specifies the default directory path for 971290001Sglebiuscryptographic keys, parameters and certificates. 972290001SglebiusThe default is 973290001Sglebius.Pa /usr/local/etc/ . 974290001Sglebius.It Ic requestkey Ar key 975290001SglebiusSpecifies the key identifier to use with the 976290001Sglebius.Xr ntpdc @NTPDC_MS@ 977290001Sglebiusutility program, which uses a 978290001Sglebiusproprietary protocol specific to this implementation of 979290001Sglebius.Xr ntpd @NTPD_MS@ . 980290001SglebiusThe 981290001Sglebius.Ar key 982290001Sglebiusargument is a key identifier 983290001Sglebiusfor the trusted key, where the value can be in the range 1 to 984290001Sglebius65,534, inclusive. 985290001Sglebius.It Ic revoke Ar logsec 986290001SglebiusSpecifies the interval between re\-randomization of certain 987290001Sglebiuscryptographic values used by the Autokey scheme, as a power of 2 in 988290001Sglebiusseconds. 989290001SglebiusThese values need to be updated frequently in order to 990290001Sglebiusdeflect brute\-force attacks on the algorithms of the scheme; 991290001Sglebiushowever, updating some values is a relatively expensive operation. 992290001SglebiusThe default interval is 16 (65,536 s or about 18 hours). 993290001SglebiusFor poll 994290001Sglebiusintervals above the specified interval, the values will be updated 995290001Sglebiusfor every message sent. 996290001Sglebius.It Ic trustedkey Ar key ... 997290001SglebiusSpecifies the key identifiers which are trusted for the 998290001Sglebiuspurposes of authenticating peers with symmetric key cryptography, 999290001Sglebiusas well as keys used by the 1000290001Sglebius.Xr ntpq @NTPQ_MS@ 1001290001Sglebiusand 1002290001Sglebius.Xr ntpdc @NTPDC_MS@ 1003290001Sglebiusprograms. 1004290001SglebiusThe authentication procedures require that both the local 1005290001Sglebiusand remote servers share the same key and key identifier for this 1006290001Sglebiuspurpose, although different keys can be used with different 1007290001Sglebiusservers. 1008290001SglebiusThe 1009290001Sglebius.Ar key 1010290001Sglebiusarguments are 32\-bit unsigned 1011290001Sglebiusintegers with values from 1 to 65,534. 1012290001Sglebius.El 1013290001Sglebius.Ss Error Codes 1014290001SglebiusThe following error codes are reported via the NTP control 1015290001Sglebiusand monitoring protocol trap mechanism. 1016290001Sglebius.Bl -tag -width indent 1017290001Sglebius.It 101 1018290001Sglebius.Pq bad field format or length 1019290001SglebiusThe packet has invalid version, length or format. 1020290001Sglebius.It 102 1021290001Sglebius.Pq bad timestamp 1022290001SglebiusThe packet timestamp is the same or older than the most recent received. 1023290001SglebiusThis could be due to a replay or a server clock time step. 1024290001Sglebius.It 103 1025290001Sglebius.Pq bad filestamp 1026290001SglebiusThe packet filestamp is the same or older than the most recent received. 1027290001SglebiusThis could be due to a replay or a key file generation error. 1028290001Sglebius.It 104 1029290001Sglebius.Pq bad or missing public key 1030290001SglebiusThe public key is missing, has incorrect format or is an unsupported type. 1031290001Sglebius.It 105 1032290001Sglebius.Pq unsupported digest type 1033290001SglebiusThe server requires an unsupported digest/signature scheme. 1034290001Sglebius.It 106 1035290001Sglebius.Pq mismatched digest types 1036290001SglebiusNot used. 1037290001Sglebius.It 107 1038290001Sglebius.Pq bad signature length 1039290001SglebiusThe signature length does not match the current public key. 1040290001Sglebius.It 108 1041290001Sglebius.Pq signature not verified 1042290001SglebiusThe message fails the signature check. 1043290001SglebiusIt could be bogus or signed by a 1044290001Sglebiusdifferent private key. 1045290001Sglebius.It 109 1046290001Sglebius.Pq certificate not verified 1047290001SglebiusThe certificate is invalid or signed with the wrong key. 1048290001Sglebius.It 110 1049290001Sglebius.Pq certificate not verified 1050290001SglebiusThe certificate is not yet valid or has expired or the signature could not 1051290001Sglebiusbe verified. 1052290001Sglebius.It 111 1053290001Sglebius.Pq bad or missing cookie 1054290001SglebiusThe cookie is missing, corrupted or bogus. 1055290001Sglebius.It 112 1056290001Sglebius.Pq bad or missing leapseconds table 1057290001SglebiusThe leapseconds table is missing, corrupted or bogus. 1058290001Sglebius.It 113 1059290001Sglebius.Pq bad or missing certificate 1060290001SglebiusThe certificate is missing, corrupted or bogus. 1061290001Sglebius.It 114 1062290001Sglebius.Pq bad or missing identity 1063290001SglebiusThe identity key is missing, corrupt or bogus. 1064290001Sglebius.El 1065290001Sglebius.Sh Monitoring Support 1066290001Sglebius.Xr ntpd @NTPD_MS@ 1067290001Sglebiusincludes a comprehensive monitoring facility suitable 1068290001Sglebiusfor continuous, long term recording of server and client 1069290001Sglebiustimekeeping performance. 1070290001SglebiusSee the 1071290001Sglebius.Ic statistics 1072290001Sglebiuscommand below 1073290001Sglebiusfor a listing and example of each type of statistics currently 1074290001Sglebiussupported. 1075290001SglebiusStatistic files are managed using file generation sets 1076290001Sglebiusand scripts in the 1077290001Sglebius.Pa ./scripts 1078298770Sdelphijdirectory of the source code distribution. 1079290001SglebiusUsing 1080290001Sglebiusthese facilities and 1081290001Sglebius.Ux 1082290001Sglebius.Xr cron 8 1083290001Sglebiusjobs, the data can be 1084290001Sglebiusautomatically summarized and archived for retrospective analysis. 1085290001Sglebius.Ss Monitoring Commands 1086290001Sglebius.Bl -tag -width indent 1087290001Sglebius.It Ic statistics Ar name ... 1088290001SglebiusEnables writing of statistics records. 1089290001SglebiusCurrently, eight kinds of 1090290001Sglebius.Ar name 1091290001Sglebiusstatistics are supported. 1092290001Sglebius.Bl -tag -width indent 1093290001Sglebius.It Cm clockstats 1094290001SglebiusEnables recording of clock driver statistics information. 1095290001SglebiusEach update 1096290001Sglebiusreceived from a clock driver appends a line of the following form to 1097290001Sglebiusthe file generation set named 1098290001Sglebius.Cm clockstats : 1099290001Sglebius.Bd -literal 1100290001Sglebius49213 525.624 127.127.4.1 93 226 00:08:29.606 D 1101290001Sglebius.Ed 1102290001Sglebius.Pp 1103290001SglebiusThe first two fields show the date (Modified Julian Day) and time 1104290001Sglebius(seconds and fraction past UTC midnight). 1105290001SglebiusThe next field shows the 1106290001Sglebiusclock address in dotted\-quad notation. 1107290001SglebiusThe final field shows the last 1108290001Sglebiustimecode received from the clock in decoded ASCII format, where 1109290001Sglebiusmeaningful. 1110290001SglebiusIn some clock drivers a good deal of additional information 1111290001Sglebiuscan be gathered and displayed as well. 1112290001SglebiusSee information specific to each 1113290001Sglebiusclock for further details. 1114290001Sglebius.It Cm cryptostats 1115290001SglebiusThis option requires the OpenSSL cryptographic software library. 1116290001SglebiusIt 1117290001Sglebiusenables recording of cryptographic public key protocol information. 1118290001SglebiusEach message received by the protocol module appends a line of the 1119290001Sglebiusfollowing form to the file generation set named 1120290001Sglebius.Cm cryptostats : 1121290001Sglebius.Bd -literal 1122290001Sglebius49213 525.624 127.127.4.1 message 1123290001Sglebius.Ed 1124290001Sglebius.Pp 1125290001SglebiusThe first two fields show the date (Modified Julian Day) and time 1126290001Sglebius(seconds and fraction past UTC midnight). 1127290001SglebiusThe next field shows the peer 1128290001Sglebiusaddress in dotted\-quad notation, The final message field includes the 1129290001Sglebiusmessage type and certain ancillary information. 1130290001SglebiusSee the 1131290001Sglebius.Sx Authentication Options 1132290001Sglebiussection for further information. 1133290001Sglebius.It Cm loopstats 1134290001SglebiusEnables recording of loop filter statistics information. 1135290001SglebiusEach 1136290001Sglebiusupdate of the local clock outputs a line of the following form to 1137290001Sglebiusthe file generation set named 1138290001Sglebius.Cm loopstats : 1139290001Sglebius.Bd -literal 1140290001Sglebius50935 75440.031 0.000006019 13.778190 0.000351733 0.0133806 1141290001Sglebius.Ed 1142290001Sglebius.Pp 1143290001SglebiusThe first two fields show the date (Modified Julian Day) and 1144290001Sglebiustime (seconds and fraction past UTC midnight). 1145290001SglebiusThe next five fields 1146290001Sglebiusshow time offset (seconds), frequency offset (parts per million \- 1147290001SglebiusPPM), RMS jitter (seconds), Allan deviation (PPM) and clock 1148290001Sglebiusdiscipline time constant. 1149290001Sglebius.It Cm peerstats 1150290001SglebiusEnables recording of peer statistics information. 1151290001SglebiusThis includes 1152290001Sglebiusstatistics records of all peers of a NTP server and of special 1153290001Sglebiussignals, where present and configured. 1154290001SglebiusEach valid update appends a 1155290001Sglebiusline of the following form to the current element of a file 1156290001Sglebiusgeneration set named 1157290001Sglebius.Cm peerstats : 1158290001Sglebius.Bd -literal 1159290001Sglebius48773 10847.650 127.127.4.1 9714 \-0.001605376 0.000000000 0.001424877 0.000958674 1160290001Sglebius.Ed 1161290001Sglebius.Pp 1162290001SglebiusThe first two fields show the date (Modified Julian Day) and 1163290001Sglebiustime (seconds and fraction past UTC midnight). 1164290001SglebiusThe next two fields 1165290001Sglebiusshow the peer address in dotted\-quad notation and status, 1166290001Sglebiusrespectively. 1167290001SglebiusThe status field is encoded in hex in the format 1168290001Sglebiusdescribed in Appendix A of the NTP specification RFC 1305. 1169290001SglebiusThe final four fields show the offset, 1170290001Sglebiusdelay, dispersion and RMS jitter, all in seconds. 1171290001Sglebius.It Cm rawstats 1172290001SglebiusEnables recording of raw\-timestamp statistics information. 1173290001SglebiusThis 1174290001Sglebiusincludes statistics records of all peers of a NTP server and of 1175290001Sglebiusspecial signals, where present and configured. 1176290001SglebiusEach NTP message 1177290001Sglebiusreceived from a peer or clock driver appends a line of the 1178290001Sglebiusfollowing form to the file generation set named 1179290001Sglebius.Cm rawstats : 1180290001Sglebius.Bd -literal 1181290001Sglebius50928 2132.543 128.4.1.1 128.4.1.20 3102453281.584327000 3102453281.58622800031 02453332.540806000 3102453332.541458000 1182290001Sglebius.Ed 1183290001Sglebius.Pp 1184290001SglebiusThe first two fields show the date (Modified Julian Day) and 1185290001Sglebiustime (seconds and fraction past UTC midnight). 1186290001SglebiusThe next two fields 1187290001Sglebiusshow the remote peer or clock address followed by the local address 1188290001Sglebiusin dotted\-quad notation. 1189290001SglebiusThe final four fields show the originate, 1190290001Sglebiusreceive, transmit and final NTP timestamps in order. 1191290001SglebiusThe timestamp 1192290001Sglebiusvalues are as received and before processing by the various data 1193290001Sglebiussmoothing and mitigation algorithms. 1194290001Sglebius.It Cm sysstats 1195290001SglebiusEnables recording of ntpd statistics counters on a periodic basis. 1196290001SglebiusEach 1197290001Sglebiushour a line of the following form is appended to the file generation 1198290001Sglebiusset named 1199290001Sglebius.Cm sysstats : 1200290001Sglebius.Bd -literal 1201290001Sglebius50928 2132.543 36000 81965 0 9546 56 71793 512 540 10 147 1202290001Sglebius.Ed 1203290001Sglebius.Pp 1204290001SglebiusThe first two fields show the date (Modified Julian Day) and time 1205290001Sglebius(seconds and fraction past UTC midnight). 1206290001SglebiusThe remaining ten fields show 1207290001Sglebiusthe statistics counter values accumulated since the last generated 1208290001Sglebiusline. 1209290001Sglebius.Bl -tag -width indent 1210290001Sglebius.It Time since restart Cm 36000 1211290001SglebiusTime in hours since the system was last rebooted. 1212290001Sglebius.It Packets received Cm 81965 1213290001SglebiusTotal number of packets received. 1214290001Sglebius.It Packets processed Cm 0 1215290001SglebiusNumber of packets received in response to previous packets sent 1216290001Sglebius.It Current version Cm 9546 1217290001SglebiusNumber of packets matching the current NTP version. 1218290001Sglebius.It Previous version Cm 56 1219290001SglebiusNumber of packets matching the previous NTP version. 1220290001Sglebius.It Bad version Cm 71793 1221290001SglebiusNumber of packets matching neither NTP version. 1222290001Sglebius.It Access denied Cm 512 1223290001SglebiusNumber of packets denied access for any reason. 1224290001Sglebius.It Bad length or format Cm 540 1225290001SglebiusNumber of packets with invalid length, format or port number. 1226290001Sglebius.It Bad authentication Cm 10 1227290001SglebiusNumber of packets not verified as authentic. 1228290001Sglebius.It Rate exceeded Cm 147 1229290001SglebiusNumber of packets discarded due to rate limitation. 1230290001Sglebius.El 1231290001Sglebius.It Cm statsdir Ar directory_path 1232290001SglebiusIndicates the full path of a directory where statistics files 1233290001Sglebiusshould be created (see below). 1234290001SglebiusThis keyword allows 1235290001Sglebiusthe (otherwise constant) 1236290001Sglebius.Cm filegen 1237290001Sglebiusfilename prefix to be modified for file generation sets, which 1238290001Sglebiusis useful for handling statistics logs. 1239290001Sglebius.It Cm filegen Ar name Xo 1240290001Sglebius.Op Cm file Ar filename 1241290001Sglebius.Op Cm type Ar typename 1242290001Sglebius.Op Cm link | nolink 1243290001Sglebius.Op Cm enable | disable 1244290001Sglebius.Xc 1245290001SglebiusConfigures setting of generation file set name. 1246290001SglebiusGeneration 1247290001Sglebiusfile sets provide a means for handling files that are 1248290001Sglebiuscontinuously growing during the lifetime of a server. 1249290001SglebiusServer statistics are a typical example for such files. 1250290001SglebiusGeneration file sets provide access to a set of files used 1251290001Sglebiusto store the actual data. 1252290001SglebiusAt any time at most one element 1253290001Sglebiusof the set is being written to. 1254290001SglebiusThe type given specifies 1255290001Sglebiuswhen and how data will be directed to a new element of the set. 1256290001SglebiusThis way, information stored in elements of a file set 1257290001Sglebiusthat are currently unused are available for administrational 1258290001Sglebiusoperations without the risk of disturbing the operation of ntpd. 1259290001Sglebius(Most important: they can be removed to free space for new data 1260290001Sglebiusproduced.) 1261290001Sglebius.Pp 1262290001SglebiusNote that this command can be sent from the 1263290001Sglebius.Xr ntpdc @NTPDC_MS@ 1264290001Sglebiusprogram running at a remote location. 1265290001Sglebius.Bl -tag -width indent 1266290001Sglebius.It Cm name 1267290001SglebiusThis is the type of the statistics records, as shown in the 1268290001Sglebius.Cm statistics 1269290001Sglebiuscommand. 1270290001Sglebius.It Cm file Ar filename 1271290001SglebiusThis is the file name for the statistics records. 1272290001SglebiusFilenames of set 1273290001Sglebiusmembers are built from three concatenated elements 1274290001Sglebius.Ar Cm prefix , 1275290001Sglebius.Ar Cm filename 1276290001Sglebiusand 1277290001Sglebius.Ar Cm suffix : 1278290001Sglebius.Bl -tag -width indent 1279290001Sglebius.It Cm prefix 1280290001SglebiusThis is a constant filename path. 1281290001SglebiusIt is not subject to 1282290001Sglebiusmodifications via the 1283290001Sglebius.Ar filegen 1284290001Sglebiusoption. 1285290001SglebiusIt is defined by the 1286290001Sglebiusserver, usually specified as a compile\-time constant. 1287290001SglebiusIt may, 1288290001Sglebiushowever, be configurable for individual file generation sets 1289290001Sglebiusvia other commands. 1290290001SglebiusFor example, the prefix used with 1291290001Sglebius.Ar loopstats 1292290001Sglebiusand 1293290001Sglebius.Ar peerstats 1294290001Sglebiusgeneration can be configured using the 1295290001Sglebius.Ar statsdir 1296290001Sglebiusoption explained above. 1297290001Sglebius.It Cm filename 1298290001SglebiusThis string is directly concatenated to the prefix mentioned 1299290001Sglebiusabove (no intervening 1300290001Sglebius.Ql / ) . 1301290001SglebiusThis can be modified using 1302290001Sglebiusthe file argument to the 1303290001Sglebius.Ar filegen 1304290001Sglebiusstatement. 1305290001SglebiusNo 1306290001Sglebius.Pa .. 1307290001Sglebiuselements are 1308290001Sglebiusallowed in this component to prevent filenames referring to 1309290001Sglebiusparts outside the filesystem hierarchy denoted by 1310290001Sglebius.Ar prefix . 1311290001Sglebius.It Cm suffix 1312290001SglebiusThis part is reflects individual elements of a file set. 1313290001SglebiusIt is 1314290001Sglebiusgenerated according to the type of a file set. 1315290001Sglebius.El 1316290001Sglebius.It Cm type Ar typename 1317290001SglebiusA file generation set is characterized by its type. 1318290001SglebiusThe following 1319290001Sglebiustypes are supported: 1320290001Sglebius.Bl -tag -width indent 1321290001Sglebius.It Cm none 1322290001SglebiusThe file set is actually a single plain file. 1323290001Sglebius.It Cm pid 1324290001SglebiusOne element of file set is used per incarnation of a ntpd 1325290001Sglebiusserver. 1326290001SglebiusThis type does not perform any changes to file set 1327290001Sglebiusmembers during runtime, however it provides an easy way of 1328290001Sglebiusseparating files belonging to different 1329290001Sglebius.Xr ntpd @NTPD_MS@ 1330290001Sglebiusserver incarnations. 1331290001SglebiusThe set member filename is built by appending a 1332290001Sglebius.Ql \&. 1333290001Sglebiusto concatenated 1334290001Sglebius.Ar prefix 1335290001Sglebiusand 1336290001Sglebius.Ar filename 1337290001Sglebiusstrings, and 1338290001Sglebiusappending the decimal representation of the process ID of the 1339290001Sglebius.Xr ntpd @NTPD_MS@ 1340290001Sglebiusserver process. 1341290001Sglebius.It Cm day 1342290001SglebiusOne file generation set element is created per day. 1343290001SglebiusA day is 1344290001Sglebiusdefined as the period between 00:00 and 24:00 UTC. 1345290001SglebiusThe file set 1346290001Sglebiusmember suffix consists of a 1347290001Sglebius.Ql \&. 1348290001Sglebiusand a day specification in 1349290001Sglebiusthe form 1350290001Sglebius.Cm YYYYMMdd . 1351290001Sglebius.Cm YYYY 1352290001Sglebiusis a 4\-digit year number (e.g., 1992). 1353290001Sglebius.Cm MM 1354290001Sglebiusis a two digit month number. 1355290001Sglebius.Cm dd 1356290001Sglebiusis a two digit day number. 1357290001SglebiusThus, all information written at 10 December 1992 would end up 1358290001Sglebiusin a file named 1359290001Sglebius.Ar prefix 1360290001Sglebius.Ar filename Ns .19921210 . 1361290001Sglebius.It Cm week 1362290001SglebiusAny file set member contains data related to a certain week of 1363290001Sglebiusa year. 1364290001SglebiusThe term week is defined by computing day\-of\-year 1365290001Sglebiusmodulo 7. 1366290001SglebiusElements of such a file generation set are 1367290001Sglebiusdistinguished by appending the following suffix to the file set 1368290001Sglebiusfilename base: A dot, a 4\-digit year number, the letter 1369290001Sglebius.Cm W , 1370290001Sglebiusand a 2\-digit week number. 1371290001SglebiusFor example, information from January, 1372290001Sglebius10th 1992 would end up in a file with suffix 1373290001Sglebius.No . Ns Ar 1992W1 . 1374290001Sglebius.It Cm month 1375290001SglebiusOne generation file set element is generated per month. 1376290001SglebiusThe 1377290001Sglebiusfile name suffix consists of a dot, a 4\-digit year number, and 1378290001Sglebiusa 2\-digit month. 1379290001Sglebius.It Cm year 1380290001SglebiusOne generation file element is generated per year. 1381290001SglebiusThe filename 1382290001Sglebiussuffix consists of a dot and a 4 digit year number. 1383290001Sglebius.It Cm age 1384290001SglebiusThis type of file generation sets changes to a new element of 1385290001Sglebiusthe file set every 24 hours of server operation. 1386290001SglebiusThe filename 1387290001Sglebiussuffix consists of a dot, the letter 1388290001Sglebius.Cm a , 1389290001Sglebiusand an 8\-digit number. 1390290001SglebiusThis number is taken to be the number of seconds the server is 1391290001Sglebiusrunning at the start of the corresponding 24\-hour period. 1392290001SglebiusInformation is only written to a file generation by specifying 1393290001Sglebius.Cm enable ; 1394290001Sglebiusoutput is prevented by specifying 1395290001Sglebius.Cm disable . 1396290001Sglebius.El 1397290001Sglebius.It Cm link | nolink 1398290001SglebiusIt is convenient to be able to access the current element of a file 1399290001Sglebiusgeneration set by a fixed name. 1400290001SglebiusThis feature is enabled by 1401290001Sglebiusspecifying 1402290001Sglebius.Cm link 1403290001Sglebiusand disabled using 1404290001Sglebius.Cm nolink . 1405290001SglebiusIf link is specified, a 1406290001Sglebiushard link from the current file set element to a file without 1407290001Sglebiussuffix is created. 1408290001SglebiusWhen there is already a file with this name and 1409290001Sglebiusthe number of links of this file is one, it is renamed appending a 1410290001Sglebiusdot, the letter 1411290001Sglebius.Cm C , 1412298770Sdelphijand the pid of the 1413298770Sdelphij.Xr ntpd @NTPD_MS@ 1414298770Sdelphijserver process. 1415290001SglebiusWhen the 1416290001Sglebiusnumber of links is greater than one, the file is unlinked. 1417290001SglebiusThis 1418290001Sglebiusallows the current file to be accessed by a constant name. 1419290001Sglebius.It Cm enable \&| Cm disable 1420290001SglebiusEnables or disables the recording function. 1421290001Sglebius.El 1422290001Sglebius.El 1423290001Sglebius.El 1424290001Sglebius.Sh Access Control Support 1425290001SglebiusThe 1426290001Sglebius.Xr ntpd @NTPD_MS@ 1427290001Sglebiusdaemon implements a general purpose address/mask based restriction 1428290001Sglebiuslist. 1429290001SglebiusThe list contains address/match entries sorted first 1430290001Sglebiusby increasing address values and and then by increasing mask values. 1431290001SglebiusA match occurs when the bitwise AND of the mask and the packet 1432290001Sglebiussource address is equal to the bitwise AND of the mask and 1433290001Sglebiusaddress in the list. 1434290001SglebiusThe list is searched in order with the 1435290001Sglebiuslast match found defining the restriction flags associated 1436290001Sglebiuswith the entry. 1437290001SglebiusAdditional information and examples can be found in the 1438290001Sglebius.Qq Notes on Configuring NTP and Setting up a NTP Subnet 1439290001Sglebiuspage 1440290001Sglebius(available as part of the HTML documentation 1441290001Sglebiusprovided in 1442290001Sglebius.Pa /usr/share/doc/ntp ) . 1443290001Sglebius.Pp 1444290001SglebiusThe restriction facility was implemented in conformance 1445290001Sglebiuswith the access policies for the original NSFnet backbone 1446290001Sglebiustime servers. 1447290001SglebiusLater the facility was expanded to deflect 1448290001Sglebiuscryptographic and clogging attacks. 1449290001SglebiusWhile this facility may 1450290001Sglebiusbe useful for keeping unwanted or broken or malicious clients 1451290001Sglebiusfrom congesting innocent servers, it should not be considered 1452290001Sglebiusan alternative to the NTP authentication facilities. 1453290001SglebiusSource address based restrictions are easily circumvented 1454290001Sglebiusby a determined cracker. 1455290001Sglebius.Pp 1456290001SglebiusClients can be denied service because they are explicitly 1457298770Sdelphijincluded in the restrict list created by the 1458298770Sdelphij.Ic restrict 1459298770Sdelphijcommand 1460290001Sglebiusor implicitly as the result of cryptographic or rate limit 1461290001Sglebiusviolations. 1462290001SglebiusCryptographic violations include certificate 1463290001Sglebiusor identity verification failure; rate limit violations generally 1464290001Sglebiusresult from defective NTP implementations that send packets 1465290001Sglebiusat abusive rates. 1466290001SglebiusSome violations cause denied service 1467290001Sglebiusonly for the offending packet, others cause denied service 1468290001Sglebiusfor a timed period and others cause the denied service for 1469298770Sdelphijan indefinite period. 1470290001SglebiusWhen a client or network is denied access 1471298770Sdelphijfor an indefinite period, the only way at present to remove 1472290001Sglebiusthe restrictions is by restarting the server. 1473290001Sglebius.Ss The Kiss\-of\-Death Packet 1474290001SglebiusOrdinarily, packets denied service are simply dropped with no 1475290001Sglebiusfurther action except incrementing statistics counters. 1476290001SglebiusSometimes a 1477290001Sglebiusmore proactive response is needed, such as a server message that 1478290001Sglebiusexplicitly requests the client to stop sending and leave a message 1479290001Sglebiusfor the system operator. 1480290001SglebiusA special packet format has been created 1481290001Sglebiusfor this purpose called the "kiss\-of\-death" (KoD) packet. 1482290001SglebiusKoD packets have the leap bits set unsynchronized and stratum set 1483290001Sglebiusto zero and the reference identifier field set to a four\-byte 1484290001SglebiusASCII code. 1485290001SglebiusIf the 1486290001Sglebius.Cm noserve 1487290001Sglebiusor 1488290001Sglebius.Cm notrust 1489290001Sglebiusflag of the matching restrict list entry is set, 1490290001Sglebiusthe code is "DENY"; if the 1491290001Sglebius.Cm limited 1492290001Sglebiusflag is set and the rate limit 1493290001Sglebiusis exceeded, the code is "RATE". 1494290001SglebiusFinally, if a cryptographic violation occurs, the code is "CRYP". 1495290001Sglebius.Pp 1496290001SglebiusA client receiving a KoD performs a set of sanity checks to 1497290001Sglebiusminimize security exposure, then updates the stratum and 1498290001Sglebiusreference identifier peer variables, sets the access 1499290001Sglebiusdenied (TEST4) bit in the peer flash variable and sends 1500290001Sglebiusa message to the log. 1501290001SglebiusAs long as the TEST4 bit is set, 1502290001Sglebiusthe client will send no further packets to the server. 1503290001SglebiusThe only way at present to recover from this condition is 1504290001Sglebiusto restart the protocol at both the client and server. 1505290001SglebiusThis 1506290001Sglebiushappens automatically at the client when the association times out. 1507290001SglebiusIt will happen at the server only if the server operator cooperates. 1508290001Sglebius.Ss Access Control Commands 1509290001Sglebius.Bl -tag -width indent 1510290001Sglebius.It Xo Ic discard 1511290001Sglebius.Op Cm average Ar avg 1512290001Sglebius.Op Cm minimum Ar min 1513290001Sglebius.Op Cm monitor Ar prob 1514290001Sglebius.Xc 1515290001SglebiusSet the parameters of the 1516290001Sglebius.Cm limited 1517290001Sglebiusfacility which protects the server from 1518290001Sglebiusclient abuse. 1519290001SglebiusThe 1520290001Sglebius.Cm average 1521290001Sglebiussubcommand specifies the minimum average packet 1522290001Sglebiusspacing, while the 1523290001Sglebius.Cm minimum 1524290001Sglebiussubcommand specifies the minimum packet spacing. 1525290001SglebiusPackets that violate these minima are discarded 1526290001Sglebiusand a kiss\-o'\-death packet returned if enabled. 1527290001SglebiusThe default 1528290001Sglebiusminimum average and minimum are 5 and 2, respectively. 1529298770SdelphijThe 1530298770Sdelphij.Ic monitor 1531298770Sdelphijsubcommand specifies the probability of discard 1532290001Sglebiusfor packets that overflow the rate\-control window. 1533290001Sglebius.It Xo Ic restrict address 1534290001Sglebius.Op Cm mask Ar mask 1535290001Sglebius.Op Ar flag ... 1536290001Sglebius.Xc 1537290001SglebiusThe 1538290001Sglebius.Ar address 1539290001Sglebiusargument expressed in 1540290001Sglebiusdotted\-quad form is the address of a host or network. 1541290001SglebiusAlternatively, the 1542290001Sglebius.Ar address 1543290001Sglebiusargument can be a valid host DNS name. 1544290001SglebiusThe 1545290001Sglebius.Ar mask 1546290001Sglebiusargument expressed in dotted\-quad form defaults to 1547290001Sglebius.Cm 255.255.255.255 , 1548290001Sglebiusmeaning that the 1549290001Sglebius.Ar address 1550290001Sglebiusis treated as the address of an individual host. 1551290001SglebiusA default entry (address 1552290001Sglebius.Cm 0.0.0.0 , 1553290001Sglebiusmask 1554290001Sglebius.Cm 0.0.0.0 ) 1555290001Sglebiusis always included and is always the first entry in the list. 1556290001SglebiusNote that text string 1557290001Sglebius.Cm default , 1558290001Sglebiuswith no mask option, may 1559290001Sglebiusbe used to indicate the default entry. 1560290001SglebiusIn the current implementation, 1561290001Sglebius.Cm flag 1562290001Sglebiusalways 1563290001Sglebiusrestricts access, i.e., an entry with no flags indicates that free 1564290001Sglebiusaccess to the server is to be given. 1565290001SglebiusThe flags are not orthogonal, 1566290001Sglebiusin that more restrictive flags will often make less restrictive 1567290001Sglebiusones redundant. 1568290001SglebiusThe flags can generally be classed into two 1569290001Sglebiuscategories, those which restrict time service and those which 1570290001Sglebiusrestrict informational queries and attempts to do run\-time 1571290001Sglebiusreconfiguration of the server. 1572290001SglebiusOne or more of the following flags 1573290001Sglebiusmay be specified: 1574290001Sglebius.Bl -tag -width indent 1575290001Sglebius.It Cm ignore 1576290001SglebiusDeny packets of all kinds, including 1577290001Sglebius.Xr ntpq @NTPQ_MS@ 1578290001Sglebiusand 1579290001Sglebius.Xr ntpdc @NTPDC_MS@ 1580290001Sglebiusqueries. 1581290001Sglebius.It Cm kod 1582290001SglebiusIf this flag is set when an access violation occurs, a kiss\-o'\-death 1583290001Sglebius(KoD) packet is sent. 1584290001SglebiusKoD packets are rate limited to no more than one 1585290001Sglebiusper second. 1586290001SglebiusIf another KoD packet occurs within one second after the 1587290001Sglebiuslast one, the packet is dropped. 1588290001Sglebius.It Cm limited 1589290001SglebiusDeny service if the packet spacing violates the lower limits specified 1590298770Sdelphijin the 1591298770Sdelphij.Ic discard 1592298770Sdelphijcommand. 1593290001SglebiusA history of clients is kept using the 1594290001Sglebiusmonitoring capability of 1595290001Sglebius.Xr ntpd @NTPD_MS@ . 1596290001SglebiusThus, monitoring is always active as 1597290001Sglebiuslong as there is a restriction entry with the 1598290001Sglebius.Cm limited 1599290001Sglebiusflag. 1600290001Sglebius.It Cm lowpriotrap 1601290001SglebiusDeclare traps set by matching hosts to be low priority. 1602290001SglebiusThe 1603290001Sglebiusnumber of traps a server can maintain is limited (the current limit 1604290001Sglebiusis 3). 1605290001SglebiusTraps are usually assigned on a first come, first served 1606290001Sglebiusbasis, with later trap requestors being denied service. 1607290001SglebiusThis flag 1608290001Sglebiusmodifies the assignment algorithm by allowing low priority traps to 1609290001Sglebiusbe overridden by later requests for normal priority traps. 1610290001Sglebius.It Cm nomodify 1611290001SglebiusDeny 1612290001Sglebius.Xr ntpq @NTPQ_MS@ 1613290001Sglebiusand 1614290001Sglebius.Xr ntpdc @NTPDC_MS@ 1615290001Sglebiusqueries which attempt to modify the state of the 1616290001Sglebiusserver (i.e., run time reconfiguration). 1617290001SglebiusQueries which return 1618290001Sglebiusinformation are permitted. 1619290001Sglebius.It Cm noquery 1620290001SglebiusDeny 1621290001Sglebius.Xr ntpq @NTPQ_MS@ 1622290001Sglebiusand 1623290001Sglebius.Xr ntpdc @NTPDC_MS@ 1624290001Sglebiusqueries. 1625290001SglebiusTime service is not affected. 1626290001Sglebius.It Cm nopeer 1627290001SglebiusDeny packets which would result in mobilizing a new association. 1628290001SglebiusThis 1629290001Sglebiusincludes broadcast and symmetric active packets when a configured 1630290001Sglebiusassociation does not exist. 1631290001SglebiusIt also includes 1632290001Sglebius.Cm pool 1633290001Sglebiusassociations, so if you want to use servers from a 1634290001Sglebius.Cm pool 1635290001Sglebiusdirective and also want to use 1636290001Sglebius.Cm nopeer 1637290001Sglebiusby default, you'll want a 1638290001Sglebius.Cm "restrict source ..." line as well that does 1639290001Sglebius.It not 1640290001Sglebiusinclude the 1641290001Sglebius.Cm nopeer 1642290001Sglebiusdirective. 1643290001Sglebius.It Cm noserve 1644290001SglebiusDeny all packets except 1645290001Sglebius.Xr ntpq @NTPQ_MS@ 1646290001Sglebiusand 1647290001Sglebius.Xr ntpdc @NTPDC_MS@ 1648290001Sglebiusqueries. 1649290001Sglebius.It Cm notrap 1650290001SglebiusDecline to provide mode 6 control message trap service to matching 1651290001Sglebiushosts. 1652298770SdelphijThe trap service is a subsystem of the 1653298770Sdelphij.Xr ntpq @NTPQ_MS@ 1654298770Sdelphijcontrol message 1655290001Sglebiusprotocol which is intended for use by remote event logging programs. 1656290001Sglebius.It Cm notrust 1657290001SglebiusDeny service unless the packet is cryptographically authenticated. 1658290001Sglebius.It Cm ntpport 1659290001SglebiusThis is actually a match algorithm modifier, rather than a 1660290001Sglebiusrestriction flag. 1661290001SglebiusIts presence causes the restriction entry to be 1662290001Sglebiusmatched only if the source port in the packet is the standard NTP 1663290001SglebiusUDP port (123). 1664290001SglebiusBoth 1665290001Sglebius.Cm ntpport 1666290001Sglebiusand 1667290001Sglebius.Cm non\-ntpport 1668290001Sglebiusmay 1669290001Sglebiusbe specified. 1670290001SglebiusThe 1671290001Sglebius.Cm ntpport 1672290001Sglebiusis considered more specific and 1673290001Sglebiusis sorted later in the list. 1674290001Sglebius.It Cm version 1675290001SglebiusDeny packets that do not match the current NTP version. 1676290001Sglebius.El 1677290001Sglebius.Pp 1678290001SglebiusDefault restriction list entries with the flags ignore, interface, 1679290001Sglebiusntpport, for each of the local host's interface addresses are 1680290001Sglebiusinserted into the table at startup to prevent the server 1681290001Sglebiusfrom attempting to synchronize to its own time. 1682290001SglebiusA default entry is also always present, though if it is 1683290001Sglebiusotherwise unconfigured; no flags are associated 1684290001Sglebiuswith the default entry (i.e., everything besides your own 1685290001SglebiusNTP server is unrestricted). 1686290001Sglebius.El 1687290001Sglebius.Sh Automatic NTP Configuration Options 1688290001Sglebius.Ss Manycasting 1689290001SglebiusManycasting is a automatic discovery and configuration paradigm 1690290001Sglebiusnew to NTPv4. 1691290001SglebiusIt is intended as a means for a multicast client 1692290001Sglebiusto troll the nearby network neighborhood to find cooperating 1693290001Sglebiusmanycast servers, validate them using cryptographic means 1694290001Sglebiusand evaluate their time values with respect to other servers 1695290001Sglebiusthat might be lurking in the vicinity. 1696290001SglebiusThe intended result is that each manycast client mobilizes 1697290001Sglebiusclient associations with some number of the "best" 1698290001Sglebiusof the nearby manycast servers, yet automatically reconfigures 1699290001Sglebiusto sustain this number of servers should one or another fail. 1700290001Sglebius.Pp 1701290001SglebiusNote that the manycasting paradigm does not coincide 1702290001Sglebiuswith the anycast paradigm described in RFC\-1546, 1703290001Sglebiuswhich is designed to find a single server from a clique 1704290001Sglebiusof servers providing the same service. 1705290001SglebiusThe manycast paradigm is designed to find a plurality 1706290001Sglebiusof redundant servers satisfying defined optimality criteria. 1707290001Sglebius.Pp 1708290001SglebiusManycasting can be used with either symmetric key 1709290001Sglebiusor public key cryptography. 1710290001SglebiusThe public key infrastructure (PKI) 1711290001Sglebiusoffers the best protection against compromised keys 1712290001Sglebiusand is generally considered stronger, at least with relatively 1713290001Sglebiuslarge key sizes. 1714290001SglebiusIt is implemented using the Autokey protocol and 1715290001Sglebiusthe OpenSSL cryptographic library available from 1716290001Sglebius.Li http://www.openssl.org/ . 1717290001SglebiusThe library can also be used with other NTPv4 modes 1718290001Sglebiusas well and is highly recommended, especially for broadcast modes. 1719290001Sglebius.Pp 1720290001SglebiusA persistent manycast client association is configured 1721298770Sdelphijusing the 1722298770Sdelphij.Ic manycastclient 1723298770Sdelphijcommand, which is similar to the 1724298770Sdelphij.Ic server 1725298770Sdelphijcommand but with a multicast (IPv4 class 1726290001Sglebius.Cm D 1727290001Sglebiusor IPv6 prefix 1728290001Sglebius.Cm FF ) 1729290001Sglebiusgroup address. 1730290001SglebiusThe IANA has designated IPv4 address 224.1.1.1 1731290001Sglebiusand IPv6 address FF05::101 (site local) for NTP. 1732290001SglebiusWhen more servers are needed, it broadcasts manycast 1733290001Sglebiusclient messages to this address at the minimum feasible rate 1734290001Sglebiusand minimum feasible time\-to\-live (TTL) hops, depending 1735290001Sglebiuson how many servers have already been found. 1736290001SglebiusThere can be as many manycast client associations 1737290001Sglebiusas different group address, each one serving as a template 1738290001Sglebiusfor a future ephemeral unicast client/server association. 1739290001Sglebius.Pp 1740290001SglebiusManycast servers configured with the 1741290001Sglebius.Ic manycastserver 1742290001Sglebiuscommand listen on the specified group address for manycast 1743290001Sglebiusclient messages. 1744290001SglebiusNote the distinction between manycast client, 1745290001Sglebiuswhich actively broadcasts messages, and manycast server, 1746290001Sglebiuswhich passively responds to them. 1747290001SglebiusIf a manycast server is 1748290001Sglebiusin scope of the current TTL and is itself synchronized 1749290001Sglebiusto a valid source and operating at a stratum level equal 1750290001Sglebiusto or lower than the manycast client, it replies to the 1751290001Sglebiusmanycast client message with an ordinary unicast server message. 1752290001Sglebius.Pp 1753290001SglebiusThe manycast client receiving this message mobilizes 1754290001Sglebiusan ephemeral client/server association according to the 1755290001Sglebiusmatching manycast client template, but only if cryptographically 1756290001Sglebiusauthenticated and the server stratum is less than or equal 1757290001Sglebiusto the client stratum. 1758290001SglebiusAuthentication is explicitly required 1759290001Sglebiusand either symmetric key or public key (Autokey) can be used. 1760290001SglebiusThen, the client polls the server at its unicast address 1761290001Sglebiusin burst mode in order to reliably set the host clock 1762290001Sglebiusand validate the source. 1763290001SglebiusThis normally results 1764290001Sglebiusin a volley of eight client/server at 2\-s intervals 1765290001Sglebiusduring which both the synchronization and cryptographic 1766290001Sglebiusprotocols run concurrently. 1767290001SglebiusFollowing the volley, 1768290001Sglebiusthe client runs the NTP intersection and clustering 1769290001Sglebiusalgorithms, which act to discard all but the "best" 1770290001Sglebiusassociations according to stratum and synchronization 1771290001Sglebiusdistance. 1772290001SglebiusThe surviving associations then continue 1773290001Sglebiusin ordinary client/server mode. 1774290001Sglebius.Pp 1775290001SglebiusThe manycast client polling strategy is designed to reduce 1776290001Sglebiusas much as possible the volume of manycast client messages 1777290001Sglebiusand the effects of implosion due to near\-simultaneous 1778290001Sglebiusarrival of manycast server messages. 1779290001SglebiusThe strategy is determined by the 1780290001Sglebius.Ic manycastclient , 1781290001Sglebius.Ic tos 1782290001Sglebiusand 1783290001Sglebius.Ic ttl 1784290001Sglebiusconfiguration commands. 1785290001SglebiusThe manycast poll interval is 1786290001Sglebiusnormally eight times the system poll interval, 1787290001Sglebiuswhich starts out at the 1788290001Sglebius.Cm minpoll 1789290001Sglebiusvalue specified in the 1790290001Sglebius.Ic manycastclient , 1791290001Sglebiuscommand and, under normal circumstances, increments to the 1792290001Sglebius.Cm maxpolll 1793290001Sglebiusvalue specified in this command. 1794290001SglebiusInitially, the TTL is 1795298770Sdelphijset at the minimum hops specified by the 1796298770Sdelphij.Ic ttl 1797298770Sdelphijcommand. 1798290001SglebiusAt each retransmission the TTL is increased until reaching 1799290001Sglebiusthe maximum hops specified by this command or a sufficient 1800290001Sglebiusnumber client associations have been found. 1801290001SglebiusFurther retransmissions use the same TTL. 1802290001Sglebius.Pp 1803290001SglebiusThe quality and reliability of the suite of associations 1804290001Sglebiusdiscovered by the manycast client is determined by the NTP 1805290001Sglebiusmitigation algorithms and the 1806290001Sglebius.Cm minclock 1807290001Sglebiusand 1808290001Sglebius.Cm minsane 1809290001Sglebiusvalues specified in the 1810290001Sglebius.Ic tos 1811290001Sglebiusconfiguration command. 1812290001SglebiusAt least 1813290001Sglebius.Cm minsane 1814290001Sglebiuscandidate servers must be available and the mitigation 1815290001Sglebiusalgorithms produce at least 1816290001Sglebius.Cm minclock 1817290001Sglebiussurvivors in order to synchronize the clock. 1818290001SglebiusByzantine agreement principles require at least four 1819290001Sglebiuscandidates in order to correctly discard a single falseticker. 1820290001SglebiusFor legacy purposes, 1821290001Sglebius.Cm minsane 1822290001Sglebiusdefaults to 1 and 1823290001Sglebius.Cm minclock 1824290001Sglebiusdefaults to 3. 1825290001SglebiusFor manycast service 1826290001Sglebius.Cm minsane 1827290001Sglebiusshould be explicitly set to 4, assuming at least that 1828290001Sglebiusnumber of servers are available. 1829290001Sglebius.Pp 1830290001SglebiusIf at least 1831290001Sglebius.Cm minclock 1832290001Sglebiusservers are found, the manycast poll interval is immediately 1833290001Sglebiusset to eight times 1834290001Sglebius.Cm maxpoll . 1835290001SglebiusIf less than 1836290001Sglebius.Cm minclock 1837290001Sglebiusservers are found when the TTL has reached the maximum hops, 1838290001Sglebiusthe manycast poll interval is doubled. 1839290001SglebiusFor each transmission 1840290001Sglebiusafter that, the poll interval is doubled again until 1841290001Sglebiusreaching the maximum of eight times 1842290001Sglebius.Cm maxpoll . 1843290001SglebiusFurther transmissions use the same poll interval and 1844290001SglebiusTTL values. 1845290001SglebiusNote that while all this is going on, 1846290001Sglebiuseach client/server association found is operating normally 1847290001Sglebiusit the system poll interval. 1848290001Sglebius.Pp 1849290001SglebiusAdministratively scoped multicast boundaries are normally 1850290001Sglebiusspecified by the network router configuration and, 1851290001Sglebiusin the case of IPv6, the link/site scope prefix. 1852290001SglebiusBy default, the increment for TTL hops is 32 starting 1853290001Sglebiusfrom 31; however, the 1854290001Sglebius.Ic ttl 1855290001Sglebiusconfiguration command can be 1856290001Sglebiusused to modify the values to match the scope rules. 1857290001Sglebius.Pp 1858290001SglebiusIt is often useful to narrow the range of acceptable 1859290001Sglebiusservers which can be found by manycast client associations. 1860290001SglebiusBecause manycast servers respond only when the client 1861290001Sglebiusstratum is equal to or greater than the server stratum, 1862290001Sglebiusprimary (stratum 1) servers fill find only primary servers 1863290001Sglebiusin TTL range, which is probably the most common objective. 1864290001SglebiusHowever, unless configured otherwise, all manycast clients 1865290001Sglebiusin TTL range will eventually find all primary servers 1866290001Sglebiusin TTL range, which is probably not the most common 1867290001Sglebiusobjective in large networks. 1868290001SglebiusThe 1869290001Sglebius.Ic tos 1870290001Sglebiuscommand can be used to modify this behavior. 1871290001SglebiusServers with stratum below 1872290001Sglebius.Cm floor 1873290001Sglebiusor above 1874290001Sglebius.Cm ceiling 1875290001Sglebiusspecified in the 1876290001Sglebius.Ic tos 1877290001Sglebiuscommand are strongly discouraged during the selection 1878290001Sglebiusprocess; however, these servers may be temporally 1879290001Sglebiusaccepted if the number of servers within TTL range is 1880290001Sglebiusless than 1881290001Sglebius.Cm minclock . 1882290001Sglebius.Pp 1883290001SglebiusThe above actions occur for each manycast client message, 1884290001Sglebiuswhich repeats at the designated poll interval. 1885290001SglebiusHowever, once the ephemeral client association is mobilized, 1886290001Sglebiussubsequent manycast server replies are discarded, 1887290001Sglebiussince that would result in a duplicate association. 1888290001SglebiusIf during a poll interval the number of client associations 1889290001Sglebiusfalls below 1890290001Sglebius.Cm minclock , 1891290001Sglebiusall manycast client prototype associations are reset 1892290001Sglebiusto the initial poll interval and TTL hops and operation 1893290001Sglebiusresumes from the beginning. 1894290001SglebiusIt is important to avoid 1895290001Sglebiusfrequent manycast client messages, since each one requires 1896290001Sglebiusall manycast servers in TTL range to respond. 1897290001SglebiusThe result could well be an implosion, either minor or major, 1898290001Sglebiusdepending on the number of servers in range. 1899290001SglebiusThe recommended value for 1900290001Sglebius.Cm maxpoll 1901290001Sglebiusis 12 (4,096 s). 1902290001Sglebius.Pp 1903290001SglebiusIt is possible and frequently useful to configure a host 1904290001Sglebiusas both manycast client and manycast server. 1905290001SglebiusA number of hosts configured this way and sharing a common 1906290001Sglebiusgroup address will automatically organize themselves 1907290001Sglebiusin an optimum configuration based on stratum and 1908290001Sglebiussynchronization distance. 1909290001SglebiusFor example, consider an NTP 1910290001Sglebiussubnet of two primary servers and a hundred or more 1911290001Sglebiusdependent clients. 1912290001SglebiusWith two exceptions, all servers 1913290001Sglebiusand clients have identical configuration files including both 1914290001Sglebius.Ic multicastclient 1915290001Sglebiusand 1916290001Sglebius.Ic multicastserver 1917290001Sglebiuscommands using, for instance, multicast group address 1918290001Sglebius239.1.1.1. 1919290001SglebiusThe only exception is that each primary server 1920290001Sglebiusconfiguration file must include commands for the primary 1921290001Sglebiusreference source such as a GPS receiver. 1922290001Sglebius.Pp 1923290001SglebiusThe remaining configuration files for all secondary 1924290001Sglebiusservers and clients have the same contents, except for the 1925290001Sglebius.Ic tos 1926290001Sglebiuscommand, which is specific for each stratum level. 1927290001SglebiusFor stratum 1 and stratum 2 servers, that command is 1928290001Sglebiusnot necessary. 1929290001SglebiusFor stratum 3 and above servers the 1930290001Sglebius.Cm floor 1931290001Sglebiusvalue is set to the intended stratum number. 1932290001SglebiusThus, all stratum 3 configuration files are identical, 1933290001Sglebiusall stratum 4 files are identical and so forth. 1934290001Sglebius.Pp 1935290001SglebiusOnce operations have stabilized in this scenario, 1936290001Sglebiusthe primary servers will find the primary reference source 1937290001Sglebiusand each other, since they both operate at the same 1938290001Sglebiusstratum (1), but not with any secondary server or client, 1939290001Sglebiussince these operate at a higher stratum. 1940290001SglebiusThe secondary 1941290001Sglebiusservers will find the servers at the same stratum level. 1942290001SglebiusIf one of the primary servers loses its GPS receiver, 1943290001Sglebiusit will continue to operate as a client and other clients 1944290001Sglebiuswill time out the corresponding association and 1945290001Sglebiusre\-associate accordingly. 1946290001Sglebius.Pp 1947290001SglebiusSome administrators prefer to avoid running 1948290001Sglebius.Xr ntpd @NTPD_MS@ 1949290001Sglebiuscontinuously and run either 1950290001Sglebius.Xr sntp @SNTP_MS@ 1951290001Sglebiusor 1952290001Sglebius.Xr ntpd @NTPD_MS@ 1953290001Sglebius.Fl q 1954290001Sglebiusas a cron job. 1955290001SglebiusIn either case the servers must be 1956290001Sglebiusconfigured in advance and the program fails if none are 1957290001Sglebiusavailable when the cron job runs. 1958290001SglebiusA really slick 1959290001Sglebiusapplication of manycast is with 1960290001Sglebius.Xr ntpd @NTPD_MS@ 1961290001Sglebius.Fl q . 1962290001SglebiusThe program wakes up, scans the local landscape looking 1963290001Sglebiusfor the usual suspects, selects the best from among 1964290001Sglebiusthe rascals, sets the clock and then departs. 1965290001SglebiusServers do not have to be configured in advance and 1966290001Sglebiusall clients throughout the network can have the same 1967290001Sglebiusconfiguration file. 1968290001Sglebius.Ss Manycast Interactions with Autokey 1969290001SglebiusEach time a manycast client sends a client mode packet 1970290001Sglebiusto a multicast group address, all manycast servers 1971290001Sglebiusin scope generate a reply including the host name 1972290001Sglebiusand status word. 1973290001SglebiusThe manycast clients then run 1974290001Sglebiusthe Autokey protocol, which collects and verifies 1975290001Sglebiusall certificates involved. 1976290001SglebiusFollowing the burst interval 1977290001Sglebiusall but three survivors are cast off, 1978290001Sglebiusbut the certificates remain in the local cache. 1979290001SglebiusIt often happens that several complete signing trails 1980290001Sglebiusfrom the client to the primary servers are collected in this way. 1981290001Sglebius.Pp 1982290001SglebiusAbout once an hour or less often if the poll interval 1983290001Sglebiusexceeds this, the client regenerates the Autokey key list. 1984290001SglebiusThis is in general transparent in client/server mode. 1985290001SglebiusHowever, about once per day the server private value 1986290001Sglebiusused to generate cookies is refreshed along with all 1987290001Sglebiusmanycast client associations. 1988290001SglebiusIn this case all 1989290001Sglebiuscryptographic values including certificates is refreshed. 1990290001SglebiusIf a new certificate has been generated since 1991290001Sglebiusthe last refresh epoch, it will automatically revoke 1992290001Sglebiusall prior certificates that happen to be in the 1993290001Sglebiuscertificate cache. 1994290001SglebiusAt the same time, the manycast 1995290001Sglebiusscheme starts all over from the beginning and 1996290001Sglebiusthe expanding ring shrinks to the minimum and increments 1997290001Sglebiusfrom there while collecting all servers in scope. 1998310419Sdelphij.Ss Broadcast Options 1999310419Sdelphij.Bl -tag -width indent 2000310419Sdelphij.It Xo Ic tos 2001310419Sdelphij.Oo 2002310419Sdelphij.Cm bcpollbstep Ar gate 2003310419Sdelphij.Oc 2004310419Sdelphij.Xc 2005310419SdelphijThis command provides a way to delay, 2006310419Sdelphijby the specified number of broadcast poll intervals, 2007310419Sdelphijbelieving backward time steps from a broadcast server. 2008310419SdelphijBroadcast time networks are expected to be trusted. 2009310419SdelphijIn the event a broadcast server's time is stepped backwards, 2010310419Sdelphijthere is clear benefit to having the clients notice this change 2011310419Sdelphijas soon as possible. 2012310419SdelphijAttacks such as replay attacks can happen, however, 2013310419Sdelphijand even though there are a number of protections built in to 2014310419Sdelphijbroadcast mode, attempts to perform a replay attack are possible. 2015310419SdelphijThis value defaults to 0, but can be changed 2016310419Sdelphijto any number of poll intervals between 0 and 4. 2017290001Sglebius.Ss Manycast Options 2018290001Sglebius.Bl -tag -width indent 2019290001Sglebius.It Xo Ic tos 2020290001Sglebius.Oo 2021290001Sglebius.Cm ceiling Ar ceiling | 2022290001Sglebius.Cm cohort { 0 | 1 } | 2023290001Sglebius.Cm floor Ar floor | 2024290001Sglebius.Cm minclock Ar minclock | 2025290001Sglebius.Cm minsane Ar minsane 2026290001Sglebius.Oc 2027290001Sglebius.Xc 2028290001SglebiusThis command affects the clock selection and clustering 2029290001Sglebiusalgorithms. 2030290001SglebiusIt can be used to select the quality and 2031290001Sglebiusquantity of peers used to synchronize the system clock 2032290001Sglebiusand is most useful in manycast mode. 2033290001SglebiusThe variables operate 2034290001Sglebiusas follows: 2035290001Sglebius.Bl -tag -width indent 2036290001Sglebius.It Cm ceiling Ar ceiling 2037290001SglebiusPeers with strata above 2038290001Sglebius.Cm ceiling 2039290001Sglebiuswill be discarded if there are at least 2040290001Sglebius.Cm minclock 2041290001Sglebiuspeers remaining. 2042290001SglebiusThis value defaults to 15, but can be changed 2043290001Sglebiusto any number from 1 to 15. 2044290001Sglebius.It Cm cohort Bro 0 | 1 Brc 2045290001SglebiusThis is a binary flag which enables (0) or disables (1) 2046290001Sglebiusmanycast server replies to manycast clients with the same 2047290001Sglebiusstratum level. 2048290001SglebiusThis is useful to reduce implosions where 2049290001Sglebiuslarge numbers of clients with the same stratum level 2050290001Sglebiusare present. 2051290001SglebiusThe default is to enable these replies. 2052290001Sglebius.It Cm floor Ar floor 2053290001SglebiusPeers with strata below 2054290001Sglebius.Cm floor 2055290001Sglebiuswill be discarded if there are at least 2056290001Sglebius.Cm minclock 2057290001Sglebiuspeers remaining. 2058290001SglebiusThis value defaults to 1, but can be changed 2059290001Sglebiusto any number from 1 to 15. 2060290001Sglebius.It Cm minclock Ar minclock 2061290001SglebiusThe clustering algorithm repeatedly casts out outlier 2062290001Sglebiusassociations until no more than 2063290001Sglebius.Cm minclock 2064290001Sglebiusassociations remain. 2065290001SglebiusThis value defaults to 3, 2066290001Sglebiusbut can be changed to any number from 1 to the number of 2067290001Sglebiusconfigured sources. 2068290001Sglebius.It Cm minsane Ar minsane 2069290001SglebiusThis is the minimum number of candidates available 2070290001Sglebiusto the clock selection algorithm in order to produce 2071290001Sglebiusone or more truechimers for the clustering algorithm. 2072290001SglebiusIf fewer than this number are available, the clock is 2073290001Sglebiusundisciplined and allowed to run free. 2074290001SglebiusThe default is 1 2075290001Sglebiusfor legacy purposes. 2076290001SglebiusHowever, according to principles of 2077290001SglebiusByzantine agreement, 2078290001Sglebius.Cm minsane 2079290001Sglebiusshould be at least 4 in order to detect and discard 2080290001Sglebiusa single falseticker. 2081290001Sglebius.El 2082290001Sglebius.It Cm ttl Ar hop ... 2083290001SglebiusThis command specifies a list of TTL values in increasing 2084290001Sglebiusorder, up to 8 values can be specified. 2085290001SglebiusIn manycast mode these values are used in turn 2086290001Sglebiusin an expanding\-ring search. 2087290001SglebiusThe default is eight 2088290001Sglebiusmultiples of 32 starting at 31. 2089290001Sglebius.El 2090290001Sglebius.Sh Reference Clock Support 2091290001SglebiusThe NTP Version 4 daemon supports some three dozen different radio, 2092290001Sglebiussatellite and modem reference clocks plus a special pseudo\-clock 2093290001Sglebiusused for backup or when no other clock source is available. 2094290001SglebiusDetailed descriptions of individual device drivers and options can 2095290001Sglebiusbe found in the 2096290001Sglebius.Qq Reference Clock Drivers 2097290001Sglebiuspage 2098290001Sglebius(available as part of the HTML documentation 2099290001Sglebiusprovided in 2100290001Sglebius.Pa /usr/share/doc/ntp ) . 2101290001SglebiusAdditional information can be found in the pages linked 2102290001Sglebiusthere, including the 2103290001Sglebius.Qq Debugging Hints for Reference Clock Drivers 2104290001Sglebiusand 2105290001Sglebius.Qq How To Write a Reference Clock Driver 2106290001Sglebiuspages 2107290001Sglebius(available as part of the HTML documentation 2108290001Sglebiusprovided in 2109290001Sglebius.Pa /usr/share/doc/ntp ) . 2110290001SglebiusIn addition, support for a PPS 2111290001Sglebiussignal is available as described in the 2112290001Sglebius.Qq Pulse\-per\-second (PPS) Signal Interfacing 2113290001Sglebiuspage 2114290001Sglebius(available as part of the HTML documentation 2115290001Sglebiusprovided in 2116290001Sglebius.Pa /usr/share/doc/ntp ) . 2117290001SglebiusMany 2118290001Sglebiusdrivers support special line discipline/streams modules which can 2119290001Sglebiussignificantly improve the accuracy using the driver. 2120290001SglebiusThese are 2121290001Sglebiusdescribed in the 2122290001Sglebius.Qq Line Disciplines and Streams Drivers 2123290001Sglebiuspage 2124290001Sglebius(available as part of the HTML documentation 2125290001Sglebiusprovided in 2126290001Sglebius.Pa /usr/share/doc/ntp ) . 2127290001Sglebius.Pp 2128290001SglebiusA reference clock will generally (though not always) be a radio 2129290001Sglebiustimecode receiver which is synchronized to a source of standard 2130290001Sglebiustime such as the services offered by the NRC in Canada and NIST and 2131290001SglebiusUSNO in the US. 2132290001SglebiusThe interface between the computer and the timecode 2133290001Sglebiusreceiver is device dependent, but is usually a serial port. 2134290001SglebiusA 2135290001Sglebiusdevice driver specific to each reference clock must be selected and 2136290001Sglebiuscompiled in the distribution; however, most common radio, satellite 2137290001Sglebiusand modem clocks are included by default. 2138290001SglebiusNote that an attempt to 2139290001Sglebiusconfigure a reference clock when the driver has not been compiled 2140290001Sglebiusor the hardware port has not been appropriately configured results 2141290001Sglebiusin a scalding remark to the system log file, but is otherwise non 2142290001Sglebiushazardous. 2143290001Sglebius.Pp 2144290001SglebiusFor the purposes of configuration, 2145290001Sglebius.Xr ntpd @NTPD_MS@ 2146290001Sglebiustreats 2147290001Sglebiusreference clocks in a manner analogous to normal NTP peers as much 2148290001Sglebiusas possible. 2149290001SglebiusReference clocks are identified by a syntactically 2150290001Sglebiuscorrect but invalid IP address, in order to distinguish them from 2151290001Sglebiusnormal NTP peers. 2152290001SglebiusReference clock addresses are of the form 2153290001Sglebius.Sm off 2154290001Sglebius.Li 127.127. Ar t . Ar u , 2155290001Sglebius.Sm on 2156290001Sglebiuswhere 2157290001Sglebius.Ar t 2158290001Sglebiusis an integer 2159290001Sglebiusdenoting the clock type and 2160290001Sglebius.Ar u 2161290001Sglebiusindicates the unit 2162290001Sglebiusnumber in the range 0\-3. 2163290001SglebiusWhile it may seem overkill, it is in fact 2164290001Sglebiussometimes useful to configure multiple reference clocks of the same 2165290001Sglebiustype, in which case the unit numbers must be unique. 2166290001Sglebius.Pp 2167290001SglebiusThe 2168290001Sglebius.Ic server 2169290001Sglebiuscommand is used to configure a reference 2170290001Sglebiusclock, where the 2171290001Sglebius.Ar address 2172290001Sglebiusargument in that command 2173290001Sglebiusis the clock address. 2174290001SglebiusThe 2175290001Sglebius.Cm key , 2176290001Sglebius.Cm version 2177290001Sglebiusand 2178290001Sglebius.Cm ttl 2179290001Sglebiusoptions are not used for reference clock support. 2180290001SglebiusThe 2181290001Sglebius.Cm mode 2182290001Sglebiusoption is added for reference clock support, as 2183290001Sglebiusdescribed below. 2184290001SglebiusThe 2185290001Sglebius.Cm prefer 2186290001Sglebiusoption can be useful to 2187290001Sglebiuspersuade the server to cherish a reference clock with somewhat more 2188290001Sglebiusenthusiasm than other reference clocks or peers. 2189290001SglebiusFurther 2190290001Sglebiusinformation on this option can be found in the 2191290001Sglebius.Qq Mitigation Rules and the prefer Keyword 2192290001Sglebius(available as part of the HTML documentation 2193290001Sglebiusprovided in 2194290001Sglebius.Pa /usr/share/doc/ntp ) 2195290001Sglebiuspage. 2196290001SglebiusThe 2197290001Sglebius.Cm minpoll 2198290001Sglebiusand 2199290001Sglebius.Cm maxpoll 2200290001Sglebiusoptions have 2201290001Sglebiusmeaning only for selected clock drivers. 2202290001SglebiusSee the individual clock 2203290001Sglebiusdriver document pages for additional information. 2204290001Sglebius.Pp 2205290001SglebiusThe 2206290001Sglebius.Ic fudge 2207290001Sglebiuscommand is used to provide additional 2208290001Sglebiusinformation for individual clock drivers and normally follows 2209290001Sglebiusimmediately after the 2210290001Sglebius.Ic server 2211290001Sglebiuscommand. 2212290001SglebiusThe 2213290001Sglebius.Ar address 2214290001Sglebiusargument specifies the clock address. 2215290001SglebiusThe 2216290001Sglebius.Cm refid 2217290001Sglebiusand 2218290001Sglebius.Cm stratum 2219290001Sglebiusoptions can be used to 2220290001Sglebiusoverride the defaults for the device. 2221290001SglebiusThere are two optional 2222290001Sglebiusdevice\-dependent time offsets and four flags that can be included 2223290001Sglebiusin the 2224290001Sglebius.Ic fudge 2225290001Sglebiuscommand as well. 2226290001Sglebius.Pp 2227290001SglebiusThe stratum number of a reference clock is by default zero. 2228290001SglebiusSince the 2229290001Sglebius.Xr ntpd @NTPD_MS@ 2230290001Sglebiusdaemon adds one to the stratum of each 2231290001Sglebiuspeer, a primary server ordinarily displays an external stratum of 2232290001Sglebiusone. 2233290001SglebiusIn order to provide engineered backups, it is often useful to 2234290001Sglebiusspecify the reference clock stratum as greater than zero. 2235290001SglebiusThe 2236290001Sglebius.Cm stratum 2237290001Sglebiusoption is used for this purpose. 2238290001SglebiusAlso, in cases 2239290001Sglebiusinvolving both a reference clock and a pulse\-per\-second (PPS) 2240290001Sglebiusdiscipline signal, it is useful to specify the reference clock 2241290001Sglebiusidentifier as other than the default, depending on the driver. 2242290001SglebiusThe 2243290001Sglebius.Cm refid 2244290001Sglebiusoption is used for this purpose. 2245290001SglebiusExcept where noted, 2246290001Sglebiusthese options apply to all clock drivers. 2247290001Sglebius.Ss Reference Clock Commands 2248290001Sglebius.Bl -tag -width indent 2249290001Sglebius.It Xo Ic server 2250290001Sglebius.Sm off 2251290001Sglebius.Li 127.127. Ar t . Ar u 2252290001Sglebius.Sm on 2253290001Sglebius.Op Cm prefer 2254290001Sglebius.Op Cm mode Ar int 2255290001Sglebius.Op Cm minpoll Ar int 2256290001Sglebius.Op Cm maxpoll Ar int 2257290001Sglebius.Xc 2258290001SglebiusThis command can be used to configure reference clocks in 2259290001Sglebiusspecial ways. 2260290001SglebiusThe options are interpreted as follows: 2261290001Sglebius.Bl -tag -width indent 2262290001Sglebius.It Cm prefer 2263290001SglebiusMarks the reference clock as preferred. 2264290001SglebiusAll other things being 2265290001Sglebiusequal, this host will be chosen for synchronization among a set of 2266290001Sglebiuscorrectly operating hosts. 2267290001SglebiusSee the 2268290001Sglebius.Qq Mitigation Rules and the prefer Keyword 2269290001Sglebiuspage 2270290001Sglebius(available as part of the HTML documentation 2271290001Sglebiusprovided in 2272290001Sglebius.Pa /usr/share/doc/ntp ) 2273290001Sglebiusfor further information. 2274290001Sglebius.It Cm mode Ar int 2275290001SglebiusSpecifies a mode number which is interpreted in a 2276290001Sglebiusdevice\-specific fashion. 2277290001SglebiusFor instance, it selects a dialing 2278290001Sglebiusprotocol in the ACTS driver and a device subtype in the 2279290001Sglebiusparse 2280290001Sglebiusdrivers. 2281290001Sglebius.It Cm minpoll Ar int 2282290001Sglebius.It Cm maxpoll Ar int 2283290001SglebiusThese options specify the minimum and maximum polling interval 2284290001Sglebiusfor reference clock messages, as a power of 2 in seconds 2285290001SglebiusFor 2286290001Sglebiusmost directly connected reference clocks, both 2287290001Sglebius.Cm minpoll 2288290001Sglebiusand 2289290001Sglebius.Cm maxpoll 2290290001Sglebiusdefault to 6 (64 s). 2291290001SglebiusFor modem reference clocks, 2292290001Sglebius.Cm minpoll 2293290001Sglebiusdefaults to 10 (17.1 m) and 2294290001Sglebius.Cm maxpoll 2295290001Sglebiusdefaults to 14 (4.5 h). 2296290001SglebiusThe allowable range is 4 (16 s) to 17 (36.4 h) inclusive. 2297290001Sglebius.El 2298290001Sglebius.It Xo Ic fudge 2299290001Sglebius.Sm off 2300290001Sglebius.Li 127.127. Ar t . Ar u 2301290001Sglebius.Sm on 2302290001Sglebius.Op Cm time1 Ar sec 2303290001Sglebius.Op Cm time2 Ar sec 2304290001Sglebius.Op Cm stratum Ar int 2305290001Sglebius.Op Cm refid Ar string 2306290001Sglebius.Op Cm mode Ar int 2307290001Sglebius.Op Cm flag1 Cm 0 \&| Cm 1 2308290001Sglebius.Op Cm flag2 Cm 0 \&| Cm 1 2309290001Sglebius.Op Cm flag3 Cm 0 \&| Cm 1 2310290001Sglebius.Op Cm flag4 Cm 0 \&| Cm 1 2311290001Sglebius.Xc 2312290001SglebiusThis command can be used to configure reference clocks in 2313290001Sglebiusspecial ways. 2314290001SglebiusIt must immediately follow the 2315290001Sglebius.Ic server 2316290001Sglebiuscommand which configures the driver. 2317290001SglebiusNote that the same capability 2318290001Sglebiusis possible at run time using the 2319290001Sglebius.Xr ntpdc @NTPDC_MS@ 2320290001Sglebiusprogram. 2321290001SglebiusThe options are interpreted as 2322290001Sglebiusfollows: 2323290001Sglebius.Bl -tag -width indent 2324290001Sglebius.It Cm time1 Ar sec 2325290001SglebiusSpecifies a constant to be added to the time offset produced by 2326290001Sglebiusthe driver, a fixed\-point decimal number in seconds. 2327290001SglebiusThis is used 2328290001Sglebiusas a calibration constant to adjust the nominal time offset of a 2329290001Sglebiusparticular clock to agree with an external standard, such as a 2330290001Sglebiusprecision PPS signal. 2331290001SglebiusIt also provides a way to correct a 2332290001Sglebiussystematic error or bias due to serial port or operating system 2333290001Sglebiuslatencies, different cable lengths or receiver internal delay. 2334290001SglebiusThe 2335290001Sglebiusspecified offset is in addition to the propagation delay provided 2336290001Sglebiusby other means, such as internal DIPswitches. 2337290001SglebiusWhere a calibration 2338290001Sglebiusfor an individual system and driver is available, an approximate 2339290001Sglebiuscorrection is noted in the driver documentation pages. 2340290001SglebiusNote: in order to facilitate calibration when more than one 2341290001Sglebiusradio clock or PPS signal is supported, a special calibration 2342290001Sglebiusfeature is available. 2343290001SglebiusIt takes the form of an argument to the 2344290001Sglebius.Ic enable 2345290001Sglebiuscommand described in 2346290001Sglebius.Sx Miscellaneous Options 2347290001Sglebiuspage and operates as described in the 2348290001Sglebius.Qq Reference Clock Drivers 2349290001Sglebiuspage 2350290001Sglebius(available as part of the HTML documentation 2351290001Sglebiusprovided in 2352290001Sglebius.Pa /usr/share/doc/ntp ) . 2353290001Sglebius.It Cm time2 Ar secs 2354290001SglebiusSpecifies a fixed\-point decimal number in seconds, which is 2355290001Sglebiusinterpreted in a driver\-dependent way. 2356290001SglebiusSee the descriptions of 2357290001Sglebiusspecific drivers in the 2358290001Sglebius.Qq Reference Clock Drivers 2359290001Sglebiuspage 2360290001Sglebius(available as part of the HTML documentation 2361290001Sglebiusprovided in 2362290001Sglebius.Pa /usr/share/doc/ntp ) . 2363290001Sglebius.It Cm stratum Ar int 2364290001SglebiusSpecifies the stratum number assigned to the driver, an integer 2365290001Sglebiusbetween 0 and 15. 2366290001SglebiusThis number overrides the default stratum number 2367290001Sglebiusordinarily assigned by the driver itself, usually zero. 2368290001Sglebius.It Cm refid Ar string 2369290001SglebiusSpecifies an ASCII string of from one to four characters which 2370290001Sglebiusdefines the reference identifier used by the driver. 2371290001SglebiusThis string 2372290001Sglebiusoverrides the default identifier ordinarily assigned by the driver 2373290001Sglebiusitself. 2374290001Sglebius.It Cm mode Ar int 2375290001SglebiusSpecifies a mode number which is interpreted in a 2376290001Sglebiusdevice\-specific fashion. 2377290001SglebiusFor instance, it selects a dialing 2378290001Sglebiusprotocol in the ACTS driver and a device subtype in the 2379290001Sglebiusparse 2380290001Sglebiusdrivers. 2381290001Sglebius.It Cm flag1 Cm 0 \&| Cm 1 2382290001Sglebius.It Cm flag2 Cm 0 \&| Cm 1 2383290001Sglebius.It Cm flag3 Cm 0 \&| Cm 1 2384290001Sglebius.It Cm flag4 Cm 0 \&| Cm 1 2385290001SglebiusThese four flags are used for customizing the clock driver. 2386290001SglebiusThe 2387290001Sglebiusinterpretation of these values, and whether they are used at all, 2388290001Sglebiusis a function of the particular clock driver. 2389290001SglebiusHowever, by 2390290001Sglebiusconvention 2391290001Sglebius.Cm flag4 2392290001Sglebiusis used to enable recording monitoring 2393290001Sglebiusdata to the 2394290001Sglebius.Cm clockstats 2395290001Sglebiusfile configured with the 2396290001Sglebius.Ic filegen 2397290001Sglebiuscommand. 2398290001SglebiusFurther information on the 2399290001Sglebius.Ic filegen 2400290001Sglebiuscommand can be found in 2401290001Sglebius.Sx Monitoring Options . 2402290001Sglebius.El 2403290001Sglebius.El 2404290001Sglebius.Sh Miscellaneous Options 2405290001Sglebius.Bl -tag -width indent 2406290001Sglebius.It Ic broadcastdelay Ar seconds 2407290001SglebiusThe broadcast and multicast modes require a special calibration 2408290001Sglebiusto determine the network delay between the local and remote 2409290001Sglebiusservers. 2410290001SglebiusOrdinarily, this is done automatically by the initial 2411290001Sglebiusprotocol exchanges between the client and server. 2412290001SglebiusIn some cases, 2413290001Sglebiusthe calibration procedure may fail due to network or server access 2414290001Sglebiuscontrols, for example. 2415290001SglebiusThis command specifies the default delay to 2416290001Sglebiusbe used under these circumstances. 2417290001SglebiusTypically (for Ethernet), a 2418290001Sglebiusnumber between 0.003 and 0.007 seconds is appropriate. 2419290001SglebiusThe default 2420290001Sglebiuswhen this command is not used is 0.004 seconds. 2421290001Sglebius.It Ic calldelay Ar delay 2422290001SglebiusThis option controls the delay in seconds between the first and second 2423290001Sglebiuspackets sent in burst or iburst mode to allow additional time for a modem 2424290001Sglebiusor ISDN call to complete. 2425290001Sglebius.It Ic driftfile Ar driftfile 2426290001SglebiusThis command specifies the complete path and name of the file used to 2427290001Sglebiusrecord the frequency of the local clock oscillator. 2428290001SglebiusThis is the same 2429290001Sglebiusoperation as the 2430290001Sglebius.Fl f 2431290001Sglebiuscommand line option. 2432290001SglebiusIf the file exists, it is read at 2433290001Sglebiusstartup in order to set the initial frequency and then updated once per 2434290001Sglebiushour with the current frequency computed by the daemon. 2435290001SglebiusIf the file name is 2436290001Sglebiusspecified, but the file itself does not exist, the starts with an initial 2437290001Sglebiusfrequency of zero and creates the file when writing it for the first time. 2438290001SglebiusIf this command is not given, the daemon will always start with an initial 2439290001Sglebiusfrequency of zero. 2440290001Sglebius.Pp 2441290001SglebiusThe file format consists of a single line containing a single 2442290001Sglebiusfloating point number, which records the frequency offset measured 2443290001Sglebiusin parts\-per\-million (PPM). 2444290001SglebiusThe file is updated by first writing 2445290001Sglebiusthe current drift value into a temporary file and then renaming 2446290001Sglebiusthis file to replace the old version. 2447290001SglebiusThis implies that 2448290001Sglebius.Xr ntpd @NTPD_MS@ 2449290001Sglebiusmust have write permission for the directory the 2450290001Sglebiusdrift file is located in, and that file system links, symbolic or 2451290001Sglebiusotherwise, should be avoided. 2452290001Sglebius.It Ic dscp Ar value 2453290001SglebiusThis option specifies the Differentiated Services Control Point (DSCP) value, 2454298770Sdelphija 6\-bit code. 2455298770SdelphijThe default value is 46, signifying Expedited Forwarding. 2456290001Sglebius.It Xo Ic enable 2457290001Sglebius.Oo 2458290001Sglebius.Cm auth | Cm bclient | 2459290001Sglebius.Cm calibrate | Cm kernel | 2460294905Sdelphij.Cm mode7 | Cm monitor | 2461294905Sdelphij.Cm ntp | Cm stats | 2462301301Sdelphij.Cm peer_clear_digest_early | 2463294905Sdelphij.Cm unpeer_crypto_early | Cm unpeer_crypto_nak_early | Cm unpeer_digest_early 2464290001Sglebius.Oc 2465290001Sglebius.Xc 2466290001Sglebius.It Xo Ic disable 2467290001Sglebius.Oo 2468290001Sglebius.Cm auth | Cm bclient | 2469290001Sglebius.Cm calibrate | Cm kernel | 2470294905Sdelphij.Cm mode7 | Cm monitor | 2471294905Sdelphij.Cm ntp | Cm stats | 2472301301Sdelphij.Cm peer_clear_digest_early | 2473294905Sdelphij.Cm unpeer_crypto_early | Cm unpeer_crypto_nak_early | Cm unpeer_digest_early 2474290001Sglebius.Oc 2475290001Sglebius.Xc 2476290001SglebiusProvides a way to enable or disable various server options. 2477290001SglebiusFlags not mentioned are unaffected. 2478290001SglebiusNote that all of these flags 2479290001Sglebiuscan be controlled remotely using the 2480290001Sglebius.Xr ntpdc @NTPDC_MS@ 2481290001Sglebiusutility program. 2482290001Sglebius.Bl -tag -width indent 2483290001Sglebius.It Cm auth 2484290001SglebiusEnables the server to synchronize with unconfigured peers only if the 2485290001Sglebiuspeer has been correctly authenticated using either public key or 2486290001Sglebiusprivate key cryptography. 2487290001SglebiusThe default for this flag is 2488290001Sglebius.Ic enable . 2489290001Sglebius.It Cm bclient 2490290001SglebiusEnables the server to listen for a message from a broadcast or 2491290001Sglebiusmulticast server, as in the 2492290001Sglebius.Ic multicastclient 2493290001Sglebiuscommand with default 2494290001Sglebiusaddress. 2495290001SglebiusThe default for this flag is 2496290001Sglebius.Ic disable . 2497290001Sglebius.It Cm calibrate 2498290001SglebiusEnables the calibrate feature for reference clocks. 2499290001SglebiusThe default for 2500290001Sglebiusthis flag is 2501290001Sglebius.Ic disable . 2502290001Sglebius.It Cm kernel 2503290001SglebiusEnables the kernel time discipline, if available. 2504290001SglebiusThe default for this 2505290001Sglebiusflag is 2506290001Sglebius.Ic enable 2507290001Sglebiusif support is available, otherwise 2508290001Sglebius.Ic disable . 2509290001Sglebius.It Cm mode7 2510290001SglebiusEnables processing of NTP mode 7 implementation\-specific requests 2511290001Sglebiuswhich are used by the deprecated 2512290001Sglebius.Xr ntpdc @NTPDC_MS@ 2513290001Sglebiusprogram. 2514290001SglebiusThe default for this flag is disable. 2515290001SglebiusThis flag is excluded from runtime configuration using 2516290001Sglebius.Xr ntpq @NTPQ_MS@ . 2517290001SglebiusThe 2518290001Sglebius.Xr ntpq @NTPQ_MS@ 2519290001Sglebiusprogram provides the same capabilities as 2520290001Sglebius.Xr ntpdc @NTPDC_MS@ 2521290001Sglebiususing standard mode 6 requests. 2522290001Sglebius.It Cm monitor 2523290001SglebiusEnables the monitoring facility. 2524290001SglebiusSee the 2525290001Sglebius.Xr ntpdc @NTPDC_MS@ 2526290001Sglebiusprogram 2527290001Sglebiusand the 2528290001Sglebius.Ic monlist 2529290001Sglebiuscommand or further information. 2530290001SglebiusThe 2531290001Sglebiusdefault for this flag is 2532290001Sglebius.Ic enable . 2533290001Sglebius.It Cm ntp 2534290001SglebiusEnables time and frequency discipline. 2535290001SglebiusIn effect, this switch opens and 2536290001Sglebiuscloses the feedback loop, which is useful for testing. 2537290001SglebiusThe default for 2538290001Sglebiusthis flag is 2539290001Sglebius.Ic enable . 2540301301Sdelphij.It Cm peer_clear_digest_early 2541301301SdelphijBy default, if 2542301301Sdelphij.Xr ntpd @NTPD_MS@ 2543301301Sdelphijis using autokey and it 2544301301Sdelphijreceives a crypto\-NAK packet that 2545301301Sdelphijpasses the duplicate packet and origin timestamp checks 2546301301Sdelphijthe peer variables are immediately cleared. 2547301301SdelphijWhile this is generally a feature 2548301301Sdelphijas it allows for quick recovery if a server key has changed, 2549301301Sdelphija properly forged and appropriately delivered crypto\-NAK packet 2550301301Sdelphijcan be used in a DoS attack. 2551301301SdelphijIf you have active noticable problems with this type of DoS attack 2552301301Sdelphijthen you should consider 2553301301Sdelphijdisabling this option. 2554301301SdelphijYou can check your 2555301301Sdelphij.Cm peerstats 2556301301Sdelphijfile for evidence of any of these attacks. 2557301301SdelphijThe 2558301301Sdelphijdefault for this flag is 2559301301Sdelphij.Ic enable . 2560290001Sglebius.It Cm stats 2561290001SglebiusEnables the statistics facility. 2562290001SglebiusSee the 2563290001Sglebius.Sx Monitoring Options 2564290001Sglebiussection for further information. 2565290001SglebiusThe default for this flag is 2566290001Sglebius.Ic disable . 2567294905Sdelphij.It Cm unpeer_crypto_early 2568294905SdelphijBy default, if 2569294905Sdelphij.Xr ntpd @NTPD_MS@ 2570294905Sdelphijreceives an autokey packet that fails TEST9, 2571294905Sdelphija crypto failure, 2572294905Sdelphijthe association is immediately cleared. 2573294905SdelphijThis is almost certainly a feature, 2574294905Sdelphijbut if, in spite of the current recommendation of not using autokey, 2575294905Sdelphijyou are 2576294905Sdelphij.B still 2577294905Sdelphijusing autokey 2578294905Sdelphij.B and 2579294905Sdelphijyou are seeing this sort of DoS attack 2580294905Sdelphijdisabling this flag will delay 2581294905Sdelphijtearing down the association until the reachability counter 2582294905Sdelphijbecomes zero. 2583294905SdelphijYou can check your 2584294905Sdelphij.Cm peerstats 2585294905Sdelphijfile for evidence of any of these attacks. 2586294905SdelphijThe 2587294905Sdelphijdefault for this flag is 2588294905Sdelphij.Ic enable . 2589294905Sdelphij.It Cm unpeer_crypto_nak_early 2590294905SdelphijBy default, if 2591294905Sdelphij.Xr ntpd @NTPD_MS@ 2592294905Sdelphijreceives a crypto\-NAK packet that 2593294905Sdelphijpasses the duplicate packet and origin timestamp checks 2594294905Sdelphijthe association is immediately cleared. 2595294905SdelphijWhile this is generally a feature 2596294905Sdelphijas it allows for quick recovery if a server key has changed, 2597294905Sdelphija properly forged and appropriately delivered crypto\-NAK packet 2598294905Sdelphijcan be used in a DoS attack. 2599294905SdelphijIf you have active noticable problems with this type of DoS attack 2600294905Sdelphijthen you should consider 2601294905Sdelphijdisabling this option. 2602294905SdelphijYou can check your 2603294905Sdelphij.Cm peerstats 2604294905Sdelphijfile for evidence of any of these attacks. 2605294905SdelphijThe 2606294905Sdelphijdefault for this flag is 2607294905Sdelphij.Ic enable . 2608294905Sdelphij.It Cm unpeer_digest_early 2609294905SdelphijBy default, if 2610294905Sdelphij.Xr ntpd @NTPD_MS@ 2611294905Sdelphijreceives what should be an authenticated packet 2612294905Sdelphijthat passes other packet sanity checks but 2613294905Sdelphijcontains an invalid digest 2614294905Sdelphijthe association is immediately cleared. 2615294905SdelphijWhile this is generally a feature 2616294905Sdelphijas it allows for quick recovery, 2617294905Sdelphijif this type of packet is carefully forged and sent 2618294905Sdelphijduring an appropriate window it can be used for a DoS attack. 2619294905SdelphijIf you have active noticable problems with this type of DoS attack 2620294905Sdelphijthen you should consider 2621294905Sdelphijdisabling this option. 2622294905SdelphijYou can check your 2623294905Sdelphij.Cm peerstats 2624294905Sdelphijfile for evidence of any of these attacks. 2625294905SdelphijThe 2626294905Sdelphijdefault for this flag is 2627294905Sdelphij.Ic enable . 2628290001Sglebius.El 2629290001Sglebius.It Ic includefile Ar includefile 2630290001SglebiusThis command allows additional configuration commands 2631290001Sglebiusto be included from a separate file. 2632290001SglebiusInclude files may 2633290001Sglebiusbe nested to a depth of five; upon reaching the end of any 2634290001Sglebiusinclude file, command processing resumes in the previous 2635290001Sglebiusconfiguration file. 2636290001SglebiusThis option is useful for sites that run 2637290001Sglebius.Xr ntpd @NTPD_MS@ 2638290001Sglebiuson multiple hosts, with (mostly) common options (e.g., a 2639290001Sglebiusrestriction list). 2640290001Sglebius.It Ic leapsmearinterval Ar seconds 2641290001SglebiusThis EXPERIMENTAL option is only available if 2642290001Sglebius.Xr ntpd @NTPD_MS@ 2643290001Sglebiuswas built with the 2644290001Sglebius.Cm \-\-enable\-leap\-smear 2645290001Sglebiusoption to the 2646290001Sglebius.Cm configure 2647290001Sglebiusscript. 2648290001SglebiusIt specifies the interval over which a leap second correction will be applied. 2649290001SglebiusRecommended values for this option are between 2650290001Sglebius7200 (2 hours) and 86400 (24 hours). 2651290001Sglebius.Sy DO NOT USE THIS OPTION ON PUBLIC\-ACCESS SERVERS! 2652290001SglebiusSee http://bugs.ntp.org/2855 for more information. 2653290001Sglebius.It Ic logconfig Ar configkeyword 2654290001SglebiusThis command controls the amount and type of output written to 2655290001Sglebiusthe system 2656290001Sglebius.Xr syslog 3 2657290001Sglebiusfacility or the alternate 2658290001Sglebius.Ic logfile 2659290001Sglebiuslog file. 2660290001SglebiusBy default, all output is turned on. 2661290001SglebiusAll 2662290001Sglebius.Ar configkeyword 2663290001Sglebiuskeywords can be prefixed with 2664290001Sglebius.Ql = , 2665290001Sglebius.Ql + 2666290001Sglebiusand 2667290001Sglebius.Ql \- , 2668290001Sglebiuswhere 2669290001Sglebius.Ql = 2670290001Sglebiussets the 2671290001Sglebius.Xr syslog 3 2672290001Sglebiuspriority mask, 2673290001Sglebius.Ql + 2674290001Sglebiusadds and 2675290001Sglebius.Ql \- 2676290001Sglebiusremoves 2677290001Sglebiusmessages. 2678290001Sglebius.Xr syslog 3 2679290001Sglebiusmessages can be controlled in four 2680290001Sglebiusclasses 2681290001Sglebius.Po 2682290001Sglebius.Cm clock , 2683290001Sglebius.Cm peer , 2684290001Sglebius.Cm sys 2685290001Sglebiusand 2686290001Sglebius.Cm sync 2687290001Sglebius.Pc . 2688290001SglebiusWithin these classes four types of messages can be 2689290001Sglebiuscontrolled: informational messages 2690290001Sglebius.Po 2691290001Sglebius.Cm info 2692290001Sglebius.Pc , 2693290001Sglebiusevent messages 2694290001Sglebius.Po 2695290001Sglebius.Cm events 2696290001Sglebius.Pc , 2697290001Sglebiusstatistics messages 2698290001Sglebius.Po 2699290001Sglebius.Cm statistics 2700290001Sglebius.Pc 2701290001Sglebiusand 2702290001Sglebiusstatus messages 2703290001Sglebius.Po 2704290001Sglebius.Cm status 2705290001Sglebius.Pc . 2706290001Sglebius.Pp 2707290001SglebiusConfiguration keywords are formed by concatenating the message class with 2708290001Sglebiusthe event class. 2709290001SglebiusThe 2710290001Sglebius.Cm all 2711290001Sglebiusprefix can be used instead of a message class. 2712290001SglebiusA 2713290001Sglebiusmessage class may also be followed by the 2714290001Sglebius.Cm all 2715290001Sglebiuskeyword to enable/disable all 2716298770Sdelphijmessages of the respective message class. 2717298770SdelphijThus, a minimal log configuration 2718290001Sglebiuscould look like this: 2719290001Sglebius.Bd -literal 2720290001Sglebiuslogconfig =syncstatus +sysevents 2721290001Sglebius.Ed 2722290001Sglebius.Pp 2723290001SglebiusThis would just list the synchronizations state of 2724290001Sglebius.Xr ntpd @NTPD_MS@ 2725290001Sglebiusand the major system events. 2726290001SglebiusFor a simple reference server, the 2727290001Sglebiusfollowing minimum message configuration could be useful: 2728290001Sglebius.Bd -literal 2729290001Sglebiuslogconfig =syncall +clockall 2730290001Sglebius.Ed 2731290001Sglebius.Pp 2732290001SglebiusThis configuration will list all clock information and 2733290001Sglebiussynchronization information. 2734290001SglebiusAll other events and messages about 2735290001Sglebiuspeers, system events and so on is suppressed. 2736290001Sglebius.It Ic logfile Ar logfile 2737290001SglebiusThis command specifies the location of an alternate log file to 2738290001Sglebiusbe used instead of the default system 2739290001Sglebius.Xr syslog 3 2740290001Sglebiusfacility. 2741298770SdelphijThis is the same operation as the 2742298770Sdelphij.Fl l 2743298770Sdelphijcommand line option. 2744290001Sglebius.It Ic setvar Ar variable Op Cm default 2745290001SglebiusThis command adds an additional system variable. 2746290001SglebiusThese 2747290001Sglebiusvariables can be used to distribute additional information such as 2748290001Sglebiusthe access policy. 2749290001SglebiusIf the variable of the form 2750290001Sglebius.Sm off 2751290001Sglebius.Va name = Ar value 2752290001Sglebius.Sm on 2753290001Sglebiusis followed by the 2754290001Sglebius.Cm default 2755290001Sglebiuskeyword, the 2756290001Sglebiusvariable will be listed as part of the default system variables 2757290001Sglebius.Po 2758290001Sglebius.Xr ntpq @NTPQ_MS@ 2759290001Sglebius.Ic rv 2760290001Sglebiuscommand 2761290001Sglebius.Pc ) . 2762290001SglebiusThese additional variables serve 2763290001Sglebiusinformational purposes only. 2764290001SglebiusThey are not related to the protocol 2765290001Sglebiusother that they can be listed. 2766290001SglebiusThe known protocol variables will 2767290001Sglebiusalways override any variables defined via the 2768290001Sglebius.Ic setvar 2769290001Sglebiusmechanism. 2770290001SglebiusThere are three special variables that contain the names 2771290001Sglebiusof all variable of the same group. 2772290001SglebiusThe 2773290001Sglebius.Va sys_var_list 2774290001Sglebiusholds 2775290001Sglebiusthe names of all system variables. 2776290001SglebiusThe 2777290001Sglebius.Va peer_var_list 2778290001Sglebiusholds 2779290001Sglebiusthe names of all peer variables and the 2780290001Sglebius.Va clock_var_list 2781290001Sglebiusholds the names of the reference clock variables. 2782290001Sglebius.It Xo Ic tinker 2783290001Sglebius.Oo 2784290001Sglebius.Cm allan Ar allan | 2785290001Sglebius.Cm dispersion Ar dispersion | 2786290001Sglebius.Cm freq Ar freq | 2787290001Sglebius.Cm huffpuff Ar huffpuff | 2788290001Sglebius.Cm panic Ar panic | 2789290001Sglebius.Cm step Ar step | 2790290001Sglebius.Cm stepback Ar stepback | 2791290001Sglebius.Cm stepfwd Ar stepfwd | 2792290001Sglebius.Cm stepout Ar stepout 2793290001Sglebius.Oc 2794290001Sglebius.Xc 2795290001SglebiusThis command can be used to alter several system variables in 2796290001Sglebiusvery exceptional circumstances. 2797290001SglebiusIt should occur in the 2798290001Sglebiusconfiguration file before any other configuration options. 2799290001SglebiusThe 2800290001Sglebiusdefault values of these variables have been carefully optimized for 2801290001Sglebiusa wide range of network speeds and reliability expectations. 2802290001SglebiusIn 2803290001Sglebiusgeneral, they interact in intricate ways that are hard to predict 2804290001Sglebiusand some combinations can result in some very nasty behavior. 2805290001SglebiusVery 2806290001Sglebiusrarely is it necessary to change the default values; but, some 2807290001Sglebiusfolks cannot resist twisting the knobs anyway and this command is 2808290001Sglebiusfor them. 2809290001SglebiusEmphasis added: twisters are on their own and can expect 2810290001Sglebiusno help from the support group. 2811290001Sglebius.Pp 2812290001SglebiusThe variables operate as follows: 2813290001Sglebius.Bl -tag -width indent 2814290001Sglebius.It Cm allan Ar allan 2815290001SglebiusThe argument becomes the new value for the minimum Allan 2816290001Sglebiusintercept, which is a parameter of the PLL/FLL clock discipline 2817290001Sglebiusalgorithm. 2818290001SglebiusThe value in log2 seconds defaults to 7 (1024 s), which is also the lower 2819290001Sglebiuslimit. 2820290001Sglebius.It Cm dispersion Ar dispersion 2821290001SglebiusThe argument becomes the new value for the dispersion increase rate, 2822290001Sglebiusnormally .000015 s/s. 2823290001Sglebius.It Cm freq Ar freq 2824290001SglebiusThe argument becomes the initial value of the frequency offset in 2825290001Sglebiusparts\-per\-million. 2826290001SglebiusThis overrides the value in the frequency file, if 2827290001Sglebiuspresent, and avoids the initial training state if it is not. 2828290001Sglebius.It Cm huffpuff Ar huffpuff 2829290001SglebiusThe argument becomes the new value for the experimental 2830290001Sglebiushuff\-n'\-puff filter span, which determines the most recent interval 2831290001Sglebiusthe algorithm will search for a minimum delay. 2832290001SglebiusThe lower limit is 2833290001Sglebius900 s (15 m), but a more reasonable value is 7200 (2 hours). 2834290001SglebiusThere 2835290001Sglebiusis no default, since the filter is not enabled unless this command 2836290001Sglebiusis given. 2837290001Sglebius.It Cm panic Ar panic 2838290001SglebiusThe argument is the panic threshold, normally 1000 s. 2839290001SglebiusIf set to zero, 2840290001Sglebiusthe panic sanity check is disabled and a clock offset of any value will 2841290001Sglebiusbe accepted. 2842290001Sglebius.It Cm step Ar step 2843290001SglebiusThe argument is the step threshold, which by default is 0.128 s. 2844290001SglebiusIt can 2845290001Sglebiusbe set to any positive number in seconds. 2846290001SglebiusIf set to zero, step 2847290001Sglebiusadjustments will never occur. 2848290001SglebiusNote: The kernel time discipline is 2849290001Sglebiusdisabled if the step threshold is set to zero or greater than the 2850290001Sglebiusdefault. 2851290001Sglebius.It Cm stepback Ar stepback 2852290001SglebiusThe argument is the step threshold for the backward direction, 2853290001Sglebiuswhich by default is 0.128 s. 2854290001SglebiusIt can 2855290001Sglebiusbe set to any positive number in seconds. 2856290001SglebiusIf both the forward and backward step thresholds are set to zero, step 2857290001Sglebiusadjustments will never occur. 2858290001SglebiusNote: The kernel time discipline is 2859290001Sglebiusdisabled if 2860290001Sglebiuseach direction of step threshold are either 2861290001Sglebiusset to zero or greater than .5 second. 2862290001Sglebius.It Cm stepfwd Ar stepfwd 2863290001SglebiusAs for stepback, but for the forward direction. 2864290001Sglebius.It Cm stepout Ar stepout 2865290001SglebiusThe argument is the stepout timeout, which by default is 900 s. 2866290001SglebiusIt can 2867290001Sglebiusbe set to any positive number in seconds. 2868290001SglebiusIf set to zero, the stepout 2869290001Sglebiuspulses will not be suppressed. 2870290001Sglebius.El 2871290001Sglebius.It Xo Ic rlimit 2872290001Sglebius.Oo 2873290001Sglebius.Cm memlock Ar Nmegabytes | 2874290001Sglebius.Cm stacksize Ar N4kPages 2875290001Sglebius.Cm filenum Ar Nfiledescriptors 2876290001Sglebius.Oc 2877290001Sglebius.Xc 2878290001Sglebius.Bl -tag -width indent 2879290001Sglebius.It Cm memlock Ar Nmegabytes 2880290001SglebiusSpecify the number of megabytes of memory that should be 2881290001Sglebiusallocated and locked. 2882290001SglebiusProbably only available under Linux, this option may be useful 2883290001Sglebiuswhen dropping root (the 2884290001Sglebius.Fl i 2885290001Sglebiusoption). 2886290001SglebiusThe default is 32 megabytes on non\-Linux machines, and \-1 under Linux. 2887290001Sglebius-1 means "do not lock the process into memory". 2888290001Sglebius0 means "lock whatever memory the process wants into memory". 2889290001Sglebius.It Cm stacksize Ar N4kPages 2890290001SglebiusSpecifies the maximum size of the process stack on systems with the 2891290001Sglebius.Fn mlockall 2892290001Sglebiusfunction. 2893290001SglebiusDefaults to 50 4k pages (200 4k pages in OpenBSD). 2894290001Sglebius.It Cm filenum Ar Nfiledescriptors 2895298770SdelphijSpecifies the maximum number of file descriptors ntpd may have open at once. 2896298770SdelphijDefaults to the system default. 2897290001Sglebius.El 2898290001Sglebius.It Xo Ic trap Ar host_address 2899290001Sglebius.Op Cm port Ar port_number 2900290001Sglebius.Op Cm interface Ar interface_address 2901290001Sglebius.Xc 2902290001SglebiusThis command configures a trap receiver at the given host 2903290001Sglebiusaddress and port number for sending messages with the specified 2904290001Sglebiuslocal interface address. 2905290001SglebiusIf the port number is unspecified, a value 2906290001Sglebiusof 18447 is used. 2907290001SglebiusIf the interface address is not specified, the 2908290001Sglebiusmessage is sent with a source address of the local interface the 2909290001Sglebiusmessage is sent through. 2910290001SglebiusNote that on a multihomed host the 2911290001Sglebiusinterface used may vary from time to time with routing changes. 2912290001Sglebius.Pp 2913290001SglebiusThe trap receiver will generally log event messages and other 2914290001Sglebiusinformation from the server in a log file. 2915290001SglebiusWhile such monitor 2916290001Sglebiusprograms may also request their own trap dynamically, configuring a 2917290001Sglebiustrap receiver will ensure that no messages are lost when the server 2918290001Sglebiusis started. 2919290001Sglebius.It Cm hop Ar ... 2920290001SglebiusThis command specifies a list of TTL values in increasing order, up to 8 2921290001Sglebiusvalues can be specified. 2922290001SglebiusIn manycast mode these values are used in turn in 2923290001Sglebiusan expanding\-ring search. 2924290001SglebiusThe default is eight multiples of 32 starting at 2925290001Sglebius31. 2926290001Sglebius.El 2927290001Sglebius.Sh "OPTIONS" 2928290001Sglebius.Bl -tag 2929290001Sglebius.It Fl \-help 2930290001SglebiusDisplay usage information and exit. 2931290001Sglebius.It Fl \-more\-help 2932290001SglebiusPass the extended usage information through a pager. 2933290001Sglebius.It Fl \-version Op Brq Ar v|c|n 2934290001SglebiusOutput version of program and exit. The default mode is `v', a simple 2935290001Sglebiusversion. The `c' mode will print copyright information and `n' will 2936290001Sglebiusprint the full copyright notice. 2937290001Sglebius.El 2938290001Sglebius.Sh "OPTION PRESETS" 2939290001SglebiusAny option that is not marked as \fInot presettable\fP may be preset 2940290001Sglebiusby loading values from environment variables named: 2941290001Sglebius.nf 2942290001Sglebius \fBNTP_CONF_<option\-name>\fP or \fBNTP_CONF\fP 2943290001Sglebius.fi 2944290001Sglebius.ad 2945290001Sglebius.Sh "ENVIRONMENT" 2946290001SglebiusSee \fBOPTION PRESETS\fP for configuration environment variables. 2947290001Sglebius.Sh FILES 2948290001Sglebius.Bl -tag -width /etc/ntp.drift -compact 2949290001Sglebius.It Pa /etc/ntp.conf 2950290001Sglebiusthe default name of the configuration file 2951290001Sglebius.It Pa ntp.keys 2952290001Sglebiusprivate MD5 keys 2953290001Sglebius.It Pa ntpkey 2954290001SglebiusRSA private key 2955290001Sglebius.It Pa ntpkey_ Ns Ar host 2956290001SglebiusRSA public key 2957290001Sglebius.It Pa ntp_dh 2958290001SglebiusDiffie\-Hellman agreement parameters 2959290001Sglebius.El 2960290001Sglebius.Sh "EXIT STATUS" 2961290001SglebiusOne of the following exit values will be returned: 2962290001Sglebius.Bl -tag 2963290001Sglebius.It 0 " (EXIT_SUCCESS)" 2964290001SglebiusSuccessful program execution. 2965290001Sglebius.It 1 " (EXIT_FAILURE)" 2966290001SglebiusThe operation failed or the command syntax was not valid. 2967290001Sglebius.It 70 " (EX_SOFTWARE)" 2968290001Sglebiuslibopts had an internal operational error. Please report 2969290001Sglebiusit to autogen\-users@lists.sourceforge.net. Thank you. 2970290001Sglebius.El 2971290001Sglebius.Sh "SEE ALSO" 2972290001Sglebius.Xr ntpd @NTPD_MS@ , 2973290001Sglebius.Xr ntpdc @NTPDC_MS@ , 2974290001Sglebius.Xr ntpq @NTPQ_MS@ 2975290001Sglebius.Pp 2976290001SglebiusIn addition to the manual pages provided, 2977290001Sglebiuscomprehensive documentation is available on the world wide web 2978290001Sglebiusat 2979290001Sglebius.Li http://www.ntp.org/ . 2980290001SglebiusA snapshot of this documentation is available in HTML format in 2981290001Sglebius.Pa /usr/share/doc/ntp . 2982290001Sglebius.Rs 2983290001Sglebius.%A David L. Mills 2984290001Sglebius.%T Network Time Protocol (Version 4) 2985290001Sglebius.%O RFC5905 2986290001Sglebius.Re 2987290001Sglebius.Sh "AUTHORS" 2988290001SglebiusThe University of Delaware and Network Time Foundation 2989290001Sglebius.Sh "COPYRIGHT" 2990294905SdelphijCopyright (C) 1992\-2016 The University of Delaware and Network Time Foundation all rights reserved. 2991290001SglebiusThis program is released under the terms of the NTP license, <http://ntp.org/license>. 2992290001Sglebius.Sh BUGS 2993290001SglebiusThe syntax checking is not picky; some combinations of 2994290001Sglebiusridiculous and even hilarious options and modes may not be 2995290001Sglebiusdetected. 2996290001Sglebius.Pp 2997290001SglebiusThe 2998290001Sglebius.Pa ntpkey_ Ns Ar host 2999290001Sglebiusfiles are really digital 3000290001Sglebiuscertificates. 3001290001SglebiusThese should be obtained via secure directory 3002290001Sglebiusservices when they become universally available. 3003290001Sglebius.Pp 3004290001SglebiusPlease send bug reports to: http://bugs.ntp.org, bugs@ntp.org 3005290001Sglebius.Sh NOTES 3006290001SglebiusThis document was derived from FreeBSD. 3007290001Sglebius.Pp 3008290001SglebiusThis manual page was \fIAutoGen\fP\-erated from the \fBntp.conf\fP 3009290001Sglebiusoption definitions. 3010