ntp.conf.man.in revision 275970
1275970Scy.de1 NOP 2275970Scy. it 1 an-trap 3275970Scy. if \\n[.$] \,\\$*\/ 4275970Scy.. 5275970Scy.ie t \ 6275970Scy.ds B-Font [CB] 7275970Scy.ds I-Font [CI] 8275970Scy.ds R-Font [CR] 9275970Scy.el \ 10275970Scy.ds B-Font B 11275970Scy.ds I-Font I 12275970Scy.ds R-Font R 13275970Scy.TH ntp.conf 5 "19 Dec 2014" "4.2.8" "File Formats" 14275970Scy.\" 15275970Scy.\" EDIT THIS FILE WITH CAUTION (/tmp/.ag-eCaa6b/ag-rCai4b) 16275970Scy.\" 17275970Scy.\" It has been AutoGen-ed December 19, 2014 at 07:48:49 AM by AutoGen 5.18.5pre4 18275970Scy.\" From the definitions ntp.conf.def 19275970Scy.\" and the template file agman-cmd.tpl 20275970Scy.SH NAME 21275970Scy\f\*[B-Font]ntp.conf\fP 22275970Scy\- Network Time Protocol (NTP) daemon configuration file format 23275970Scy.SH SYNOPSIS 24275970Scy\f\*[B-Font]ntp.conf\fP 25275970Scy[\f\*[B-Font]\-\-option-name\f[]] 26275970Scy[\f\*[B-Font]\-\-option-name\f[] \f\*[I-Font]value\f[]] 27275970Scy.sp \n(Ppu 28275970Scy.ne 2 29275970Scy 30275970ScyAll arguments must be options. 31275970Scy.sp \n(Ppu 32275970Scy.ne 2 33275970Scy 34275970Scy.SH DESCRIPTION 35275970ScyThe 36275970Scy\f\*[B-Font]ntp.conf\fP 37275970Scyconfiguration file is read at initial startup by the 38275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 39275970Scydaemon in order to specify the synchronization sources, 40275970Scymodes and other related information. 41275970ScyUsually, it is installed in the 42275970Scy\fI/etc\f[] 43275970Scydirectory, 44275970Scybut could be installed elsewhere 45275970Scy(see the daemon's 46275970Scy\f\*[B-Font]\-c\f[] 47275970Scycommand line option). 48275970Scy.sp \n(Ppu 49275970Scy.ne 2 50275970Scy 51275970ScyThe file format is similar to other 52275970ScyUNIX 53275970Scyconfiguration files. 54275970ScyComments begin with a 55275970Scy\[oq]#\[cq] 56275970Scycharacter and extend to the end of the line; 57275970Scyblank lines are ignored. 58275970ScyConfiguration commands consist of an initial keyword 59275970Scyfollowed by a list of arguments, 60275970Scysome of which may be optional, separated by whitespace. 61275970ScyCommands may not be continued over multiple lines. 62275970ScyArguments may be host names, 63275970Scyhost addresses written in numeric, dotted-quad form, 64275970Scyintegers, floating point numbers (when specifying times in seconds) 65275970Scyand text strings. 66275970Scy.sp \n(Ppu 67275970Scy.ne 2 68275970Scy 69275970ScyThe rest of this page describes the configuration and control options. 70275970ScyThe 71275970Scy"Notes on Configuring NTP and Setting up an NTP Subnet" 72275970Scypage 73275970Scy(available as part of the HTML documentation 74275970Scyprovided in 75275970Scy\fI/usr/share/doc/ntp\f[]) 76275970Scycontains an extended discussion of these options. 77275970ScyIn addition to the discussion of general 78275970Scy\fIConfiguration\f[] \fIOptions\f[], 79275970Scythere are sections describing the following supported functionality 80275970Scyand the options used to control it: 81275970Scy.IP \fB\(bu\fP 2 82275970Scy\fIAuthentication\f[] \fISupport\f[] 83275970Scy.IP \fB\(bu\fP 2 84275970Scy\fIMonitoring\f[] \fISupport\f[] 85275970Scy.IP \fB\(bu\fP 2 86275970Scy\fIAccess\f[] \fIControl\f[] \fISupport\f[] 87275970Scy.IP \fB\(bu\fP 2 88275970Scy\fIAutomatic\f[] \fINTP\f[] \fIConfiguration\f[] \fIOptions\f[] 89275970Scy.IP \fB\(bu\fP 2 90275970Scy\fIReference\f[] \fIClock\f[] \fISupport\f[] 91275970Scy.IP \fB\(bu\fP 2 92275970Scy\fIMiscellaneous\f[] \fIOptions\f[] 93275970Scy.PP 94275970Scy.sp \n(Ppu 95275970Scy.ne 2 96275970Scy 97275970ScyFollowing these is a section describing 98275970Scy\fIMiscellaneous\f[] \fIOptions\f[]. 99275970ScyWhile there is a rich set of options available, 100275970Scythe only required option is one or more 101275970Scy\f\*[B-Font]pool\f[], 102275970Scy\f\*[B-Font]server\f[], 103275970Scy\f\*[B-Font]peer\f[], 104275970Scy\f\*[B-Font]broadcast\f[] 105275970Scyor 106275970Scy\f\*[B-Font]manycastclient\f[] 107275970Scycommands. 108275970Scy.SH Configuration Support 109275970ScyFollowing is a description of the configuration commands in 110275970ScyNTPv4. 111275970ScyThese commands have the same basic functions as in NTPv3 and 112275970Scyin some cases new functions and new arguments. 113275970ScyThere are two 114275970Scyclasses of commands, configuration commands that configure a 115275970Scypersistent association with a remote server or peer or reference 116275970Scyclock, and auxiliary commands that specify environmental variables 117275970Scythat control various related operations. 118275970Scy.SS Configuration Commands 119275970ScyThe various modes are determined by the command keyword and the 120275970Scytype of the required IP address. 121275970ScyAddresses are classed by type as 122275970Scy(s) a remote server or peer (IPv4 class A, B and C), (b) the 123275970Scybroadcast address of a local interface, (m) a multicast address (IPv4 124275970Scyclass D), or (r) a reference clock address (127.127.x.x). 125275970ScyNote that 126275970Scyonly those options applicable to each command are listed below. 127275970ScyUse 128275970Scyof options not listed may not be caught as an error, but may result 129275970Scyin some weird and even destructive behavior. 130275970Scy.sp \n(Ppu 131275970Scy.ne 2 132275970Scy 133275970ScyIf the Basic Socket Interface Extensions for IPv6 (RFC-2553) 134275970Scyis detected, support for the IPv6 address family is generated 135275970Scyin addition to the default support of the IPv4 address family. 136275970ScyIn a few cases, including the reslist billboard generated 137275970Scyby ntpdc, IPv6 addresses are automatically generated. 138275970ScyIPv6 addresses can be identified by the presence of colons 139275970Scy\*[Lq]\&:\*[Rq] 140275970Scyin the address field. 141275970ScyIPv6 addresses can be used almost everywhere where 142275970ScyIPv4 addresses can be used, 143275970Scywith the exception of reference clock addresses, 144275970Scywhich are always IPv4. 145275970Scy.sp \n(Ppu 146275970Scy.ne 2 147275970Scy 148275970ScyNote that in contexts where a host name is expected, a 149275970Scy\f\*[B-Font]\-4\f[] 150275970Scyqualifier preceding 151275970Scythe host name forces DNS resolution to the IPv4 namespace, 152275970Scywhile a 153275970Scy\f\*[B-Font]\-6\f[] 154275970Scyqualifier forces DNS resolution to the IPv6 namespace. 155275970ScySee IPv6 references for the 156275970Scyequivalent classes for that address family. 157275970Scy.TP 7 158275970Scy.NOP \f\*[B-Font]pool\f[] \f\*[I-Font]address\f[] [\f\*[B-Font]burst\f[]] [\f\*[B-Font]iburst\f[]] [\f\*[B-Font]version\f[] \f\*[I-Font]version\f[]] [\f\*[B-Font]prefer\f[]] [\f\*[B-Font]minpoll\f[] \f\*[I-Font]minpoll\f[]] [\f\*[B-Font]maxpoll\f[] \f\*[I-Font]maxpoll\f[]] 159275970Scy.TP 7 160275970Scy.NOP \f\*[B-Font]server\f[] \f\*[I-Font]address\f[] [\f\*[B-Font]key\f[] \f\*[I-Font]key\f[] \f\*[I-Font]\&|\f[] \f\*[B-Font]autokey\f[]] [\f\*[B-Font]burst\f[]] [\f\*[B-Font]iburst\f[]] [\f\*[B-Font]version\f[] \f\*[I-Font]version\f[]] [\f\*[B-Font]prefer\f[]] [\f\*[B-Font]minpoll\f[] \f\*[I-Font]minpoll\f[]] [\f\*[B-Font]maxpoll\f[] \f\*[I-Font]maxpoll\f[]] 161275970Scy.TP 7 162275970Scy.NOP \f\*[B-Font]peer\f[] \f\*[I-Font]address\f[] [\f\*[B-Font]key\f[] \f\*[I-Font]key\f[] \f\*[I-Font]\&|\f[] \f\*[B-Font]autokey\f[]] [\f\*[B-Font]version\f[] \f\*[I-Font]version\f[]] [\f\*[B-Font]prefer\f[]] [\f\*[B-Font]minpoll\f[] \f\*[I-Font]minpoll\f[]] [\f\*[B-Font]maxpoll\f[] \f\*[I-Font]maxpoll\f[]] 163275970Scy.TP 7 164275970Scy.NOP \f\*[B-Font]broadcast\f[] \f\*[I-Font]address\f[] [\f\*[B-Font]key\f[] \f\*[I-Font]key\f[] \f\*[I-Font]\&|\f[] \f\*[B-Font]autokey\f[]] [\f\*[B-Font]version\f[] \f\*[I-Font]version\f[]] [\f\*[B-Font]prefer\f[]] [\f\*[B-Font]minpoll\f[] \f\*[I-Font]minpoll\f[]] [\f\*[B-Font]ttl\f[] \f\*[I-Font]ttl\f[]] 165275970Scy.TP 7 166275970Scy.NOP \f\*[B-Font]manycastclient\f[] \f\*[I-Font]address\f[] [\f\*[B-Font]key\f[] \f\*[I-Font]key\f[] \f\*[I-Font]\&|\f[] \f\*[B-Font]autokey\f[]] [\f\*[B-Font]version\f[] \f\*[I-Font]version\f[]] [\f\*[B-Font]prefer\f[]] [\f\*[B-Font]minpoll\f[] \f\*[I-Font]minpoll\f[]] [\f\*[B-Font]maxpoll\f[] \f\*[I-Font]maxpoll\f[]] [\f\*[B-Font]ttl\f[] \f\*[I-Font]ttl\f[]] 167275970Scy.PP 168275970Scy.sp \n(Ppu 169275970Scy.ne 2 170275970Scy 171275970ScyThese five commands specify the time server name or address to 172275970Scybe used and the mode in which to operate. 173275970ScyThe 174275970Scy\f\*[I-Font]address\f[] 175275970Scycan be 176275970Scyeither a DNS name or an IP address in dotted-quad notation. 177275970ScyAdditional information on association behavior can be found in the 178275970Scy"Association Management" 179275970Scypage 180275970Scy(available as part of the HTML documentation 181275970Scyprovided in 182275970Scy\fI/usr/share/doc/ntp\f[]). 183275970Scy.TP 7 184275970Scy.NOP \f\*[B-Font]pool\f[] 185275970ScyFor type s addresses, this command mobilizes a persistent 186275970Scyclient mode association with a number of remote servers. 187275970ScyIn this mode the local clock can synchronized to the 188275970Scyremote server, but the remote server can never be synchronized to 189275970Scythe local clock. 190275970Scy.TP 7 191275970Scy.NOP \f\*[B-Font]server\f[] 192275970ScyFor type s and r addresses, this command mobilizes a persistent 193275970Scyclient mode association with the specified remote server or local 194275970Scyradio clock. 195275970ScyIn this mode the local clock can synchronized to the 196275970Scyremote server, but the remote server can never be synchronized to 197275970Scythe local clock. 198275970ScyThis command should 199275970Scy\fInot\f[] 200275970Scybe used for type 201275970Scyb or m addresses. 202275970Scy.TP 7 203275970Scy.NOP \f\*[B-Font]peer\f[] 204275970ScyFor type s addresses (only), this command mobilizes a 205275970Scypersistent symmetric-active mode association with the specified 206275970Scyremote peer. 207275970ScyIn this mode the local clock can be synchronized to 208275970Scythe remote peer or the remote peer can be synchronized to the local 209275970Scyclock. 210275970ScyThis is useful in a network of servers where, depending on 211275970Scyvarious failure scenarios, either the local or remote peer may be 212275970Scythe better source of time. 213275970ScyThis command should NOT be used for type 214275970Scyb, m or r addresses. 215275970Scy.TP 7 216275970Scy.NOP \f\*[B-Font]broadcast\f[] 217275970ScyFor type b and m addresses (only), this 218275970Scycommand mobilizes a persistent broadcast mode association. 219275970ScyMultiple 220275970Scycommands can be used to specify multiple local broadcast interfaces 221275970Scy(subnets) and/or multiple multicast groups. 222275970ScyNote that local 223275970Scybroadcast messages go only to the interface associated with the 224275970Scysubnet specified, but multicast messages go to all interfaces. 225275970ScyIn broadcast mode the local server sends periodic broadcast 226275970Scymessages to a client population at the 227275970Scy\f\*[I-Font]address\f[] 228275970Scyspecified, which is usually the broadcast address on (one of) the 229275970Scylocal network(s) or a multicast address assigned to NTP. 230275970ScyThe IANA 231275970Scyhas assigned the multicast group address IPv4 224.0.1.1 and 232275970ScyIPv6 ff05::101 (site local) exclusively to 233275970ScyNTP, but other nonconflicting addresses can be used to contain the 234275970Scymessages within administrative boundaries. 235275970ScyOrdinarily, this 236275970Scyspecification applies only to the local server operating as a 237275970Scysender; for operation as a broadcast client, see the 238275970Scy\f\*[B-Font]broadcastclient\f[] 239275970Scyor 240275970Scy\f\*[B-Font]multicastclient\f[] 241275970Scycommands 242275970Scybelow. 243275970Scy.TP 7 244275970Scy.NOP \f\*[B-Font]manycastclient\f[] 245275970ScyFor type m addresses (only), this command mobilizes a 246275970Scymanycast client mode association for the multicast address 247275970Scyspecified. 248275970ScyIn this case a specific address must be supplied which 249275970Scymatches the address used on the 250275970Scy\f\*[B-Font]manycastserver\f[] 251275970Scycommand for 252275970Scythe designated manycast servers. 253275970ScyThe NTP multicast address 254275970Scy224.0.1.1 assigned by the IANA should NOT be used, unless specific 255275970Scymeans are taken to avoid spraying large areas of the Internet with 256275970Scythese messages and causing a possibly massive implosion of replies 257275970Scyat the sender. 258275970ScyThe 259275970Scy\f\*[B-Font]manycastserver\f[] 260275970Scycommand specifies that the local server 261275970Scyis to operate in client mode with the remote servers that are 262275970Scydiscovered as the result of broadcast/multicast messages. 263275970ScyThe 264275970Scyclient broadcasts a request message to the group address associated 265275970Scywith the specified 266275970Scy\f\*[I-Font]address\f[] 267275970Scyand specifically enabled 268275970Scyservers respond to these messages. 269275970ScyThe client selects the servers 270275970Scyproviding the best time and continues as with the 271275970Scy\f\*[B-Font]server\f[] 272275970Scycommand. 273275970ScyThe remaining servers are discarded as if never 274275970Scyheard. 275275970Scy.PP 276275970Scy.sp \n(Ppu 277275970Scy.ne 2 278275970Scy 279275970ScyOptions: 280275970Scy.TP 7 281275970Scy.NOP \f\*[B-Font]autokey\f[] 282275970ScyAll packets sent to and received from the server or peer are to 283275970Scyinclude authentication fields encrypted using the autokey scheme 284275970Scydescribed in 285275970Scy\fIAuthentication\f[] \fIOptions\f[]. 286275970Scy.TP 7 287275970Scy.NOP \f\*[B-Font]burst\f[] 288275970Scywhen the server is reachable, send a burst of eight packets 289275970Scyinstead of the usual one. 290275970ScyThe packet spacing is normally 2 s; 291275970Scyhowever, the spacing between the first and second packets 292275970Scycan be changed with the calldelay command to allow 293275970Scyadditional time for a modem or ISDN call to complete. 294275970ScyThis is designed to improve timekeeping quality 295275970Scywith the 296275970Scy\f\*[B-Font]server\f[] 297275970Scycommand and s addresses. 298275970Scy.TP 7 299275970Scy.NOP \f\*[B-Font]iburst\f[] 300275970ScyWhen the server is unreachable, send a burst of eight packets 301275970Scyinstead of the usual one. 302275970ScyThe packet spacing is normally 2 s; 303275970Scyhowever, the spacing between the first two packets can be 304275970Scychanged with the calldelay command to allow 305275970Scyadditional time for a modem or ISDN call to complete. 306275970ScyThis is designed to speed the initial synchronization 307275970Scyacquisition with the 308275970Scy\f\*[B-Font]server\f[] 309275970Scycommand and s addresses and when 310275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 311275970Scyis started with the 312275970Scy\f\*[B-Font]\-q\f[] 313275970Scyoption. 314275970Scy.TP 7 315275970Scy.NOP \f\*[B-Font]key\f[] \f\*[I-Font]key\f[] 316275970ScyAll packets sent to and received from the server or peer are to 317275970Scyinclude authentication fields encrypted using the specified 318275970Scy\f\*[I-Font]key\f[] 319275970Scyidentifier with values from 1 to 65534, inclusive. 320275970ScyThe 321275970Scydefault is to include no encryption field. 322275970Scy.TP 7 323275970Scy.NOP \f\*[B-Font]minpoll\f[] \f\*[I-Font]minpoll\f[] 324275970Scy.TP 7 325275970Scy.NOP \f\*[B-Font]maxpoll\f[] \f\*[I-Font]maxpoll\f[] 326275970ScyThese options specify the minimum and maximum poll intervals 327275970Scyfor NTP messages, as a power of 2 in seconds 328275970ScyThe maximum poll 329275970Scyinterval defaults to 10 (1,024 s), but can be increased by the 330275970Scy\f\*[B-Font]maxpoll\f[] 331275970Scyoption to an upper limit of 17 (36.4 h). 332275970ScyThe 333275970Scyminimum poll interval defaults to 6 (64 s), but can be decreased by 334275970Scythe 335275970Scy\f\*[B-Font]minpoll\f[] 336275970Scyoption to a lower limit of 4 (16 s). 337275970Scy.TP 7 338275970Scy.NOP \f\*[B-Font]noselect\f[] 339275970ScyMarks the server as unused, except for display purposes. 340275970ScyThe server is discarded by the selection algroithm. 341275970Scy.TP 7 342275970Scy.NOP \f\*[B-Font]prefer\f[] 343275970ScyMarks the server as preferred. 344275970ScyAll other things being equal, 345275970Scythis host will be chosen for synchronization among a set of 346275970Scycorrectly operating hosts. 347275970ScySee the 348275970Scy"Mitigation Rules and the prefer Keyword" 349275970Scypage 350275970Scy(available as part of the HTML documentation 351275970Scyprovided in 352275970Scy\fI/usr/share/doc/ntp\f[]) 353275970Scyfor further information. 354275970Scy.TP 7 355275970Scy.NOP \f\*[B-Font]ttl\f[] \f\*[I-Font]ttl\f[] 356275970ScyThis option is used only with broadcast server and manycast 357275970Scyclient modes. 358275970ScyIt specifies the time-to-live 359275970Scy\f\*[I-Font]ttl\f[] 360275970Scyto 361275970Scyuse on broadcast server and multicast server and the maximum 362275970Scy\f\*[I-Font]ttl\f[] 363275970Scyfor the expanding ring search with manycast 364275970Scyclient packets. 365275970ScySelection of the proper value, which defaults to 366275970Scy127, is something of a black art and should be coordinated with the 367275970Scynetwork administrator. 368275970Scy.TP 7 369275970Scy.NOP \f\*[B-Font]version\f[] \f\*[I-Font]version\f[] 370275970ScySpecifies the version number to be used for outgoing NTP 371275970Scypackets. 372275970ScyVersions 1-4 are the choices, with version 4 the 373275970Scydefault. 374275970Scy.PP 375275970Scy.SS Auxiliary Commands 376275970Scy.TP 7 377275970Scy.NOP \f\*[B-Font]broadcastclient\f[] 378275970ScyThis command enables reception of broadcast server messages to 379275970Scyany local interface (type b) address. 380275970ScyUpon receiving a message for 381275970Scythe first time, the broadcast client measures the nominal server 382275970Scypropagation delay using a brief client/server exchange with the 383275970Scyserver, then enters the broadcast client mode, in which it 384275970Scysynchronizes to succeeding broadcast messages. 385275970ScyNote that, in order 386275970Scyto avoid accidental or malicious disruption in this mode, both the 387275970Scyserver and client should operate using symmetric-key or public-key 388275970Scyauthentication as described in 389275970Scy\fIAuthentication\f[] \fIOptions\f[]. 390275970Scy.TP 7 391275970Scy.NOP \f\*[B-Font]manycastserver\f[] \f\*[I-Font]address\f[] \f\*[I-Font]...\f[] 392275970ScyThis command enables reception of manycast client messages to 393275970Scythe multicast group address(es) (type m) specified. 394275970ScyAt least one 395275970Scyaddress is required, but the NTP multicast address 224.0.1.1 396275970Scyassigned by the IANA should NOT be used, unless specific means are 397275970Scytaken to limit the span of the reply and avoid a possibly massive 398275970Scyimplosion at the original sender. 399275970ScyNote that, in order to avoid 400275970Scyaccidental or malicious disruption in this mode, both the server 401275970Scyand client should operate using symmetric-key or public-key 402275970Scyauthentication as described in 403275970Scy\fIAuthentication\f[] \fIOptions\f[]. 404275970Scy.TP 7 405275970Scy.NOP \f\*[B-Font]multicastclient\f[] \f\*[I-Font]address\f[] \f\*[I-Font]...\f[] 406275970ScyThis command enables reception of multicast server messages to 407275970Scythe multicast group address(es) (type m) specified. 408275970ScyUpon receiving 409275970Scya message for the first time, the multicast client measures the 410275970Scynominal server propagation delay using a brief client/server 411275970Scyexchange with the server, then enters the broadcast client mode, in 412275970Scywhich it synchronizes to succeeding multicast messages. 413275970ScyNote that, 414275970Scyin order to avoid accidental or malicious disruption in this mode, 415275970Scyboth the server and client should operate using symmetric-key or 416275970Scypublic-key authentication as described in 417275970Scy\fIAuthentication\f[] \fIOptions\f[]. 418275970Scy.PP 419275970Scy.SH Authentication Support 420275970ScyAuthentication support allows the NTP client to verify that the 421275970Scyserver is in fact known and trusted and not an intruder intending 422275970Scyaccidentally or on purpose to masquerade as that server. 423275970ScyThe NTPv3 424275970Scyspecification RFC-1305 defines a scheme which provides 425275970Scycryptographic authentication of received NTP packets. 426275970ScyOriginally, 427275970Scythis was done using the Data Encryption Standard (DES) algorithm 428275970Scyoperating in Cipher Block Chaining (CBC) mode, commonly called 429275970ScyDES-CBC. 430275970ScySubsequently, this was replaced by the RSA Message Digest 431275970Scy5 (MD5) algorithm using a private key, commonly called keyed-MD5. 432275970ScyEither algorithm computes a message digest, or one-way hash, which 433275970Scycan be used to verify the server has the correct private key and 434275970Scykey identifier. 435275970Scy.sp \n(Ppu 436275970Scy.ne 2 437275970Scy 438275970ScyNTPv4 retains the NTPv3 scheme, properly described as symmetric key 439275970Scycryptography and, in addition, provides a new Autokey scheme 440275970Scybased on public key cryptography. 441275970ScyPublic key cryptography is generally considered more secure 442275970Scythan symmetric key cryptography, since the security is based 443275970Scyon a private value which is generated by each server and 444275970Scynever revealed. 445275970ScyWith Autokey all key distribution and 446275970Scymanagement functions involve only public values, which 447275970Scyconsiderably simplifies key distribution and storage. 448275970ScyPublic key management is based on X.509 certificates, 449275970Scywhich can be provided by commercial services or 450275970Scyproduced by utility programs in the OpenSSL software library 451275970Scyor the NTPv4 distribution. 452275970Scy.sp \n(Ppu 453275970Scy.ne 2 454275970Scy 455275970ScyWhile the algorithms for symmetric key cryptography are 456275970Scyincluded in the NTPv4 distribution, public key cryptography 457275970Scyrequires the OpenSSL software library to be installed 458275970Scybefore building the NTP distribution. 459275970ScyDirections for doing that 460275970Scyare on the Building and Installing the Distribution page. 461275970Scy.sp \n(Ppu 462275970Scy.ne 2 463275970Scy 464275970ScyAuthentication is configured separately for each association 465275970Scyusing the 466275970Scy\f\*[B-Font]key\f[] 467275970Scyor 468275970Scy\f\*[B-Font]autokey\f[] 469275970Scysubcommand on the 470275970Scy\f\*[B-Font]peer\f[], 471275970Scy\f\*[B-Font]server\f[], 472275970Scy\f\*[B-Font]broadcast\f[] 473275970Scyand 474275970Scy\f\*[B-Font]manycastclient\f[] 475275970Scyconfiguration commands as described in 476275970Scy\fIConfiguration\f[] \fIOptions\f[] 477275970Scypage. 478275970ScyThe authentication 479275970Scyoptions described below specify the locations of the key files, 480275970Scyif other than default, which symmetric keys are trusted 481275970Scyand the interval between various operations, if other than default. 482275970Scy.sp \n(Ppu 483275970Scy.ne 2 484275970Scy 485275970ScyAuthentication is always enabled, 486275970Scyalthough ineffective if not configured as 487275970Scydescribed below. 488275970ScyIf a NTP packet arrives 489275970Scyincluding a message authentication 490275970Scycode (MAC), it is accepted only if it 491275970Scypasses all cryptographic checks. 492275970ScyThe 493275970Scychecks require correct key ID, key value 494275970Scyand message digest. 495275970ScyIf the packet has 496275970Scybeen modified in any way or replayed 497275970Scyby an intruder, it will fail one or more 498275970Scyof these checks and be discarded. 499275970ScyFurthermore, the Autokey scheme requires a 500275970Scypreliminary protocol exchange to obtain 501275970Scythe server certificate, verify its 502275970Scycredentials and initialize the protocol 503275970Scy.sp \n(Ppu 504275970Scy.ne 2 505275970Scy 506275970ScyThe 507275970Scy\f\*[B-Font]auth\f[] 508275970Scyflag controls whether new associations or 509275970Scyremote configuration commands require cryptographic authentication. 510275970ScyThis flag can be set or reset by the 511275970Scy\f\*[B-Font]enable\f[] 512275970Scyand 513275970Scy\f\*[B-Font]disable\f[] 514275970Scycommands and also by remote 515275970Scyconfiguration commands sent by a 516275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 517275970Scyprogram running in 518275970Scyanother machine. 519275970ScyIf this flag is enabled, which is the default 520275970Scycase, new broadcast client and symmetric passive associations and 521275970Scyremote configuration commands must be cryptographically 522275970Scyauthenticated using either symmetric key or public key cryptography. 523275970ScyIf this 524275970Scyflag is disabled, these operations are effective 525275970Scyeven if not cryptographic 526275970Scyauthenticated. 527275970ScyIt should be understood 528275970Scythat operating with the 529275970Scy\f\*[B-Font]auth\f[] 530275970Scyflag disabled invites a significant vulnerability 531275970Scywhere a rogue hacker can 532275970Scymasquerade as a falseticker and seriously 533275970Scydisrupt system timekeeping. 534275970ScyIt is 535275970Scyimportant to note that this flag has no purpose 536275970Scyother than to allow or disallow 537275970Scya new association in response to new broadcast 538275970Scyand symmetric active messages 539275970Scyand remote configuration commands and, in particular, 540275970Scythe flag has no effect on 541275970Scythe authentication process itself. 542275970Scy.sp \n(Ppu 543275970Scy.ne 2 544275970Scy 545275970ScyAn attractive alternative where multicast support is available 546275970Scyis manycast mode, in which clients periodically troll 547275970Scyfor servers as described in the 548275970Scy\fIAutomatic\f[] \fINTP\f[] \fIConfiguration\f[] \fIOptions\f[] 549275970Scypage. 550275970ScyEither symmetric key or public key 551275970Scycryptographic authentication can be used in this mode. 552275970ScyThe principle advantage 553275970Scyof manycast mode is that potential servers need not be 554275970Scyconfigured in advance, 555275970Scysince the client finds them during regular operation, 556275970Scyand the configuration 557275970Scyfiles for all clients can be identical. 558275970Scy.sp \n(Ppu 559275970Scy.ne 2 560275970Scy 561275970ScyThe security model and protocol schemes for 562275970Scyboth symmetric key and public key 563275970Scycryptography are summarized below; 564275970Scyfurther details are in the briefings, papers 565275970Scyand reports at the NTP project page linked from 566275970Scy\f[C]http://www.ntp.org/\f[]. 567275970Scy.SS Symmetric-Key Cryptography 568275970ScyThe original RFC-1305 specification allows any one of possibly 569275970Scy65,534 keys, each distinguished by a 32-bit key identifier, to 570275970Scyauthenticate an association. 571275970ScyThe servers and clients involved must 572275970Scyagree on the key and key identifier to 573275970Scyauthenticate NTP packets. 574275970ScyKeys and 575275970Scyrelated information are specified in a key 576275970Scyfile, usually called 577275970Scy\fIntp.keys\f[], 578275970Scywhich must be distributed and stored using 579275970Scysecure means beyond the scope of the NTP protocol itself. 580275970ScyBesides the keys used 581275970Scyfor ordinary NTP associations, 582275970Scyadditional keys can be used as passwords for the 583275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 584275970Scyand 585275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 586275970Scyutility programs. 587275970Scy.sp \n(Ppu 588275970Scy.ne 2 589275970Scy 590275970ScyWhen 591275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 592275970Scyis first started, it reads the key file specified in the 593275970Scy\f\*[B-Font]keys\f[] 594275970Scyconfiguration command and installs the keys 595275970Scyin the key cache. 596275970ScyHowever, 597275970Scyindividual keys must be activated with the 598275970Scy\f\*[B-Font]trusted\f[] 599275970Scycommand before use. 600275970ScyThis 601275970Scyallows, for instance, the installation of possibly 602275970Scyseveral batches of keys and 603275970Scythen activating or deactivating each batch 604275970Scyremotely using 605275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[]. 606275970ScyThis also provides a revocation capability that can be used 607275970Scyif a key becomes compromised. 608275970ScyThe 609275970Scy\f\*[B-Font]requestkey\f[] 610275970Scycommand selects the key used as the password for the 611275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 612275970Scyutility, while the 613275970Scy\f\*[B-Font]controlkey\f[] 614275970Scycommand selects the key used as the password for the 615275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 616275970Scyutility. 617275970Scy.SS Public Key Cryptography 618275970ScyNTPv4 supports the original NTPv3 symmetric key scheme 619275970Scydescribed in RFC-1305 and in addition the Autokey protocol, 620275970Scywhich is based on public key cryptography. 621275970ScyThe Autokey Version 2 protocol described on the Autokey Protocol 622275970Scypage verifies packet integrity using MD5 message digests 623275970Scyand verifies the source with digital signatures and any of several 624275970Scydigest/signature schemes. 625275970ScyOptional identity schemes described on the Identity Schemes 626275970Scypage and based on cryptographic challenge/response algorithms 627275970Scyare also available. 628275970ScyUsing all of these schemes provides strong security against 629275970Scyreplay with or without modification, spoofing, masquerade 630275970Scyand most forms of clogging attacks. 631275970Scy.\" .Pp 632275970Scy.\" The cryptographic means necessary for all Autokey operations 633275970Scy.\" is provided by the OpenSSL software library. 634275970Scy.\" This library is available from http://www.openssl.org/ 635275970Scy.\" and can be installed using the procedures outlined 636275970Scy.\" in the Building and Installing the Distribution page. 637275970Scy.\" Once installed, 638275970Scy.\" the configure and build 639275970Scy.\" process automatically detects the library and links 640275970Scy.\" the library routines required. 641275970Scy.sp \n(Ppu 642275970Scy.ne 2 643275970Scy 644275970ScyThe Autokey protocol has several modes of operation 645275970Scycorresponding to the various NTP modes supported. 646275970ScyMost modes use a special cookie which can be 647275970Scycomputed independently by the client and server, 648275970Scybut encrypted in transmission. 649275970ScyAll modes use in addition a variant of the S-KEY scheme, 650275970Scyin which a pseudo-random key list is generated and used 651275970Scyin reverse order. 652275970ScyThese schemes are described along with an executive summary, 653275970Scycurrent status, briefing slides and reading list on the 654275970Scy\fIAutonomous\f[] \fIAuthentication\f[] 655275970Scypage. 656275970Scy.sp \n(Ppu 657275970Scy.ne 2 658275970Scy 659275970ScyThe specific cryptographic environment used by Autokey servers 660275970Scyand clients is determined by a set of files 661275970Scyand soft links generated by the 662275970Scy\fCntp-keygen\fR(1ntpkeygenmdoc)\f[] 663275970Scyprogram. 664275970ScyThis includes a required host key file, 665275970Scyrequired certificate file and optional sign key file, 666275970Scyleapsecond file and identity scheme files. 667275970ScyThe 668275970Scydigest/signature scheme is specified in the X.509 certificate 669275970Scyalong with the matching sign key. 670275970ScyThere are several schemes 671275970Scyavailable in the OpenSSL software library, each identified 672275970Scyby a specific string such as 673275970Scy\f\*[B-Font]md5WithRSAEncryption\f[], 674275970Scywhich stands for the MD5 message digest with RSA 675275970Scyencryption scheme. 676275970ScyThe current NTP distribution supports 677275970Scyall the schemes in the OpenSSL library, including 678275970Scythose based on RSA and DSA digital signatures. 679275970Scy.sp \n(Ppu 680275970Scy.ne 2 681275970Scy 682275970ScyNTP secure groups can be used to define cryptographic compartments 683275970Scyand security hierarchies. 684275970ScyIt is important that every host 685275970Scyin the group be able to construct a certificate trail to one 686275970Scyor more trusted hosts in the same group. 687275970ScyEach group 688275970Scyhost runs the Autokey protocol to obtain the certificates 689275970Scyfor all hosts along the trail to one or more trusted hosts. 690275970ScyThis requires the configuration file in all hosts to be 691275970Scyengineered so that, even under anticipated failure conditions, 692275970Scythe NTP subnet will form such that every group host can find 693275970Scya trail to at least one trusted host. 694275970Scy.SS Naming and Addressing 695275970ScyIt is important to note that Autokey does not use DNS to 696275970Scyresolve addresses, since DNS can't be completely trusted 697275970Scyuntil the name servers have synchronized clocks. 698275970ScyThe cryptographic name used by Autokey to bind the host identity 699275970Scycredentials and cryptographic values must be independent 700275970Scyof interface, network and any other naming convention. 701275970ScyThe name appears in the host certificate in either or both 702275970Scythe subject and issuer fields, so protection against 703275970ScyDNS compromise is essential. 704275970Scy.sp \n(Ppu 705275970Scy.ne 2 706275970Scy 707275970ScyBy convention, the name of an Autokey host is the name returned 708275970Scyby the Unix 709275970Scy\fCgethostname\fR(2)\f[] 710275970Scysystem call or equivalent in other systems. 711275970ScyBy the system design 712275970Scymodel, there are no provisions to allow alternate names or aliases. 713275970ScyHowever, this is not to say that DNS aliases, different names 714275970Scyfor each interface, etc., are constrained in any way. 715275970Scy.sp \n(Ppu 716275970Scy.ne 2 717275970Scy 718275970ScyIt is also important to note that Autokey verifies authenticity 719275970Scyusing the host name, network address and public keys, 720275970Scyall of which are bound together by the protocol specifically 721275970Scyto deflect masquerade attacks. 722275970ScyFor this reason Autokey 723275970Scyincludes the source and destinatino IP addresses in message digest 724275970Scycomputations and so the same addresses must be available 725275970Scyat both the server and client. 726275970ScyFor this reason operation 727275970Scywith network address translation schemes is not possible. 728275970ScyThis reflects the intended robust security model where government 729275970Scyand corporate NTP servers are operated outside firewall perimeters. 730275970Scy.SS Operation 731275970ScyA specific combination of authentication scheme (none, 732275970Scysymmetric key, public key) and identity scheme is called 733275970Scya cryptotype, although not all combinations are compatible. 734275970ScyThere may be management configurations where the clients, 735275970Scyservers and peers may not all support the same cryptotypes. 736275970ScyA secure NTPv4 subnet can be configured in many ways while 737275970Scykeeping in mind the principles explained above and 738275970Scyin this section. 739275970ScyNote however that some cryptotype 740275970Scycombinations may successfully interoperate with each other, 741275970Scybut may not represent good security practice. 742275970Scy.sp \n(Ppu 743275970Scy.ne 2 744275970Scy 745275970ScyThe cryptotype of an association is determined at the time 746275970Scyof mobilization, either at configuration time or some time 747275970Scylater when a message of appropriate cryptotype arrives. 748275970ScyWhen mobilized by a 749275970Scy\f\*[B-Font]server\f[] 750275970Scyor 751275970Scy\f\*[B-Font]peer\f[] 752275970Scyconfiguration command and no 753275970Scy\f\*[B-Font]key\f[] 754275970Scyor 755275970Scy\f\*[B-Font]autokey\f[] 756275970Scysubcommands are present, the association is not 757275970Scyauthenticated; if the 758275970Scy\f\*[B-Font]key\f[] 759275970Scysubcommand is present, the association is authenticated 760275970Scyusing the symmetric key ID specified; if the 761275970Scy\f\*[B-Font]autokey\f[] 762275970Scysubcommand is present, the association is authenticated 763275970Scyusing Autokey. 764275970Scy.sp \n(Ppu 765275970Scy.ne 2 766275970Scy 767275970ScyWhen multiple identity schemes are supported in the Autokey 768275970Scyprotocol, the first message exchange determines which one is used. 769275970ScyThe client request message contains bits corresponding 770275970Scyto which schemes it has available. 771275970ScyThe server response message 772275970Scycontains bits corresponding to which schemes it has available. 773275970ScyBoth server and client match the received bits with their own 774275970Scyand select a common scheme. 775275970Scy.sp \n(Ppu 776275970Scy.ne 2 777275970Scy 778275970ScyFollowing the principle that time is a public value, 779275970Scya server responds to any client packet that matches 780275970Scyits cryptotype capabilities. 781275970ScyThus, a server receiving 782275970Scyan unauthenticated packet will respond with an unauthenticated 783275970Scypacket, while the same server receiving a packet of a cryptotype 784275970Scyit supports will respond with packets of that cryptotype. 785275970ScyHowever, unconfigured broadcast or manycast client 786275970Scyassociations or symmetric passive associations will not be 787275970Scymobilized unless the server supports a cryptotype compatible 788275970Scywith the first packet received. 789275970ScyBy default, unauthenticated associations will not be mobilized 790275970Scyunless overridden in a decidedly dangerous way. 791275970Scy.sp \n(Ppu 792275970Scy.ne 2 793275970Scy 794275970ScySome examples may help to reduce confusion. 795275970ScyClient Alice has no specific cryptotype selected. 796275970ScyServer Bob has both a symmetric key file and minimal Autokey files. 797275970ScyAlice's unauthenticated messages arrive at Bob, who replies with 798275970Scyunauthenticated messages. 799275970ScyCathy has a copy of Bob's symmetric 800275970Scykey file and has selected key ID 4 in messages to Bob. 801275970ScyBob verifies the message with his key ID 4. 802275970ScyIf it's the 803275970Scysame key and the message is verified, Bob sends Cathy a reply 804275970Scyauthenticated with that key. 805275970ScyIf verification fails, 806275970ScyBob sends Cathy a thing called a crypto-NAK, which tells her 807275970Scysomething broke. 808275970ScyShe can see the evidence using the 809275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 810275970Scyprogram. 811275970Scy.sp \n(Ppu 812275970Scy.ne 2 813275970Scy 814275970ScyDenise has rolled her own host key and certificate. 815275970ScyShe also uses one of the identity schemes as Bob. 816275970ScyShe sends the first Autokey message to Bob and they 817275970Scyboth dance the protocol authentication and identity steps. 818275970ScyIf all comes out okay, Denise and Bob continue as described above. 819275970Scy.sp \n(Ppu 820275970Scy.ne 2 821275970Scy 822275970ScyIt should be clear from the above that Bob can support 823275970Scyall the girls at the same time, as long as he has compatible 824275970Scyauthentication and identity credentials. 825275970ScyNow, Bob can act just like the girls in his own choice of servers; 826275970Scyhe can run multiple configured associations with multiple different 827275970Scyservers (or the same server, although that might not be useful). 828275970ScyBut, wise security policy might preclude some cryptotype 829275970Scycombinations; for instance, running an identity scheme 830275970Scywith one server and no authentication with another might not be wise. 831275970Scy.SS Key Management 832275970ScyThe cryptographic values used by the Autokey protocol are 833275970Scyincorporated as a set of files generated by the 834275970Scy\fCntp-keygen\fR(1ntpkeygenmdoc)\f[] 835275970Scyutility program, including symmetric key, host key and 836275970Scypublic certificate files, as well as sign key, identity parameters 837275970Scyand leapseconds files. 838275970ScyAlternatively, host and sign keys and 839275970Scycertificate files can be generated by the OpenSSL utilities 840275970Scyand certificates can be imported from public certificate 841275970Scyauthorities. 842275970ScyNote that symmetric keys are necessary for the 843275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 844275970Scyand 845275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 846275970Scyutility programs. 847275970ScyThe remaining files are necessary only for the 848275970ScyAutokey protocol. 849275970Scy.sp \n(Ppu 850275970Scy.ne 2 851275970Scy 852275970ScyCertificates imported from OpenSSL or public certificate 853275970Scyauthorities have certian limitations. 854275970ScyThe certificate should be in ASN.1 syntax, X.509 Version 3 855275970Scyformat and encoded in PEM, which is the same format 856275970Scyused by OpenSSL. 857275970ScyThe overall length of the certificate encoded 858275970Scyin ASN.1 must not exceed 1024 bytes. 859275970ScyThe subject distinguished 860275970Scyname field (CN) is the fully qualified name of the host 861275970Scyon which it is used; the remaining subject fields are ignored. 862275970ScyThe certificate extension fields must not contain either 863275970Scya subject key identifier or a issuer key identifier field; 864275970Scyhowever, an extended key usage field for a trusted host must 865275970Scycontain the value 866275970Scy\f\*[B-Font]trustRoot\f[];. 867275970ScyOther extension fields are ignored. 868275970Scy.SS Authentication Commands 869275970Scy.TP 7 870275970Scy.NOP \f\*[B-Font]autokey\f[] [\f\*[I-Font]logsec\f[]] 871275970ScySpecifies the interval between regenerations of the session key 872275970Scylist used with the Autokey protocol. 873275970ScyNote that the size of the key 874275970Scylist for each association depends on this interval and the current 875275970Scypoll interval. 876275970ScyThe default value is 12 (4096 s or about 1.1 hours). 877275970ScyFor poll intervals above the specified interval, a session key list 878275970Scywith a single entry will be regenerated for every message 879275970Scysent. 880275970Scy.TP 7 881275970Scy.NOP \f\*[B-Font]controlkey\f[] \f\*[I-Font]key\f[] 882275970ScySpecifies the key identifier to use with the 883275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 884275970Scyutility, which uses the standard 885275970Scyprotocol defined in RFC-1305. 886275970ScyThe 887275970Scy\f\*[I-Font]key\f[] 888275970Scyargument is 889275970Scythe key identifier for a trusted key, where the value can be in the 890275970Scyrange 1 to 65,534, inclusive. 891275970Scy.TP 7 892275970Scy.NOP \f\*[B-Font]crypto\f[] [\f\*[B-Font]cert\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]leap\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]randfile\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]host\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]sign\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]gq\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]gqpar\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]iffpar\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]mvpar\f[] \f\*[I-Font]file\f[]] [\f\*[B-Font]pw\f[] \f\*[I-Font]password\f[]] 893275970ScyThis command requires the OpenSSL library. 894275970ScyIt activates public key 895275970Scycryptography, selects the message digest and signature 896275970Scyencryption scheme and loads the required private and public 897275970Scyvalues described above. 898275970ScyIf one or more files are left unspecified, 899275970Scythe default names are used as described above. 900275970ScyUnless the complete path and name of the file are specified, the 901275970Scylocation of a file is relative to the keys directory specified 902275970Scyin the 903275970Scy\f\*[B-Font]keysdir\f[] 904275970Scycommand or default 905275970Scy\fI/usr/local/etc\f[]. 906275970ScyFollowing are the subcommands: 907275970Scy.RS 908275970Scy.TP 7 909275970Scy.NOP \f\*[B-Font]cert\f[] \f\*[I-Font]file\f[] 910275970ScySpecifies the location of the required host public certificate file. 911275970ScyThis overrides the link 912275970Scy\fIntpkey_cert_\f[]\f\*[I-Font]hostname\f[] 913275970Scyin the keys directory. 914275970Scy.TP 7 915275970Scy.NOP \f\*[B-Font]gqpar\f[] \f\*[I-Font]file\f[] 916275970ScySpecifies the location of the optional GQ parameters file. 917275970ScyThis 918275970Scyoverrides the link 919275970Scy\fIntpkey_gq_\f[]\f\*[I-Font]hostname\f[] 920275970Scyin the keys directory. 921275970Scy.TP 7 922275970Scy.NOP \f\*[B-Font]host\f[] \f\*[I-Font]file\f[] 923275970ScySpecifies the location of the required host key file. 924275970ScyThis overrides 925275970Scythe link 926275970Scy\fIntpkey_key_\f[]\f\*[I-Font]hostname\f[] 927275970Scyin the keys directory. 928275970Scy.TP 7 929275970Scy.NOP \f\*[B-Font]iffpar\f[] \f\*[I-Font]file\f[] 930275970ScySpecifies the location of the optional IFF parameters file.This 931275970Scyoverrides the link 932275970Scy\fIntpkey_iff_\f[]\f\*[I-Font]hostname\f[] 933275970Scyin the keys directory. 934275970Scy.TP 7 935275970Scy.NOP \f\*[B-Font]leap\f[] \f\*[I-Font]file\f[] 936275970ScySpecifies the location of the optional leapsecond file. 937275970ScyThis overrides the link 938275970Scy\fIntpkey_leap\f[] 939275970Scyin the keys directory. 940275970Scy.TP 7 941275970Scy.NOP \f\*[B-Font]mvpar\f[] \f\*[I-Font]file\f[] 942275970ScySpecifies the location of the optional MV parameters file. 943275970ScyThis 944275970Scyoverrides the link 945275970Scy\fIntpkey_mv_\f[]\f\*[I-Font]hostname\f[] 946275970Scyin the keys directory. 947275970Scy.TP 7 948275970Scy.NOP \f\*[B-Font]pw\f[] \f\*[I-Font]password\f[] 949275970ScySpecifies the password to decrypt files containing private keys and 950275970Scyidentity parameters. 951275970ScyThis is required only if these files have been 952275970Scyencrypted. 953275970Scy.TP 7 954275970Scy.NOP \f\*[B-Font]randfile\f[] \f\*[I-Font]file\f[] 955275970ScySpecifies the location of the random seed file used by the OpenSSL 956275970Scylibrary. 957275970ScyThe defaults are described in the main text above. 958275970Scy.TP 7 959275970Scy.NOP \f\*[B-Font]sign\f[] \f\*[I-Font]file\f[] 960275970ScySpecifies the location of the optional sign key file. 961275970ScyThis overrides 962275970Scythe link 963275970Scy\fIntpkey_sign_\f[]\f\*[I-Font]hostname\f[] 964275970Scyin the keys directory. 965275970ScyIf this file is 966275970Scynot found, the host key is also the sign key. 967275970Scy.RE 968275970Scy.TP 7 969275970Scy.NOP \f\*[B-Font]keys\f[] \f\*[I-Font]keyfile\f[] 970275970ScySpecifies the complete path and location of the MD5 key file 971275970Scycontaining the keys and key identifiers used by 972275970Scy\fCntpd\fR(@NTPD_MS@)\f[], 973275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 974275970Scyand 975275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 976275970Scywhen operating with symmetric key cryptography. 977275970ScyThis is the same operation as the 978275970Scy\f\*[B-Font]\-k\f[] 979275970Scycommand line option. 980275970Scy.TP 7 981275970Scy.NOP \f\*[B-Font]keysdir\f[] \f\*[I-Font]path\f[] 982275970ScyThis command specifies the default directory path for 983275970Scycryptographic keys, parameters and certificates. 984275970ScyThe default is 985275970Scy\fI/usr/local/etc/\f[]. 986275970Scy.TP 7 987275970Scy.NOP \f\*[B-Font]requestkey\f[] \f\*[I-Font]key\f[] 988275970ScySpecifies the key identifier to use with the 989275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 990275970Scyutility program, which uses a 991275970Scyproprietary protocol specific to this implementation of 992275970Scy\fCntpd\fR(@NTPD_MS@)\f[]. 993275970ScyThe 994275970Scy\f\*[I-Font]key\f[] 995275970Scyargument is a key identifier 996275970Scyfor the trusted key, where the value can be in the range 1 to 997275970Scy65,534, inclusive. 998275970Scy.TP 7 999275970Scy.NOP \f\*[B-Font]revoke\f[] \f\*[I-Font]logsec\f[] 1000275970ScySpecifies the interval between re-randomization of certain 1001275970Scycryptographic values used by the Autokey scheme, as a power of 2 in 1002275970Scyseconds. 1003275970ScyThese values need to be updated frequently in order to 1004275970Scydeflect brute-force attacks on the algorithms of the scheme; 1005275970Scyhowever, updating some values is a relatively expensive operation. 1006275970ScyThe default interval is 16 (65,536 s or about 18 hours). 1007275970ScyFor poll 1008275970Scyintervals above the specified interval, the values will be updated 1009275970Scyfor every message sent. 1010275970Scy.TP 7 1011275970Scy.NOP \f\*[B-Font]trustedkey\f[] \f\*[I-Font]key\f[] \f\*[I-Font]...\f[] 1012275970ScySpecifies the key identifiers which are trusted for the 1013275970Scypurposes of authenticating peers with symmetric key cryptography, 1014275970Scyas well as keys used by the 1015275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 1016275970Scyand 1017275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 1018275970Scyprograms. 1019275970ScyThe authentication procedures require that both the local 1020275970Scyand remote servers share the same key and key identifier for this 1021275970Scypurpose, although different keys can be used with different 1022275970Scyservers. 1023275970ScyThe 1024275970Scy\f\*[I-Font]key\f[] 1025275970Scyarguments are 32-bit unsigned 1026275970Scyintegers with values from 1 to 65,534. 1027275970Scy.PP 1028275970Scy.SS Error Codes 1029275970ScyThe following error codes are reported via the NTP control 1030275970Scyand monitoring protocol trap mechanism. 1031275970Scy.TP 7 1032275970Scy.NOP 101 1033275970Scy(bad field format or length) 1034275970ScyThe packet has invalid version, length or format. 1035275970Scy.TP 7 1036275970Scy.NOP 102 1037275970Scy(bad timestamp) 1038275970ScyThe packet timestamp is the same or older than the most recent received. 1039275970ScyThis could be due to a replay or a server clock time step. 1040275970Scy.TP 7 1041275970Scy.NOP 103 1042275970Scy(bad filestamp) 1043275970ScyThe packet filestamp is the same or older than the most recent received. 1044275970ScyThis could be due to a replay or a key file generation error. 1045275970Scy.TP 7 1046275970Scy.NOP 104 1047275970Scy(bad or missing public key) 1048275970ScyThe public key is missing, has incorrect format or is an unsupported type. 1049275970Scy.TP 7 1050275970Scy.NOP 105 1051275970Scy(unsupported digest type) 1052275970ScyThe server requires an unsupported digest/signature scheme. 1053275970Scy.TP 7 1054275970Scy.NOP 106 1055275970Scy(mismatched digest types) 1056275970ScyNot used. 1057275970Scy.TP 7 1058275970Scy.NOP 107 1059275970Scy(bad signature length) 1060275970ScyThe signature length does not match the current public key. 1061275970Scy.TP 7 1062275970Scy.NOP 108 1063275970Scy(signature not verified) 1064275970ScyThe message fails the signature check. 1065275970ScyIt could be bogus or signed by a 1066275970Scydifferent private key. 1067275970Scy.TP 7 1068275970Scy.NOP 109 1069275970Scy(certificate not verified) 1070275970ScyThe certificate is invalid or signed with the wrong key. 1071275970Scy.TP 7 1072275970Scy.NOP 110 1073275970Scy(certificate not verified) 1074275970ScyThe certificate is not yet valid or has expired or the signature could not 1075275970Scybe verified. 1076275970Scy.TP 7 1077275970Scy.NOP 111 1078275970Scy(bad or missing cookie) 1079275970ScyThe cookie is missing, corrupted or bogus. 1080275970Scy.TP 7 1081275970Scy.NOP 112 1082275970Scy(bad or missing leapseconds table) 1083275970ScyThe leapseconds table is missing, corrupted or bogus. 1084275970Scy.TP 7 1085275970Scy.NOP 113 1086275970Scy(bad or missing certificate) 1087275970ScyThe certificate is missing, corrupted or bogus. 1088275970Scy.TP 7 1089275970Scy.NOP 114 1090275970Scy(bad or missing identity) 1091275970ScyThe identity key is missing, corrupt or bogus. 1092275970Scy.PP 1093275970Scy.SH Monitoring Support 1094275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 1095275970Scyincludes a comprehensive monitoring facility suitable 1096275970Scyfor continuous, long term recording of server and client 1097275970Scytimekeeping performance. 1098275970ScySee the 1099275970Scy\f\*[B-Font]statistics\f[] 1100275970Scycommand below 1101275970Scyfor a listing and example of each type of statistics currently 1102275970Scysupported. 1103275970ScyStatistic files are managed using file generation sets 1104275970Scyand scripts in the 1105275970Scy\fI./scripts\f[] 1106275970Scydirectory of this distribution. 1107275970ScyUsing 1108275970Scythese facilities and 1109275970ScyUNIX 1110275970Scy\fCcron\fR(8)\f[] 1111275970Scyjobs, the data can be 1112275970Scyautomatically summarized and archived for retrospective analysis. 1113275970Scy.SS Monitoring Commands 1114275970Scy.TP 7 1115275970Scy.NOP \f\*[B-Font]statistics\f[] \f\*[I-Font]name\f[] \f\*[I-Font]...\f[] 1116275970ScyEnables writing of statistics records. 1117275970ScyCurrently, eight kinds of 1118275970Scy\f\*[I-Font]name\f[] 1119275970Scystatistics are supported. 1120275970Scy.RS 1121275970Scy.TP 7 1122275970Scy.NOP \f\*[B-Font]clockstats\f[] 1123275970ScyEnables recording of clock driver statistics information. 1124275970ScyEach update 1125275970Scyreceived from a clock driver appends a line of the following form to 1126275970Scythe file generation set named 1127275970Scy\f\*[B-Font]clockstats\f[]: 1128275970Scy.br 1129275970Scy.in +4 1130275970Scy.nf 1131275970Scy49213 525.624 127.127.4.1 93 226 00:08:29.606 D 1132275970Scy.in -4 1133275970Scy.fi 1134275970Scy.sp \n(Ppu 1135275970Scy.ne 2 1136275970Scy 1137275970ScyThe first two fields show the date (Modified Julian Day) and time 1138275970Scy(seconds and fraction past UTC midnight). 1139275970ScyThe next field shows the 1140275970Scyclock address in dotted-quad notation. 1141275970ScyThe final field shows the last 1142275970Scytimecode received from the clock in decoded ASCII format, where 1143275970Scymeaningful. 1144275970ScyIn some clock drivers a good deal of additional information 1145275970Scycan be gathered and displayed as well. 1146275970ScySee information specific to each 1147275970Scyclock for further details. 1148275970Scy.TP 7 1149275970Scy.NOP \f\*[B-Font]cryptostats\f[] 1150275970ScyThis option requires the OpenSSL cryptographic software library. 1151275970ScyIt 1152275970Scyenables recording of cryptographic public key protocol information. 1153275970ScyEach message received by the protocol module appends a line of the 1154275970Scyfollowing form to the file generation set named 1155275970Scy\f\*[B-Font]cryptostats\f[]: 1156275970Scy.br 1157275970Scy.in +4 1158275970Scy.nf 1159275970Scy49213 525.624 127.127.4.1 message 1160275970Scy.in -4 1161275970Scy.fi 1162275970Scy.sp \n(Ppu 1163275970Scy.ne 2 1164275970Scy 1165275970ScyThe first two fields show the date (Modified Julian Day) and time 1166275970Scy(seconds and fraction past UTC midnight). 1167275970ScyThe next field shows the peer 1168275970Scyaddress in dotted-quad notation, The final message field includes the 1169275970Scymessage type and certain ancillary information. 1170275970ScySee the 1171275970Scy\fIAuthentication\f[] \fIOptions\f[] 1172275970Scysection for further information. 1173275970Scy.TP 7 1174275970Scy.NOP \f\*[B-Font]loopstats\f[] 1175275970ScyEnables recording of loop filter statistics information. 1176275970ScyEach 1177275970Scyupdate of the local clock outputs a line of the following form to 1178275970Scythe file generation set named 1179275970Scy\f\*[B-Font]loopstats\f[]: 1180275970Scy.br 1181275970Scy.in +4 1182275970Scy.nf 1183275970Scy50935 75440.031 0.000006019 13.778190 0.000351733 0.0133806 1184275970Scy.in -4 1185275970Scy.fi 1186275970Scy.sp \n(Ppu 1187275970Scy.ne 2 1188275970Scy 1189275970ScyThe first two fields show the date (Modified Julian Day) and 1190275970Scytime (seconds and fraction past UTC midnight). 1191275970ScyThe next five fields 1192275970Scyshow time offset (seconds), frequency offset (parts per million \- 1193275970ScyPPM), RMS jitter (seconds), Allan deviation (PPM) and clock 1194275970Scydiscipline time constant. 1195275970Scy.TP 7 1196275970Scy.NOP \f\*[B-Font]peerstats\f[] 1197275970ScyEnables recording of peer statistics information. 1198275970ScyThis includes 1199275970Scystatistics records of all peers of a NTP server and of special 1200275970Scysignals, where present and configured. 1201275970ScyEach valid update appends a 1202275970Scyline of the following form to the current element of a file 1203275970Scygeneration set named 1204275970Scy\f\*[B-Font]peerstats\f[]: 1205275970Scy.br 1206275970Scy.in +4 1207275970Scy.nf 1208275970Scy48773 10847.650 127.127.4.1 9714 \-0.001605376 0.000000000 0.001424877 0.000958674 1209275970Scy.in -4 1210275970Scy.fi 1211275970Scy.sp \n(Ppu 1212275970Scy.ne 2 1213275970Scy 1214275970ScyThe first two fields show the date (Modified Julian Day) and 1215275970Scytime (seconds and fraction past UTC midnight). 1216275970ScyThe next two fields 1217275970Scyshow the peer address in dotted-quad notation and status, 1218275970Scyrespectively. 1219275970ScyThe status field is encoded in hex in the format 1220275970Scydescribed in Appendix A of the NTP specification RFC 1305. 1221275970ScyThe final four fields show the offset, 1222275970Scydelay, dispersion and RMS jitter, all in seconds. 1223275970Scy.TP 7 1224275970Scy.NOP \f\*[B-Font]rawstats\f[] 1225275970ScyEnables recording of raw-timestamp statistics information. 1226275970ScyThis 1227275970Scyincludes statistics records of all peers of a NTP server and of 1228275970Scyspecial signals, where present and configured. 1229275970ScyEach NTP message 1230275970Scyreceived from a peer or clock driver appends a line of the 1231275970Scyfollowing form to the file generation set named 1232275970Scy\f\*[B-Font]rawstats\f[]: 1233275970Scy.br 1234275970Scy.in +4 1235275970Scy.nf 1236275970Scy50928 2132.543 128.4.1.1 128.4.1.20 3102453281.584327000 3102453281.58622800031 02453332.540806000 3102453332.541458000 1237275970Scy.in -4 1238275970Scy.fi 1239275970Scy.sp \n(Ppu 1240275970Scy.ne 2 1241275970Scy 1242275970ScyThe first two fields show the date (Modified Julian Day) and 1243275970Scytime (seconds and fraction past UTC midnight). 1244275970ScyThe next two fields 1245275970Scyshow the remote peer or clock address followed by the local address 1246275970Scyin dotted-quad notation. 1247275970ScyThe final four fields show the originate, 1248275970Scyreceive, transmit and final NTP timestamps in order. 1249275970ScyThe timestamp 1250275970Scyvalues are as received and before processing by the various data 1251275970Scysmoothing and mitigation algorithms. 1252275970Scy.TP 7 1253275970Scy.NOP \f\*[B-Font]sysstats\f[] 1254275970ScyEnables recording of ntpd statistics counters on a periodic basis. 1255275970ScyEach 1256275970Scyhour a line of the following form is appended to the file generation 1257275970Scyset named 1258275970Scy\f\*[B-Font]sysstats\f[]: 1259275970Scy.br 1260275970Scy.in +4 1261275970Scy.nf 1262275970Scy50928 2132.543 36000 81965 0 9546 56 71793 512 540 10 147 1263275970Scy.in -4 1264275970Scy.fi 1265275970Scy.sp \n(Ppu 1266275970Scy.ne 2 1267275970Scy 1268275970ScyThe first two fields show the date (Modified Julian Day) and time 1269275970Scy(seconds and fraction past UTC midnight). 1270275970ScyThe remaining ten fields show 1271275970Scythe statistics counter values accumulated since the last generated 1272275970Scyline. 1273275970Scy.RS 1274275970Scy.TP 7 1275275970Scy.NOP Time since restart \f\*[B-Font]36000\f[] 1276275970ScyTime in hours since the system was last rebooted. 1277275970Scy.TP 7 1278275970Scy.NOP Packets received \f\*[B-Font]81965\f[] 1279275970ScyTotal number of packets received. 1280275970Scy.TP 7 1281275970Scy.NOP Packets processed \f\*[B-Font]0\f[] 1282275970ScyNumber of packets received in response to previous packets sent 1283275970Scy.TP 7 1284275970Scy.NOP Current version \f\*[B-Font]9546\f[] 1285275970ScyNumber of packets matching the current NTP version. 1286275970Scy.TP 7 1287275970Scy.NOP Previous version \f\*[B-Font]56\f[] 1288275970ScyNumber of packets matching the previous NTP version. 1289275970Scy.TP 7 1290275970Scy.NOP Bad version \f\*[B-Font]71793\f[] 1291275970ScyNumber of packets matching neither NTP version. 1292275970Scy.TP 7 1293275970Scy.NOP Access denied \f\*[B-Font]512\f[] 1294275970ScyNumber of packets denied access for any reason. 1295275970Scy.TP 7 1296275970Scy.NOP Bad length or format \f\*[B-Font]540\f[] 1297275970ScyNumber of packets with invalid length, format or port number. 1298275970Scy.TP 7 1299275970Scy.NOP Bad authentication \f\*[B-Font]10\f[] 1300275970ScyNumber of packets not verified as authentic. 1301275970Scy.TP 7 1302275970Scy.NOP Rate exceeded \f\*[B-Font]147\f[] 1303275970ScyNumber of packets discarded due to rate limitation. 1304275970Scy.RE 1305275970Scy.TP 7 1306275970Scy.NOP \f\*[B-Font]statsdir\f[] \f\*[I-Font]directory_path\f[] 1307275970ScyIndicates the full path of a directory where statistics files 1308275970Scyshould be created (see below). 1309275970ScyThis keyword allows 1310275970Scythe (otherwise constant) 1311275970Scy\f\*[B-Font]filegen\f[] 1312275970Scyfilename prefix to be modified for file generation sets, which 1313275970Scyis useful for handling statistics logs. 1314275970Scy.TP 7 1315275970Scy.NOP \f\*[B-Font]filegen\f[] \f\*[I-Font]name\f[] [\f\*[B-Font]file\f[] \f\*[I-Font]filename\f[]] [\f\*[B-Font]type\f[] \f\*[I-Font]typename\f[]] [\f\*[B-Font]link\f[] | \f\*[B-Font]nolink\f[]] [\f\*[B-Font]enable\f[] | \f\*[B-Font]disable\f[]] 1316275970ScyConfigures setting of generation file set name. 1317275970ScyGeneration 1318275970Scyfile sets provide a means for handling files that are 1319275970Scycontinuously growing during the lifetime of a server. 1320275970ScyServer statistics are a typical example for such files. 1321275970ScyGeneration file sets provide access to a set of files used 1322275970Scyto store the actual data. 1323275970ScyAt any time at most one element 1324275970Scyof the set is being written to. 1325275970ScyThe type given specifies 1326275970Scywhen and how data will be directed to a new element of the set. 1327275970ScyThis way, information stored in elements of a file set 1328275970Scythat are currently unused are available for administrational 1329275970Scyoperations without the risk of disturbing the operation of ntpd. 1330275970Scy(Most important: they can be removed to free space for new data 1331275970Scyproduced.) 1332275970Scy.sp \n(Ppu 1333275970Scy.ne 2 1334275970Scy 1335275970ScyNote that this command can be sent from the 1336275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 1337275970Scyprogram running at a remote location. 1338275970Scy.RS 1339275970Scy.TP 7 1340275970Scy.NOP \f\*[B-Font]name\f[] 1341275970ScyThis is the type of the statistics records, as shown in the 1342275970Scy\f\*[B-Font]statistics\f[] 1343275970Scycommand. 1344275970Scy.TP 7 1345275970Scy.NOP \f\*[B-Font]file\f[] \f\*[I-Font]filename\f[] 1346275970ScyThis is the file name for the statistics records. 1347275970ScyFilenames of set 1348275970Scymembers are built from three concatenated elements 1349275970Scy\f\*[B-Font]prefix\f[], 1350275970Scy\f\*[B-Font]filename\f[] 1351275970Scyand 1352275970Scy\f\*[B-Font]suffix\f[]: 1353275970Scy.RS 1354275970Scy.TP 7 1355275970Scy.NOP \f\*[B-Font]prefix\f[] 1356275970ScyThis is a constant filename path. 1357275970ScyIt is not subject to 1358275970Scymodifications via the 1359275970Scy\f\*[I-Font]filegen\f[] 1360275970Scyoption. 1361275970ScyIt is defined by the 1362275970Scyserver, usually specified as a compile-time constant. 1363275970ScyIt may, 1364275970Scyhowever, be configurable for individual file generation sets 1365275970Scyvia other commands. 1366275970ScyFor example, the prefix used with 1367275970Scy\f\*[I-Font]loopstats\f[] 1368275970Scyand 1369275970Scy\f\*[I-Font]peerstats\f[] 1370275970Scygeneration can be configured using the 1371275970Scy\f\*[I-Font]statsdir\f[] 1372275970Scyoption explained above. 1373275970Scy.TP 7 1374275970Scy.NOP \f\*[B-Font]filename\f[] 1375275970ScyThis string is directly concatenated to the prefix mentioned 1376275970Scyabove (no intervening 1377275970Scy\[oq]/\[cq]). 1378275970ScyThis can be modified using 1379275970Scythe file argument to the 1380275970Scy\f\*[I-Font]filegen\f[] 1381275970Scystatement. 1382275970ScyNo 1383275970Scy\fI..\f[] 1384275970Scyelements are 1385275970Scyallowed in this component to prevent filenames referring to 1386275970Scyparts outside the filesystem hierarchy denoted by 1387275970Scy\f\*[I-Font]prefix\f[]. 1388275970Scy.TP 7 1389275970Scy.NOP \f\*[B-Font]suffix\f[] 1390275970ScyThis part is reflects individual elements of a file set. 1391275970ScyIt is 1392275970Scygenerated according to the type of a file set. 1393275970Scy.RE 1394275970Scy.TP 7 1395275970Scy.NOP \f\*[B-Font]type\f[] \f\*[I-Font]typename\f[] 1396275970ScyA file generation set is characterized by its type. 1397275970ScyThe following 1398275970Scytypes are supported: 1399275970Scy.RS 1400275970Scy.TP 7 1401275970Scy.NOP \f\*[B-Font]none\f[] 1402275970ScyThe file set is actually a single plain file. 1403275970Scy.TP 7 1404275970Scy.NOP \f\*[B-Font]pid\f[] 1405275970ScyOne element of file set is used per incarnation of a ntpd 1406275970Scyserver. 1407275970ScyThis type does not perform any changes to file set 1408275970Scymembers during runtime, however it provides an easy way of 1409275970Scyseparating files belonging to different 1410275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 1411275970Scyserver incarnations. 1412275970ScyThe set member filename is built by appending a 1413275970Scy\[oq]\&.\[cq] 1414275970Scyto concatenated 1415275970Scy\f\*[I-Font]prefix\f[] 1416275970Scyand 1417275970Scy\f\*[I-Font]filename\f[] 1418275970Scystrings, and 1419275970Scyappending the decimal representation of the process ID of the 1420275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 1421275970Scyserver process. 1422275970Scy.TP 7 1423275970Scy.NOP \f\*[B-Font]day\f[] 1424275970ScyOne file generation set element is created per day. 1425275970ScyA day is 1426275970Scydefined as the period between 00:00 and 24:00 UTC. 1427275970ScyThe file set 1428275970Scymember suffix consists of a 1429275970Scy\[oq]\&.\[cq] 1430275970Scyand a day specification in 1431275970Scythe form 1432275970Scy\f\*[B-Font]YYYYMMdd\f[]. 1433275970Scy\f\*[B-Font]YYYY\f[] 1434275970Scyis a 4-digit year number (e.g., 1992). 1435275970Scy\f\*[B-Font]MM\f[] 1436275970Scyis a two digit month number. 1437275970Scy\f\*[B-Font]dd\f[] 1438275970Scyis a two digit day number. 1439275970ScyThus, all information written at 10 December 1992 would end up 1440275970Scyin a file named 1441275970Scy\f\*[I-Font]prefix\f[] 1442275970Scy\f\*[I-Font]filename\f[].19921210. 1443275970Scy.TP 7 1444275970Scy.NOP \f\*[B-Font]week\f[] 1445275970ScyAny file set member contains data related to a certain week of 1446275970Scya year. 1447275970ScyThe term week is defined by computing day-of-year 1448275970Scymodulo 7. 1449275970ScyElements of such a file generation set are 1450275970Scydistinguished by appending the following suffix to the file set 1451275970Scyfilename base: A dot, a 4-digit year number, the letter 1452275970Scy\f\*[B-Font]W\f[], 1453275970Scyand a 2-digit week number. 1454275970ScyFor example, information from January, 1455275970Scy10th 1992 would end up in a file with suffix 1456275970Scy.NOP. \f\*[I-Font]1992W1\f[]. 1457275970Scy.TP 7 1458275970Scy.NOP \f\*[B-Font]month\f[] 1459275970ScyOne generation file set element is generated per month. 1460275970ScyThe 1461275970Scyfile name suffix consists of a dot, a 4-digit year number, and 1462275970Scya 2-digit month. 1463275970Scy.TP 7 1464275970Scy.NOP \f\*[B-Font]year\f[] 1465275970ScyOne generation file element is generated per year. 1466275970ScyThe filename 1467275970Scysuffix consists of a dot and a 4 digit year number. 1468275970Scy.TP 7 1469275970Scy.NOP \f\*[B-Font]age\f[] 1470275970ScyThis type of file generation sets changes to a new element of 1471275970Scythe file set every 24 hours of server operation. 1472275970ScyThe filename 1473275970Scysuffix consists of a dot, the letter 1474275970Scy\f\*[B-Font]a\f[], 1475275970Scyand an 8-digit number. 1476275970ScyThis number is taken to be the number of seconds the server is 1477275970Scyrunning at the start of the corresponding 24-hour period. 1478275970ScyInformation is only written to a file generation by specifying 1479275970Scy\f\*[B-Font]enable\f[]; 1480275970Scyoutput is prevented by specifying 1481275970Scy\f\*[B-Font]disable\f[]. 1482275970Scy.RE 1483275970Scy.TP 7 1484275970Scy.NOP \f\*[B-Font]link\f[] | \f\*[B-Font]nolink\f[] 1485275970ScyIt is convenient to be able to access the current element of a file 1486275970Scygeneration set by a fixed name. 1487275970ScyThis feature is enabled by 1488275970Scyspecifying 1489275970Scy\f\*[B-Font]link\f[] 1490275970Scyand disabled using 1491275970Scy\f\*[B-Font]nolink\f[]. 1492275970ScyIf link is specified, a 1493275970Scyhard link from the current file set element to a file without 1494275970Scysuffix is created. 1495275970ScyWhen there is already a file with this name and 1496275970Scythe number of links of this file is one, it is renamed appending a 1497275970Scydot, the letter 1498275970Scy\f\*[B-Font]C\f[], 1499275970Scyand the pid of the ntpd server process. 1500275970ScyWhen the 1501275970Scynumber of links is greater than one, the file is unlinked. 1502275970ScyThis 1503275970Scyallows the current file to be accessed by a constant name. 1504275970Scy.TP 7 1505275970Scy.NOP \f\*[B-Font]enable\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]disable\f[] 1506275970ScyEnables or disables the recording function. 1507275970Scy.RE 1508275970Scy.RE 1509275970Scy.PP 1510275970Scy.SH Access Control Support 1511275970ScyThe 1512275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 1513275970Scydaemon implements a general purpose address/mask based restriction 1514275970Scylist. 1515275970ScyThe list contains address/match entries sorted first 1516275970Scyby increasing address values and and then by increasing mask values. 1517275970ScyA match occurs when the bitwise AND of the mask and the packet 1518275970Scysource address is equal to the bitwise AND of the mask and 1519275970Scyaddress in the list. 1520275970ScyThe list is searched in order with the 1521275970Scylast match found defining the restriction flags associated 1522275970Scywith the entry. 1523275970ScyAdditional information and examples can be found in the 1524275970Scy"Notes on Configuring NTP and Setting up a NTP Subnet" 1525275970Scypage 1526275970Scy(available as part of the HTML documentation 1527275970Scyprovided in 1528275970Scy\fI/usr/share/doc/ntp\f[]). 1529275970Scy.sp \n(Ppu 1530275970Scy.ne 2 1531275970Scy 1532275970ScyThe restriction facility was implemented in conformance 1533275970Scywith the access policies for the original NSFnet backbone 1534275970Scytime servers. 1535275970ScyLater the facility was expanded to deflect 1536275970Scycryptographic and clogging attacks. 1537275970ScyWhile this facility may 1538275970Scybe useful for keeping unwanted or broken or malicious clients 1539275970Scyfrom congesting innocent servers, it should not be considered 1540275970Scyan alternative to the NTP authentication facilities. 1541275970ScySource address based restrictions are easily circumvented 1542275970Scyby a determined cracker. 1543275970Scy.sp \n(Ppu 1544275970Scy.ne 2 1545275970Scy 1546275970ScyClients can be denied service because they are explicitly 1547275970Scyincluded in the restrict list created by the restrict command 1548275970Scyor implicitly as the result of cryptographic or rate limit 1549275970Scyviolations. 1550275970ScyCryptographic violations include certificate 1551275970Scyor identity verification failure; rate limit violations generally 1552275970Scyresult from defective NTP implementations that send packets 1553275970Scyat abusive rates. 1554275970ScySome violations cause denied service 1555275970Scyonly for the offending packet, others cause denied service 1556275970Scyfor a timed period and others cause the denied service for 1557275970Scyan indefinate period. 1558275970ScyWhen a client or network is denied access 1559275970Scyfor an indefinate period, the only way at present to remove 1560275970Scythe restrictions is by restarting the server. 1561275970Scy.SS The Kiss-of-Death Packet 1562275970ScyOrdinarily, packets denied service are simply dropped with no 1563275970Scyfurther action except incrementing statistics counters. 1564275970ScySometimes a 1565275970Scymore proactive response is needed, such as a server message that 1566275970Scyexplicitly requests the client to stop sending and leave a message 1567275970Scyfor the system operator. 1568275970ScyA special packet format has been created 1569275970Scyfor this purpose called the "kiss-of-death" (KoD) packet. 1570275970ScyKoD packets have the leap bits set unsynchronized and stratum set 1571275970Scyto zero and the reference identifier field set to a four-byte 1572275970ScyASCII code. 1573275970ScyIf the 1574275970Scy\f\*[B-Font]noserve\f[] 1575275970Scyor 1576275970Scy\f\*[B-Font]notrust\f[] 1577275970Scyflag of the matching restrict list entry is set, 1578275970Scythe code is "DENY"; if the 1579275970Scy\f\*[B-Font]limited\f[] 1580275970Scyflag is set and the rate limit 1581275970Scyis exceeded, the code is "RATE". 1582275970ScyFinally, if a cryptographic violation occurs, the code is "CRYP". 1583275970Scy.sp \n(Ppu 1584275970Scy.ne 2 1585275970Scy 1586275970ScyA client receiving a KoD performs a set of sanity checks to 1587275970Scyminimize security exposure, then updates the stratum and 1588275970Scyreference identifier peer variables, sets the access 1589275970Scydenied (TEST4) bit in the peer flash variable and sends 1590275970Scya message to the log. 1591275970ScyAs long as the TEST4 bit is set, 1592275970Scythe client will send no further packets to the server. 1593275970ScyThe only way at present to recover from this condition is 1594275970Scyto restart the protocol at both the client and server. 1595275970ScyThis 1596275970Scyhappens automatically at the client when the association times out. 1597275970ScyIt will happen at the server only if the server operator cooperates. 1598275970Scy.SS Access Control Commands 1599275970Scy.TP 7 1600275970Scy.NOP \f\*[B-Font]discard\f[] [\f\*[B-Font]average\f[] \f\*[I-Font]avg\f[]] [\f\*[B-Font]minimum\f[] \f\*[I-Font]min\f[]] [\f\*[B-Font]monitor\f[] \f\*[I-Font]prob\f[]] 1601275970ScySet the parameters of the 1602275970Scy\f\*[B-Font]limited\f[] 1603275970Scyfacility which protects the server from 1604275970Scyclient abuse. 1605275970ScyThe 1606275970Scy\f\*[B-Font]average\f[] 1607275970Scysubcommand specifies the minimum average packet 1608275970Scyspacing, while the 1609275970Scy\f\*[B-Font]minimum\f[] 1610275970Scysubcommand specifies the minimum packet spacing. 1611275970ScyPackets that violate these minima are discarded 1612275970Scyand a kiss-o'-death packet returned if enabled. 1613275970ScyThe default 1614275970Scyminimum average and minimum are 5 and 2, respectively. 1615275970ScyThe monitor subcommand specifies the probability of discard 1616275970Scyfor packets that overflow the rate-control window. 1617275970Scy.TP 7 1618275970Scy.NOP \f\*[B-Font]restrict\f[] \f\*[B-Font]address\f[] [\f\*[B-Font]mask\f[] \f\*[I-Font]mask\f[]] [\f\*[I-Font]flag\f[] \f\*[I-Font]...\f[]] 1619275970ScyThe 1620275970Scy\f\*[I-Font]address\f[] 1621275970Scyargument expressed in 1622275970Scydotted-quad form is the address of a host or network. 1623275970ScyAlternatively, the 1624275970Scy\f\*[I-Font]address\f[] 1625275970Scyargument can be a valid host DNS name. 1626275970ScyThe 1627275970Scy\f\*[I-Font]mask\f[] 1628275970Scyargument expressed in dotted-quad form defaults to 1629275970Scy\f\*[B-Font]255.255.255.255\f[], 1630275970Scymeaning that the 1631275970Scy\f\*[I-Font]address\f[] 1632275970Scyis treated as the address of an individual host. 1633275970ScyA default entry (address 1634275970Scy\f\*[B-Font]0.0.0.0\f[], 1635275970Scymask 1636275970Scy\f\*[B-Font]0.0.0.0\f[]) 1637275970Scyis always included and is always the first entry in the list. 1638275970ScyNote that text string 1639275970Scy\f\*[B-Font]default\f[], 1640275970Scywith no mask option, may 1641275970Scybe used to indicate the default entry. 1642275970ScyIn the current implementation, 1643275970Scy\f\*[B-Font]flag\f[] 1644275970Scyalways 1645275970Scyrestricts access, i.e., an entry with no flags indicates that free 1646275970Scyaccess to the server is to be given. 1647275970ScyThe flags are not orthogonal, 1648275970Scyin that more restrictive flags will often make less restrictive 1649275970Scyones redundant. 1650275970ScyThe flags can generally be classed into two 1651275970Scycategories, those which restrict time service and those which 1652275970Scyrestrict informational queries and attempts to do run-time 1653275970Scyreconfiguration of the server. 1654275970ScyOne or more of the following flags 1655275970Scymay be specified: 1656275970Scy.RS 1657275970Scy.TP 7 1658275970Scy.NOP \f\*[B-Font]ignore\f[] 1659275970ScyDeny packets of all kinds, including 1660275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 1661275970Scyand 1662275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 1663275970Scyqueries. 1664275970Scy.TP 7 1665275970Scy.NOP \f\*[B-Font]kod\f[] 1666275970ScyIf this flag is set when an access violation occurs, a kiss-o'-death 1667275970Scy(KoD) packet is sent. 1668275970ScyKoD packets are rate limited to no more than one 1669275970Scyper second. 1670275970ScyIf another KoD packet occurs within one second after the 1671275970Scylast one, the packet is dropped. 1672275970Scy.TP 7 1673275970Scy.NOP \f\*[B-Font]limited\f[] 1674275970ScyDeny service if the packet spacing violates the lower limits specified 1675275970Scyin the discard command. 1676275970ScyA history of clients is kept using the 1677275970Scymonitoring capability of 1678275970Scy\fCntpd\fR(@NTPD_MS@)\f[]. 1679275970ScyThus, monitoring is always active as 1680275970Scylong as there is a restriction entry with the 1681275970Scy\f\*[B-Font]limited\f[] 1682275970Scyflag. 1683275970Scy.TP 7 1684275970Scy.NOP \f\*[B-Font]lowpriotrap\f[] 1685275970ScyDeclare traps set by matching hosts to be low priority. 1686275970ScyThe 1687275970Scynumber of traps a server can maintain is limited (the current limit 1688275970Scyis 3). 1689275970ScyTraps are usually assigned on a first come, first served 1690275970Scybasis, with later trap requestors being denied service. 1691275970ScyThis flag 1692275970Scymodifies the assignment algorithm by allowing low priority traps to 1693275970Scybe overridden by later requests for normal priority traps. 1694275970Scy.TP 7 1695275970Scy.NOP \f\*[B-Font]nomodify\f[] 1696275970ScyDeny 1697275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 1698275970Scyand 1699275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 1700275970Scyqueries which attempt to modify the state of the 1701275970Scyserver (i.e., run time reconfiguration). 1702275970ScyQueries which return 1703275970Scyinformation are permitted. 1704275970Scy.TP 7 1705275970Scy.NOP \f\*[B-Font]noquery\f[] 1706275970ScyDeny 1707275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 1708275970Scyand 1709275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 1710275970Scyqueries. 1711275970ScyTime service is not affected. 1712275970Scy.TP 7 1713275970Scy.NOP \f\*[B-Font]nopeer\f[] 1714275970ScyDeny packets which would result in mobilizing a new association. 1715275970ScyThis 1716275970Scyincludes broadcast and symmetric active packets when a configured 1717275970Scyassociation does not exist. 1718275970ScyIt also includes 1719275970Scy\f\*[B-Font]pool\f[] 1720275970Scyassociations, so if you want to use servers from a 1721275970Scy\f\*[B-Font]pool\f[] 1722275970Scydirective and also want to use 1723275970Scy\f\*[B-Font]nopeer\f[] 1724275970Scyby default, you'll want a 1725275970Scy\f\*[B-Font]restrict source ...\f[] \f\*[B-Font]line\f[] \f\*[B-Font]as\f[] \f\*[B-Font]well\f[] \f\*[B-Font]that\f[] \f\*[B-Font]does\f[] 1726275970Scy.TP 7 1727275970Scy.NOP not 1728275970Scyinclude the 1729275970Scy\f\*[B-Font]nopeer\f[] 1730275970Scydirective. 1731275970Scy.TP 7 1732275970Scy.NOP \f\*[B-Font]noserve\f[] 1733275970ScyDeny all packets except 1734275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 1735275970Scyand 1736275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 1737275970Scyqueries. 1738275970Scy.TP 7 1739275970Scy.NOP \f\*[B-Font]notrap\f[] 1740275970ScyDecline to provide mode 6 control message trap service to matching 1741275970Scyhosts. 1742275970ScyThe trap service is a subsystem of the ntpdq control message 1743275970Scyprotocol which is intended for use by remote event logging programs. 1744275970Scy.TP 7 1745275970Scy.NOP \f\*[B-Font]notrust\f[] 1746275970ScyDeny service unless the packet is cryptographically authenticated. 1747275970Scy.TP 7 1748275970Scy.NOP \f\*[B-Font]ntpport\f[] 1749275970ScyThis is actually a match algorithm modifier, rather than a 1750275970Scyrestriction flag. 1751275970ScyIts presence causes the restriction entry to be 1752275970Scymatched only if the source port in the packet is the standard NTP 1753275970ScyUDP port (123). 1754275970ScyBoth 1755275970Scy\f\*[B-Font]ntpport\f[] 1756275970Scyand 1757275970Scy\f\*[B-Font]non-ntpport\f[] 1758275970Scymay 1759275970Scybe specified. 1760275970ScyThe 1761275970Scy\f\*[B-Font]ntpport\f[] 1762275970Scyis considered more specific and 1763275970Scyis sorted later in the list. 1764275970Scy.TP 7 1765275970Scy.NOP \f\*[B-Font]version\f[] 1766275970ScyDeny packets that do not match the current NTP version. 1767275970Scy.RE 1768275970Scy.sp \n(Ppu 1769275970Scy.ne 2 1770275970Scy 1771275970ScyDefault restriction list entries with the flags ignore, interface, 1772275970Scyntpport, for each of the local host's interface addresses are 1773275970Scyinserted into the table at startup to prevent the server 1774275970Scyfrom attempting to synchronize to its own time. 1775275970ScyA default entry is also always present, though if it is 1776275970Scyotherwise unconfigured; no flags are associated 1777275970Scywith the default entry (i.e., everything besides your own 1778275970ScyNTP server is unrestricted). 1779275970Scy.PP 1780275970Scy.SH Automatic NTP Configuration Options 1781275970Scy.SS Manycasting 1782275970ScyManycasting is a automatic discovery and configuration paradigm 1783275970Scynew to NTPv4. 1784275970ScyIt is intended as a means for a multicast client 1785275970Scyto troll the nearby network neighborhood to find cooperating 1786275970Scymanycast servers, validate them using cryptographic means 1787275970Scyand evaluate their time values with respect to other servers 1788275970Scythat might be lurking in the vicinity. 1789275970ScyThe intended result is that each manycast client mobilizes 1790275970Scyclient associations with some number of the "best" 1791275970Scyof the nearby manycast servers, yet automatically reconfigures 1792275970Scyto sustain this number of servers should one or another fail. 1793275970Scy.sp \n(Ppu 1794275970Scy.ne 2 1795275970Scy 1796275970ScyNote that the manycasting paradigm does not coincide 1797275970Scywith the anycast paradigm described in RFC-1546, 1798275970Scywhich is designed to find a single server from a clique 1799275970Scyof servers providing the same service. 1800275970ScyThe manycast paradigm is designed to find a plurality 1801275970Scyof redundant servers satisfying defined optimality criteria. 1802275970Scy.sp \n(Ppu 1803275970Scy.ne 2 1804275970Scy 1805275970ScyManycasting can be used with either symmetric key 1806275970Scyor public key cryptography. 1807275970ScyThe public key infrastructure (PKI) 1808275970Scyoffers the best protection against compromised keys 1809275970Scyand is generally considered stronger, at least with relatively 1810275970Scylarge key sizes. 1811275970ScyIt is implemented using the Autokey protocol and 1812275970Scythe OpenSSL cryptographic library available from 1813275970Scy\f[C]http://www.openssl.org/\f[]. 1814275970ScyThe library can also be used with other NTPv4 modes 1815275970Scyas well and is highly recommended, especially for broadcast modes. 1816275970Scy.sp \n(Ppu 1817275970Scy.ne 2 1818275970Scy 1819275970ScyA persistent manycast client association is configured 1820275970Scyusing the manycastclient command, which is similar to the 1821275970Scyserver command but with a multicast (IPv4 class 1822275970Scy\f\*[B-Font]D\f[] 1823275970Scyor IPv6 prefix 1824275970Scy\f\*[B-Font]FF\f[]) 1825275970Scygroup address. 1826275970ScyThe IANA has designated IPv4 address 224.1.1.1 1827275970Scyand IPv6 address FF05::101 (site local) for NTP. 1828275970ScyWhen more servers are needed, it broadcasts manycast 1829275970Scyclient messages to this address at the minimum feasible rate 1830275970Scyand minimum feasible time-to-live (TTL) hops, depending 1831275970Scyon how many servers have already been found. 1832275970ScyThere can be as many manycast client associations 1833275970Scyas different group address, each one serving as a template 1834275970Scyfor a future ephemeral unicast client/server association. 1835275970Scy.sp \n(Ppu 1836275970Scy.ne 2 1837275970Scy 1838275970ScyManycast servers configured with the 1839275970Scy\f\*[B-Font]manycastserver\f[] 1840275970Scycommand listen on the specified group address for manycast 1841275970Scyclient messages. 1842275970ScyNote the distinction between manycast client, 1843275970Scywhich actively broadcasts messages, and manycast server, 1844275970Scywhich passively responds to them. 1845275970ScyIf a manycast server is 1846275970Scyin scope of the current TTL and is itself synchronized 1847275970Scyto a valid source and operating at a stratum level equal 1848275970Scyto or lower than the manycast client, it replies to the 1849275970Scymanycast client message with an ordinary unicast server message. 1850275970Scy.sp \n(Ppu 1851275970Scy.ne 2 1852275970Scy 1853275970ScyThe manycast client receiving this message mobilizes 1854275970Scyan ephemeral client/server association according to the 1855275970Scymatching manycast client template, but only if cryptographically 1856275970Scyauthenticated and the server stratum is less than or equal 1857275970Scyto the client stratum. 1858275970ScyAuthentication is explicitly required 1859275970Scyand either symmetric key or public key (Autokey) can be used. 1860275970ScyThen, the client polls the server at its unicast address 1861275970Scyin burst mode in order to reliably set the host clock 1862275970Scyand validate the source. 1863275970ScyThis normally results 1864275970Scyin a volley of eight client/server at 2-s intervals 1865275970Scyduring which both the synchronization and cryptographic 1866275970Scyprotocols run concurrently. 1867275970ScyFollowing the volley, 1868275970Scythe client runs the NTP intersection and clustering 1869275970Scyalgorithms, which act to discard all but the "best" 1870275970Scyassociations according to stratum and synchronization 1871275970Scydistance. 1872275970ScyThe surviving associations then continue 1873275970Scyin ordinary client/server mode. 1874275970Scy.sp \n(Ppu 1875275970Scy.ne 2 1876275970Scy 1877275970ScyThe manycast client polling strategy is designed to reduce 1878275970Scyas much as possible the volume of manycast client messages 1879275970Scyand the effects of implosion due to near-simultaneous 1880275970Scyarrival of manycast server messages. 1881275970ScyThe strategy is determined by the 1882275970Scy\f\*[B-Font]manycastclient\f[], 1883275970Scy\f\*[B-Font]tos\f[] 1884275970Scyand 1885275970Scy\f\*[B-Font]ttl\f[] 1886275970Scyconfiguration commands. 1887275970ScyThe manycast poll interval is 1888275970Scynormally eight times the system poll interval, 1889275970Scywhich starts out at the 1890275970Scy\f\*[B-Font]minpoll\f[] 1891275970Scyvalue specified in the 1892275970Scy\f\*[B-Font]manycastclient\f[], 1893275970Scycommand and, under normal circumstances, increments to the 1894275970Scy\f\*[B-Font]maxpolll\f[] 1895275970Scyvalue specified in this command. 1896275970ScyInitially, the TTL is 1897275970Scyset at the minimum hops specified by the ttl command. 1898275970ScyAt each retransmission the TTL is increased until reaching 1899275970Scythe maximum hops specified by this command or a sufficient 1900275970Scynumber client associations have been found. 1901275970ScyFurther retransmissions use the same TTL. 1902275970Scy.sp \n(Ppu 1903275970Scy.ne 2 1904275970Scy 1905275970ScyThe quality and reliability of the suite of associations 1906275970Scydiscovered by the manycast client is determined by the NTP 1907275970Scymitigation algorithms and the 1908275970Scy\f\*[B-Font]minclock\f[] 1909275970Scyand 1910275970Scy\f\*[B-Font]minsane\f[] 1911275970Scyvalues specified in the 1912275970Scy\f\*[B-Font]tos\f[] 1913275970Scyconfiguration command. 1914275970ScyAt least 1915275970Scy\f\*[B-Font]minsane\f[] 1916275970Scycandidate servers must be available and the mitigation 1917275970Scyalgorithms produce at least 1918275970Scy\f\*[B-Font]minclock\f[] 1919275970Scysurvivors in order to synchronize the clock. 1920275970ScyByzantine agreement principles require at least four 1921275970Scycandidates in order to correctly discard a single falseticker. 1922275970ScyFor legacy purposes, 1923275970Scy\f\*[B-Font]minsane\f[] 1924275970Scydefaults to 1 and 1925275970Scy\f\*[B-Font]minclock\f[] 1926275970Scydefaults to 3. 1927275970ScyFor manycast service 1928275970Scy\f\*[B-Font]minsane\f[] 1929275970Scyshould be explicitly set to 4, assuming at least that 1930275970Scynumber of servers are available. 1931275970Scy.sp \n(Ppu 1932275970Scy.ne 2 1933275970Scy 1934275970ScyIf at least 1935275970Scy\f\*[B-Font]minclock\f[] 1936275970Scyservers are found, the manycast poll interval is immediately 1937275970Scyset to eight times 1938275970Scy\f\*[B-Font]maxpoll\f[]. 1939275970ScyIf less than 1940275970Scy\f\*[B-Font]minclock\f[] 1941275970Scyservers are found when the TTL has reached the maximum hops, 1942275970Scythe manycast poll interval is doubled. 1943275970ScyFor each transmission 1944275970Scyafter that, the poll interval is doubled again until 1945275970Scyreaching the maximum of eight times 1946275970Scy\f\*[B-Font]maxpoll\f[]. 1947275970ScyFurther transmissions use the same poll interval and 1948275970ScyTTL values. 1949275970ScyNote that while all this is going on, 1950275970Scyeach client/server association found is operating normally 1951275970Scyit the system poll interval. 1952275970Scy.sp \n(Ppu 1953275970Scy.ne 2 1954275970Scy 1955275970ScyAdministratively scoped multicast boundaries are normally 1956275970Scyspecified by the network router configuration and, 1957275970Scyin the case of IPv6, the link/site scope prefix. 1958275970ScyBy default, the increment for TTL hops is 32 starting 1959275970Scyfrom 31; however, the 1960275970Scy\f\*[B-Font]ttl\f[] 1961275970Scyconfiguration command can be 1962275970Scyused to modify the values to match the scope rules. 1963275970Scy.sp \n(Ppu 1964275970Scy.ne 2 1965275970Scy 1966275970ScyIt is often useful to narrow the range of acceptable 1967275970Scyservers which can be found by manycast client associations. 1968275970ScyBecause manycast servers respond only when the client 1969275970Scystratum is equal to or greater than the server stratum, 1970275970Scyprimary (stratum 1) servers fill find only primary servers 1971275970Scyin TTL range, which is probably the most common objective. 1972275970ScyHowever, unless configured otherwise, all manycast clients 1973275970Scyin TTL range will eventually find all primary servers 1974275970Scyin TTL range, which is probably not the most common 1975275970Scyobjective in large networks. 1976275970ScyThe 1977275970Scy\f\*[B-Font]tos\f[] 1978275970Scycommand can be used to modify this behavior. 1979275970ScyServers with stratum below 1980275970Scy\f\*[B-Font]floor\f[] 1981275970Scyor above 1982275970Scy\f\*[B-Font]ceiling\f[] 1983275970Scyspecified in the 1984275970Scy\f\*[B-Font]tos\f[] 1985275970Scycommand are strongly discouraged during the selection 1986275970Scyprocess; however, these servers may be temporally 1987275970Scyaccepted if the number of servers within TTL range is 1988275970Scyless than 1989275970Scy\f\*[B-Font]minclock\f[]. 1990275970Scy.sp \n(Ppu 1991275970Scy.ne 2 1992275970Scy 1993275970ScyThe above actions occur for each manycast client message, 1994275970Scywhich repeats at the designated poll interval. 1995275970ScyHowever, once the ephemeral client association is mobilized, 1996275970Scysubsequent manycast server replies are discarded, 1997275970Scysince that would result in a duplicate association. 1998275970ScyIf during a poll interval the number of client associations 1999275970Scyfalls below 2000275970Scy\f\*[B-Font]minclock\f[], 2001275970Scyall manycast client prototype associations are reset 2002275970Scyto the initial poll interval and TTL hops and operation 2003275970Scyresumes from the beginning. 2004275970ScyIt is important to avoid 2005275970Scyfrequent manycast client messages, since each one requires 2006275970Scyall manycast servers in TTL range to respond. 2007275970ScyThe result could well be an implosion, either minor or major, 2008275970Scydepending on the number of servers in range. 2009275970ScyThe recommended value for 2010275970Scy\f\*[B-Font]maxpoll\f[] 2011275970Scyis 12 (4,096 s). 2012275970Scy.sp \n(Ppu 2013275970Scy.ne 2 2014275970Scy 2015275970ScyIt is possible and frequently useful to configure a host 2016275970Scyas both manycast client and manycast server. 2017275970ScyA number of hosts configured this way and sharing a common 2018275970Scygroup address will automatically organize themselves 2019275970Scyin an optimum configuration based on stratum and 2020275970Scysynchronization distance. 2021275970ScyFor example, consider an NTP 2022275970Scysubnet of two primary servers and a hundred or more 2023275970Scydependent clients. 2024275970ScyWith two exceptions, all servers 2025275970Scyand clients have identical configuration files including both 2026275970Scy\f\*[B-Font]multicastclient\f[] 2027275970Scyand 2028275970Scy\f\*[B-Font]multicastserver\f[] 2029275970Scycommands using, for instance, multicast group address 2030275970Scy239.1.1.1. 2031275970ScyThe only exception is that each primary server 2032275970Scyconfiguration file must include commands for the primary 2033275970Scyreference source such as a GPS receiver. 2034275970Scy.sp \n(Ppu 2035275970Scy.ne 2 2036275970Scy 2037275970ScyThe remaining configuration files for all secondary 2038275970Scyservers and clients have the same contents, except for the 2039275970Scy\f\*[B-Font]tos\f[] 2040275970Scycommand, which is specific for each stratum level. 2041275970ScyFor stratum 1 and stratum 2 servers, that command is 2042275970Scynot necessary. 2043275970ScyFor stratum 3 and above servers the 2044275970Scy\f\*[B-Font]floor\f[] 2045275970Scyvalue is set to the intended stratum number. 2046275970ScyThus, all stratum 3 configuration files are identical, 2047275970Scyall stratum 4 files are identical and so forth. 2048275970Scy.sp \n(Ppu 2049275970Scy.ne 2 2050275970Scy 2051275970ScyOnce operations have stabilized in this scenario, 2052275970Scythe primary servers will find the primary reference source 2053275970Scyand each other, since they both operate at the same 2054275970Scystratum (1), but not with any secondary server or client, 2055275970Scysince these operate at a higher stratum. 2056275970ScyThe secondary 2057275970Scyservers will find the servers at the same stratum level. 2058275970ScyIf one of the primary servers loses its GPS receiver, 2059275970Scyit will continue to operate as a client and other clients 2060275970Scywill time out the corresponding association and 2061275970Scyre-associate accordingly. 2062275970Scy.sp \n(Ppu 2063275970Scy.ne 2 2064275970Scy 2065275970ScySome administrators prefer to avoid running 2066275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2067275970Scycontinuously and run either 2068275970Scy\fCntpdate\fR(8)\f[] 2069275970Scyor 2070275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2071275970Scy\f\*[B-Font]\-q\f[] 2072275970Scyas a cron job. 2073275970ScyIn either case the servers must be 2074275970Scyconfigured in advance and the program fails if none are 2075275970Scyavailable when the cron job runs. 2076275970ScyA really slick 2077275970Scyapplication of manycast is with 2078275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2079275970Scy\f\*[B-Font]\-q\f[]. 2080275970ScyThe program wakes up, scans the local landscape looking 2081275970Scyfor the usual suspects, selects the best from among 2082275970Scythe rascals, sets the clock and then departs. 2083275970ScyServers do not have to be configured in advance and 2084275970Scyall clients throughout the network can have the same 2085275970Scyconfiguration file. 2086275970Scy.SS Manycast Interactions with Autokey 2087275970ScyEach time a manycast client sends a client mode packet 2088275970Scyto a multicast group address, all manycast servers 2089275970Scyin scope generate a reply including the host name 2090275970Scyand status word. 2091275970ScyThe manycast clients then run 2092275970Scythe Autokey protocol, which collects and verifies 2093275970Scyall certificates involved. 2094275970ScyFollowing the burst interval 2095275970Scyall but three survivors are cast off, 2096275970Scybut the certificates remain in the local cache. 2097275970ScyIt often happens that several complete signing trails 2098275970Scyfrom the client to the primary servers are collected in this way. 2099275970Scy.sp \n(Ppu 2100275970Scy.ne 2 2101275970Scy 2102275970ScyAbout once an hour or less often if the poll interval 2103275970Scyexceeds this, the client regenerates the Autokey key list. 2104275970ScyThis is in general transparent in client/server mode. 2105275970ScyHowever, about once per day the server private value 2106275970Scyused to generate cookies is refreshed along with all 2107275970Scymanycast client associations. 2108275970ScyIn this case all 2109275970Scycryptographic values including certificates is refreshed. 2110275970ScyIf a new certificate has been generated since 2111275970Scythe last refresh epoch, it will automatically revoke 2112275970Scyall prior certificates that happen to be in the 2113275970Scycertificate cache. 2114275970ScyAt the same time, the manycast 2115275970Scyscheme starts all over from the beginning and 2116275970Scythe expanding ring shrinks to the minimum and increments 2117275970Scyfrom there while collecting all servers in scope. 2118275970Scy.SS Manycast Options 2119275970Scy.TP 7 2120275970Scy.NOP \f\*[B-Font]tos\f[] [\f\*[B-Font]ceiling\f[] \f\*[I-Font]ceiling\f[] | \f\*[B-Font]cohort\f[] { \f\*[B-Font]0\f[] | \f\*[B-Font]1\f[] } | \f\*[B-Font]floor\f[] \f\*[I-Font]floor\f[] | \f\*[B-Font]minclock\f[] \f\*[I-Font]minclock\f[] | \f\*[B-Font]minsane\f[] \f\*[I-Font]minsane\f[]] 2121275970ScyThis command affects the clock selection and clustering 2122275970Scyalgorithms. 2123275970ScyIt can be used to select the quality and 2124275970Scyquantity of peers used to synchronize the system clock 2125275970Scyand is most useful in manycast mode. 2126275970ScyThe variables operate 2127275970Scyas follows: 2128275970Scy.RS 2129275970Scy.TP 7 2130275970Scy.NOP \f\*[B-Font]ceiling\f[] \f\*[I-Font]ceiling\f[] 2131275970ScyPeers with strata above 2132275970Scy\f\*[B-Font]ceiling\f[] 2133275970Scywill be discarded if there are at least 2134275970Scy\f\*[B-Font]minclock\f[] 2135275970Scypeers remaining. 2136275970ScyThis value defaults to 15, but can be changed 2137275970Scyto any number from 1 to 15. 2138275970Scy.TP 7 2139275970Scy.NOP \f\*[B-Font]cohort\f[] {0 | 1 } 2140275970ScyThis is a binary flag which enables (0) or disables (1) 2141275970Scymanycast server replies to manycast clients with the same 2142275970Scystratum level. 2143275970ScyThis is useful to reduce implosions where 2144275970Scylarge numbers of clients with the same stratum level 2145275970Scyare present. 2146275970ScyThe default is to enable these replies. 2147275970Scy.TP 7 2148275970Scy.NOP \f\*[B-Font]floor\f[] \f\*[I-Font]floor\f[] 2149275970ScyPeers with strata below 2150275970Scy\f\*[B-Font]floor\f[] 2151275970Scywill be discarded if there are at least 2152275970Scy\f\*[B-Font]minclock\f[] 2153275970Scypeers remaining. 2154275970ScyThis value defaults to 1, but can be changed 2155275970Scyto any number from 1 to 15. 2156275970Scy.TP 7 2157275970Scy.NOP \f\*[B-Font]minclock\f[] \f\*[I-Font]minclock\f[] 2158275970ScyThe clustering algorithm repeatedly casts out outlyer 2159275970Scyassociations until no more than 2160275970Scy\f\*[B-Font]minclock\f[] 2161275970Scyassociations remain. 2162275970ScyThis value defaults to 3, 2163275970Scybut can be changed to any number from 1 to the number of 2164275970Scyconfigured sources. 2165275970Scy.TP 7 2166275970Scy.NOP \f\*[B-Font]minsane\f[] \f\*[I-Font]minsane\f[] 2167275970ScyThis is the minimum number of candidates available 2168275970Scyto the clock selection algorithm in order to produce 2169275970Scyone or more truechimers for the clustering algorithm. 2170275970ScyIf fewer than this number are available, the clock is 2171275970Scyundisciplined and allowed to run free. 2172275970ScyThe default is 1 2173275970Scyfor legacy purposes. 2174275970ScyHowever, according to principles of 2175275970ScyByzantine agreement, 2176275970Scy\f\*[B-Font]minsane\f[] 2177275970Scyshould be at least 4 in order to detect and discard 2178275970Scya single falseticker. 2179275970Scy.RE 2180275970Scy.TP 7 2181275970Scy.NOP \f\*[B-Font]ttl\f[] \f\*[I-Font]hop\f[] \f\*[I-Font]...\f[] 2182275970ScyThis command specifies a list of TTL values in increasing 2183275970Scyorder, up to 8 values can be specified. 2184275970ScyIn manycast mode these values are used in turn 2185275970Scyin an expanding-ring search. 2186275970ScyThe default is eight 2187275970Scymultiples of 32 starting at 31. 2188275970Scy.PP 2189275970Scy.SH Reference Clock Support 2190275970ScyThe NTP Version 4 daemon supports some three dozen different radio, 2191275970Scysatellite and modem reference clocks plus a special pseudo-clock 2192275970Scyused for backup or when no other clock source is available. 2193275970ScyDetailed descriptions of individual device drivers and options can 2194275970Scybe found in the 2195275970Scy"Reference Clock Drivers" 2196275970Scypage 2197275970Scy(available as part of the HTML documentation 2198275970Scyprovided in 2199275970Scy\fI/usr/share/doc/ntp\f[]). 2200275970ScyAdditional information can be found in the pages linked 2201275970Scythere, including the 2202275970Scy"Debugging Hints for Reference Clock Drivers" 2203275970Scyand 2204275970Scy"How To Write a Reference Clock Driver" 2205275970Scypages 2206275970Scy(available as part of the HTML documentation 2207275970Scyprovided in 2208275970Scy\fI/usr/share/doc/ntp\f[]). 2209275970ScyIn addition, support for a PPS 2210275970Scysignal is available as described in the 2211275970Scy"Pulse-per-second (PPS) Signal Interfacing" 2212275970Scypage 2213275970Scy(available as part of the HTML documentation 2214275970Scyprovided in 2215275970Scy\fI/usr/share/doc/ntp\f[]). 2216275970ScyMany 2217275970Scydrivers support special line discipline/streams modules which can 2218275970Scysignificantly improve the accuracy using the driver. 2219275970ScyThese are 2220275970Scydescribed in the 2221275970Scy"Line Disciplines and Streams Drivers" 2222275970Scypage 2223275970Scy(available as part of the HTML documentation 2224275970Scyprovided in 2225275970Scy\fI/usr/share/doc/ntp\f[]). 2226275970Scy.sp \n(Ppu 2227275970Scy.ne 2 2228275970Scy 2229275970ScyA reference clock will generally (though not always) be a radio 2230275970Scytimecode receiver which is synchronized to a source of standard 2231275970Scytime such as the services offered by the NRC in Canada and NIST and 2232275970ScyUSNO in the US. 2233275970ScyThe interface between the computer and the timecode 2234275970Scyreceiver is device dependent, but is usually a serial port. 2235275970ScyA 2236275970Scydevice driver specific to each reference clock must be selected and 2237275970Scycompiled in the distribution; however, most common radio, satellite 2238275970Scyand modem clocks are included by default. 2239275970ScyNote that an attempt to 2240275970Scyconfigure a reference clock when the driver has not been compiled 2241275970Scyor the hardware port has not been appropriately configured results 2242275970Scyin a scalding remark to the system log file, but is otherwise non 2243275970Scyhazardous. 2244275970Scy.sp \n(Ppu 2245275970Scy.ne 2 2246275970Scy 2247275970ScyFor the purposes of configuration, 2248275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2249275970Scytreats 2250275970Scyreference clocks in a manner analogous to normal NTP peers as much 2251275970Scyas possible. 2252275970ScyReference clocks are identified by a syntactically 2253275970Scycorrect but invalid IP address, in order to distinguish them from 2254275970Scynormal NTP peers. 2255275970ScyReference clock addresses are of the form 2256275970Scy\f[C]127.127.\f[]\f\*[I-Font]t\f[].\f\*[I-Font]u\f[], 2257275970Scywhere 2258275970Scy\f\*[I-Font]t\f[] 2259275970Scyis an integer 2260275970Scydenoting the clock type and 2261275970Scy\f\*[I-Font]u\f[] 2262275970Scyindicates the unit 2263275970Scynumber in the range 0-3. 2264275970ScyWhile it may seem overkill, it is in fact 2265275970Scysometimes useful to configure multiple reference clocks of the same 2266275970Scytype, in which case the unit numbers must be unique. 2267275970Scy.sp \n(Ppu 2268275970Scy.ne 2 2269275970Scy 2270275970ScyThe 2271275970Scy\f\*[B-Font]server\f[] 2272275970Scycommand is used to configure a reference 2273275970Scyclock, where the 2274275970Scy\f\*[I-Font]address\f[] 2275275970Scyargument in that command 2276275970Scyis the clock address. 2277275970ScyThe 2278275970Scy\f\*[B-Font]key\f[], 2279275970Scy\f\*[B-Font]version\f[] 2280275970Scyand 2281275970Scy\f\*[B-Font]ttl\f[] 2282275970Scyoptions are not used for reference clock support. 2283275970ScyThe 2284275970Scy\f\*[B-Font]mode\f[] 2285275970Scyoption is added for reference clock support, as 2286275970Scydescribed below. 2287275970ScyThe 2288275970Scy\f\*[B-Font]prefer\f[] 2289275970Scyoption can be useful to 2290275970Scypersuade the server to cherish a reference clock with somewhat more 2291275970Scyenthusiasm than other reference clocks or peers. 2292275970ScyFurther 2293275970Scyinformation on this option can be found in the 2294275970Scy"Mitigation Rules and the prefer Keyword" 2295275970Scy(available as part of the HTML documentation 2296275970Scyprovided in 2297275970Scy\fI/usr/share/doc/ntp\f[]) 2298275970Scypage. 2299275970ScyThe 2300275970Scy\f\*[B-Font]minpoll\f[] 2301275970Scyand 2302275970Scy\f\*[B-Font]maxpoll\f[] 2303275970Scyoptions have 2304275970Scymeaning only for selected clock drivers. 2305275970ScySee the individual clock 2306275970Scydriver document pages for additional information. 2307275970Scy.sp \n(Ppu 2308275970Scy.ne 2 2309275970Scy 2310275970ScyThe 2311275970Scy\f\*[B-Font]fudge\f[] 2312275970Scycommand is used to provide additional 2313275970Scyinformation for individual clock drivers and normally follows 2314275970Scyimmediately after the 2315275970Scy\f\*[B-Font]server\f[] 2316275970Scycommand. 2317275970ScyThe 2318275970Scy\f\*[I-Font]address\f[] 2319275970Scyargument specifies the clock address. 2320275970ScyThe 2321275970Scy\f\*[B-Font]refid\f[] 2322275970Scyand 2323275970Scy\f\*[B-Font]stratum\f[] 2324275970Scyoptions can be used to 2325275970Scyoverride the defaults for the device. 2326275970ScyThere are two optional 2327275970Scydevice-dependent time offsets and four flags that can be included 2328275970Scyin the 2329275970Scy\f\*[B-Font]fudge\f[] 2330275970Scycommand as well. 2331275970Scy.sp \n(Ppu 2332275970Scy.ne 2 2333275970Scy 2334275970ScyThe stratum number of a reference clock is by default zero. 2335275970ScySince the 2336275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2337275970Scydaemon adds one to the stratum of each 2338275970Scypeer, a primary server ordinarily displays an external stratum of 2339275970Scyone. 2340275970ScyIn order to provide engineered backups, it is often useful to 2341275970Scyspecify the reference clock stratum as greater than zero. 2342275970ScyThe 2343275970Scy\f\*[B-Font]stratum\f[] 2344275970Scyoption is used for this purpose. 2345275970ScyAlso, in cases 2346275970Scyinvolving both a reference clock and a pulse-per-second (PPS) 2347275970Scydiscipline signal, it is useful to specify the reference clock 2348275970Scyidentifier as other than the default, depending on the driver. 2349275970ScyThe 2350275970Scy\f\*[B-Font]refid\f[] 2351275970Scyoption is used for this purpose. 2352275970ScyExcept where noted, 2353275970Scythese options apply to all clock drivers. 2354275970Scy.SS Reference Clock Commands 2355275970Scy.TP 7 2356275970Scy.NOP \f\*[B-Font]server\f[] \f[C]127.127.\f[]\f\*[I-Font]t\f[].\f\*[I-Font]u\f[] [\f\*[B-Font]prefer\f[]] [\f\*[B-Font]mode\f[] \f\*[I-Font]int\f[]] [\f\*[B-Font]minpoll\f[] \f\*[I-Font]int\f[]] [\f\*[B-Font]maxpoll\f[] \f\*[I-Font]int\f[]] 2357275970ScyThis command can be used to configure reference clocks in 2358275970Scyspecial ways. 2359275970ScyThe options are interpreted as follows: 2360275970Scy.RS 2361275970Scy.TP 7 2362275970Scy.NOP \f\*[B-Font]prefer\f[] 2363275970ScyMarks the reference clock as preferred. 2364275970ScyAll other things being 2365275970Scyequal, this host will be chosen for synchronization among a set of 2366275970Scycorrectly operating hosts. 2367275970ScySee the 2368275970Scy"Mitigation Rules and the prefer Keyword" 2369275970Scypage 2370275970Scy(available as part of the HTML documentation 2371275970Scyprovided in 2372275970Scy\fI/usr/share/doc/ntp\f[]) 2373275970Scyfor further information. 2374275970Scy.TP 7 2375275970Scy.NOP \f\*[B-Font]mode\f[] \f\*[I-Font]int\f[] 2376275970ScySpecifies a mode number which is interpreted in a 2377275970Scydevice-specific fashion. 2378275970ScyFor instance, it selects a dialing 2379275970Scyprotocol in the ACTS driver and a device subtype in the 2380275970Scyparse 2381275970Scydrivers. 2382275970Scy.TP 7 2383275970Scy.NOP \f\*[B-Font]minpoll\f[] \f\*[I-Font]int\f[] 2384275970Scy.TP 7 2385275970Scy.NOP \f\*[B-Font]maxpoll\f[] \f\*[I-Font]int\f[] 2386275970ScyThese options specify the minimum and maximum polling interval 2387275970Scyfor reference clock messages, as a power of 2 in seconds 2388275970ScyFor 2389275970Scymost directly connected reference clocks, both 2390275970Scy\f\*[B-Font]minpoll\f[] 2391275970Scyand 2392275970Scy\f\*[B-Font]maxpoll\f[] 2393275970Scydefault to 6 (64 s). 2394275970ScyFor modem reference clocks, 2395275970Scy\f\*[B-Font]minpoll\f[] 2396275970Scydefaults to 10 (17.1 m) and 2397275970Scy\f\*[B-Font]maxpoll\f[] 2398275970Scydefaults to 14 (4.5 h). 2399275970ScyThe allowable range is 4 (16 s) to 17 (36.4 h) inclusive. 2400275970Scy.RE 2401275970Scy.TP 7 2402275970Scy.NOP \f\*[B-Font]fudge\f[] \f[C]127.127.\f[]\f\*[I-Font]t\f[].\f\*[I-Font]u\f[] [\f\*[B-Font]time1\f[] \f\*[I-Font]sec\f[]] [\f\*[B-Font]time2\f[] \f\*[I-Font]sec\f[]] [\f\*[B-Font]stratum\f[] \f\*[I-Font]int\f[]] [\f\*[B-Font]refid\f[] \f\*[I-Font]string\f[]] [\f\*[B-Font]mode\f[] \f\*[I-Font]int\f[]] [\f\*[B-Font]flag1\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[]] [\f\*[B-Font]flag2\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[]] [\f\*[B-Font]flag3\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[]] [\f\*[B-Font]flag4\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[]] 2403275970ScyThis command can be used to configure reference clocks in 2404275970Scyspecial ways. 2405275970ScyIt must immediately follow the 2406275970Scy\f\*[B-Font]server\f[] 2407275970Scycommand which configures the driver. 2408275970ScyNote that the same capability 2409275970Scyis possible at run time using the 2410275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 2411275970Scyprogram. 2412275970ScyThe options are interpreted as 2413275970Scyfollows: 2414275970Scy.RS 2415275970Scy.TP 7 2416275970Scy.NOP \f\*[B-Font]time1\f[] \f\*[I-Font]sec\f[] 2417275970ScySpecifies a constant to be added to the time offset produced by 2418275970Scythe driver, a fixed-point decimal number in seconds. 2419275970ScyThis is used 2420275970Scyas a calibration constant to adjust the nominal time offset of a 2421275970Scyparticular clock to agree with an external standard, such as a 2422275970Scyprecision PPS signal. 2423275970ScyIt also provides a way to correct a 2424275970Scysystematic error or bias due to serial port or operating system 2425275970Scylatencies, different cable lengths or receiver internal delay. 2426275970ScyThe 2427275970Scyspecified offset is in addition to the propagation delay provided 2428275970Scyby other means, such as internal DIPswitches. 2429275970ScyWhere a calibration 2430275970Scyfor an individual system and driver is available, an approximate 2431275970Scycorrection is noted in the driver documentation pages. 2432275970ScyNote: in order to facilitate calibration when more than one 2433275970Scyradio clock or PPS signal is supported, a special calibration 2434275970Scyfeature is available. 2435275970ScyIt takes the form of an argument to the 2436275970Scy\f\*[B-Font]enable\f[] 2437275970Scycommand described in 2438275970Scy\fIMiscellaneous\f[] \fIOptions\f[] 2439275970Scypage and operates as described in the 2440275970Scy"Reference Clock Drivers" 2441275970Scypage 2442275970Scy(available as part of the HTML documentation 2443275970Scyprovided in 2444275970Scy\fI/usr/share/doc/ntp\f[]). 2445275970Scy.TP 7 2446275970Scy.NOP \f\*[B-Font]time2\f[] \f\*[I-Font]secs\f[] 2447275970ScySpecifies a fixed-point decimal number in seconds, which is 2448275970Scyinterpreted in a driver-dependent way. 2449275970ScySee the descriptions of 2450275970Scyspecific drivers in the 2451275970Scy"Reference Clock Drivers" 2452275970Scypage 2453275970Scy(available as part of the HTML documentation 2454275970Scyprovided in 2455275970Scy\fI/usr/share/doc/ntp\f[]). 2456275970Scy.TP 7 2457275970Scy.NOP \f\*[B-Font]stratum\f[] \f\*[I-Font]int\f[] 2458275970ScySpecifies the stratum number assigned to the driver, an integer 2459275970Scybetween 0 and 15. 2460275970ScyThis number overrides the default stratum number 2461275970Scyordinarily assigned by the driver itself, usually zero. 2462275970Scy.TP 7 2463275970Scy.NOP \f\*[B-Font]refid\f[] \f\*[I-Font]string\f[] 2464275970ScySpecifies an ASCII string of from one to four characters which 2465275970Scydefines the reference identifier used by the driver. 2466275970ScyThis string 2467275970Scyoverrides the default identifier ordinarily assigned by the driver 2468275970Scyitself. 2469275970Scy.TP 7 2470275970Scy.NOP \f\*[B-Font]mode\f[] \f\*[I-Font]int\f[] 2471275970ScySpecifies a mode number which is interpreted in a 2472275970Scydevice-specific fashion. 2473275970ScyFor instance, it selects a dialing 2474275970Scyprotocol in the ACTS driver and a device subtype in the 2475275970Scyparse 2476275970Scydrivers. 2477275970Scy.TP 7 2478275970Scy.NOP \f\*[B-Font]flag1\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[] 2479275970Scy.TP 7 2480275970Scy.NOP \f\*[B-Font]flag2\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[] 2481275970Scy.TP 7 2482275970Scy.NOP \f\*[B-Font]flag3\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[] 2483275970Scy.TP 7 2484275970Scy.NOP \f\*[B-Font]flag4\f[] \f\*[B-Font]0\f[] \f\*[B-Font]\&|\f[] \f\*[B-Font]1\f[] 2485275970ScyThese four flags are used for customizing the clock driver. 2486275970ScyThe 2487275970Scyinterpretation of these values, and whether they are used at all, 2488275970Scyis a function of the particular clock driver. 2489275970ScyHowever, by 2490275970Scyconvention 2491275970Scy\f\*[B-Font]flag4\f[] 2492275970Scyis used to enable recording monitoring 2493275970Scydata to the 2494275970Scy\f\*[B-Font]clockstats\f[] 2495275970Scyfile configured with the 2496275970Scy\f\*[B-Font]filegen\f[] 2497275970Scycommand. 2498275970ScyFurther information on the 2499275970Scy\f\*[B-Font]filegen\f[] 2500275970Scycommand can be found in 2501275970Scy\fIMonitoring\f[] \fIOptions\f[]. 2502275970Scy.RE 2503275970Scy.PP 2504275970Scy.SH Miscellaneous Options 2505275970Scy.TP 7 2506275970Scy.NOP \f\*[B-Font]broadcastdelay\f[] \f\*[I-Font]seconds\f[] 2507275970ScyThe broadcast and multicast modes require a special calibration 2508275970Scyto determine the network delay between the local and remote 2509275970Scyservers. 2510275970ScyOrdinarily, this is done automatically by the initial 2511275970Scyprotocol exchanges between the client and server. 2512275970ScyIn some cases, 2513275970Scythe calibration procedure may fail due to network or server access 2514275970Scycontrols, for example. 2515275970ScyThis command specifies the default delay to 2516275970Scybe used under these circumstances. 2517275970ScyTypically (for Ethernet), a 2518275970Scynumber between 0.003 and 0.007 seconds is appropriate. 2519275970ScyThe default 2520275970Scywhen this command is not used is 0.004 seconds. 2521275970Scy.TP 7 2522275970Scy.NOP \f\*[B-Font]calldelay\f[] \f\*[I-Font]delay\f[] 2523275970ScyThis option controls the delay in seconds between the first and second 2524275970Scypackets sent in burst or iburst mode to allow additional time for a modem 2525275970Scyor ISDN call to complete. 2526275970Scy.TP 7 2527275970Scy.NOP \f\*[B-Font]driftfile\f[] \f\*[I-Font]driftfile\f[] 2528275970ScyThis command specifies the complete path and name of the file used to 2529275970Scyrecord the frequency of the local clock oscillator. 2530275970ScyThis is the same 2531275970Scyoperation as the 2532275970Scy\f\*[B-Font]\-f\f[] 2533275970Scycommand line option. 2534275970ScyIf the file exists, it is read at 2535275970Scystartup in order to set the initial frequency and then updated once per 2536275970Scyhour with the current frequency computed by the daemon. 2537275970ScyIf the file name is 2538275970Scyspecified, but the file itself does not exist, the starts with an initial 2539275970Scyfrequency of zero and creates the file when writing it for the first time. 2540275970ScyIf this command is not given, the daemon will always start with an initial 2541275970Scyfrequency of zero. 2542275970Scy.sp \n(Ppu 2543275970Scy.ne 2 2544275970Scy 2545275970ScyThe file format consists of a single line containing a single 2546275970Scyfloating point number, which records the frequency offset measured 2547275970Scyin parts-per-million (PPM). 2548275970ScyThe file is updated by first writing 2549275970Scythe current drift value into a temporary file and then renaming 2550275970Scythis file to replace the old version. 2551275970ScyThis implies that 2552275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2553275970Scymust have write permission for the directory the 2554275970Scydrift file is located in, and that file system links, symbolic or 2555275970Scyotherwise, should be avoided. 2556275970Scy.TP 7 2557275970Scy.NOP \f\*[B-Font]enable\f[] [\f\*[B-Font]auth\f[] | \f\*[B-Font]bclient\f[] | \f\*[B-Font]calibrate\f[] | \f\*[B-Font]kernel\f[] | \f\*[B-Font]mode7\f[] | \f\*[B-Font]monitor\f[] | \f\*[B-Font]ntp\f[] | \f\*[B-Font]stats\f[]] 2558275970Scy.TP 7 2559275970Scy.NOP \f\*[B-Font]disable\f[] [\f\*[B-Font]auth\f[] | \f\*[B-Font]bclient\f[] | \f\*[B-Font]calibrate\f[] | \f\*[B-Font]kernel\f[] | \f\*[B-Font]mode7\f[] | \f\*[B-Font]monitor\f[] | \f\*[B-Font]ntp\f[] | \f\*[B-Font]stats\f[]] 2560275970ScyProvides a way to enable or disable various server options. 2561275970ScyFlags not mentioned are unaffected. 2562275970ScyNote that all of these flags 2563275970Scycan be controlled remotely using the 2564275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 2565275970Scyutility program. 2566275970Scy.RS 2567275970Scy.TP 7 2568275970Scy.NOP \f\*[B-Font]auth\f[] 2569275970ScyEnables the server to synchronize with unconfigured peers only if the 2570275970Scypeer has been correctly authenticated using either public key or 2571275970Scyprivate key cryptography. 2572275970ScyThe default for this flag is 2573275970Scy\f\*[B-Font]enable\f[]. 2574275970Scy.TP 7 2575275970Scy.NOP \f\*[B-Font]bclient\f[] 2576275970ScyEnables the server to listen for a message from a broadcast or 2577275970Scymulticast server, as in the 2578275970Scy\f\*[B-Font]multicastclient\f[] 2579275970Scycommand with default 2580275970Scyaddress. 2581275970ScyThe default for this flag is 2582275970Scy\f\*[B-Font]disable\f[]. 2583275970Scy.TP 7 2584275970Scy.NOP \f\*[B-Font]calibrate\f[] 2585275970ScyEnables the calibrate feature for reference clocks. 2586275970ScyThe default for 2587275970Scythis flag is 2588275970Scy\f\*[B-Font]disable\f[]. 2589275970Scy.TP 7 2590275970Scy.NOP \f\*[B-Font]kernel\f[] 2591275970ScyEnables the kernel time discipline, if available. 2592275970ScyThe default for this 2593275970Scyflag is 2594275970Scy\f\*[B-Font]enable\f[] 2595275970Scyif support is available, otherwise 2596275970Scy\f\*[B-Font]disable\f[]. 2597275970Scy.TP 7 2598275970Scy.NOP \f\*[B-Font]mode7\f[] 2599275970ScyEnables processing of NTP mode 7 implementation-specific requests 2600275970Scywhich are used by the deprecated 2601275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 2602275970Scyprogram. 2603275970ScyThe default for this flag is disable. 2604275970ScyThis flag is excluded from runtime configuration using 2605275970Scy\fCntpq\fR(@NTPQ_MS@)\f[]. 2606275970ScyThe 2607275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 2608275970Scyprogram provides the same capabilities as 2609275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 2610275970Scyusing standard mode 6 requests. 2611275970Scy.TP 7 2612275970Scy.NOP \f\*[B-Font]monitor\f[] 2613275970ScyEnables the monitoring facility. 2614275970ScySee the 2615275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[] 2616275970Scyprogram 2617275970Scyand the 2618275970Scy\f\*[B-Font]monlist\f[] 2619275970Scycommand or further information. 2620275970ScyThe 2621275970Scydefault for this flag is 2622275970Scy\f\*[B-Font]enable\f[]. 2623275970Scy.TP 7 2624275970Scy.NOP \f\*[B-Font]ntp\f[] 2625275970ScyEnables time and frequency discipline. 2626275970ScyIn effect, this switch opens and 2627275970Scycloses the feedback loop, which is useful for testing. 2628275970ScyThe default for 2629275970Scythis flag is 2630275970Scy\f\*[B-Font]enable\f[]. 2631275970Scy.TP 7 2632275970Scy.NOP \f\*[B-Font]stats\f[] 2633275970ScyEnables the statistics facility. 2634275970ScySee the 2635275970Scy\fIMonitoring\f[] \fIOptions\f[] 2636275970Scysection for further information. 2637275970ScyThe default for this flag is 2638275970Scy\f\*[B-Font]disable\f[]. 2639275970Scy.RE 2640275970Scy.TP 7 2641275970Scy.NOP \f\*[B-Font]includefile\f[] \f\*[I-Font]includefile\f[] 2642275970ScyThis command allows additional configuration commands 2643275970Scyto be included from a separate file. 2644275970ScyInclude files may 2645275970Scybe nested to a depth of five; upon reaching the end of any 2646275970Scyinclude file, command processing resumes in the previous 2647275970Scyconfiguration file. 2648275970ScyThis option is useful for sites that run 2649275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2650275970Scyon multiple hosts, with (mostly) common options (e.g., a 2651275970Scyrestriction list). 2652275970Scy.TP 7 2653275970Scy.NOP \f\*[B-Font]logconfig\f[] \f\*[I-Font]configkeyword\f[] 2654275970ScyThis command controls the amount and type of output written to 2655275970Scythe system 2656275970Scy\fCsyslog\fR(3)\f[] 2657275970Scyfacility or the alternate 2658275970Scy\f\*[B-Font]logfile\f[] 2659275970Scylog file. 2660275970ScyBy default, all output is turned on. 2661275970ScyAll 2662275970Scy\f\*[I-Font]configkeyword\f[] 2663275970Scykeywords can be prefixed with 2664275970Scy\[oq]=\[cq], 2665275970Scy\[oq]+\[cq] 2666275970Scyand 2667275970Scy\[oq]\-\[cq], 2668275970Scywhere 2669275970Scy\[oq]=\[cq] 2670275970Scysets the 2671275970Scy\fCsyslog\fR(3)\f[] 2672275970Scypriority mask, 2673275970Scy\[oq]+\[cq] 2674275970Scyadds and 2675275970Scy\[oq]\-\[cq] 2676275970Scyremoves 2677275970Scymessages. 2678275970Scy\fCsyslog\fR(3)\f[] 2679275970Scymessages can be controlled in four 2680275970Scyclasses 2681275970Scy(\f\*[B-Font]clock\f[], \f\*[B-Font]peer\f[], \f\*[B-Font]sys\f[] and \f\*[B-Font]sync\f[]). 2682275970ScyWithin these classes four types of messages can be 2683275970Scycontrolled: informational messages 2684275970Scy(\f\*[B-Font]info\f[]), 2685275970Scyevent messages 2686275970Scy(\f\*[B-Font]events\f[]), 2687275970Scystatistics messages 2688275970Scy(\f\*[B-Font]statistics\f[]) 2689275970Scyand 2690275970Scystatus messages 2691275970Scy(\f\*[B-Font]status\f[]). 2692275970Scy.sp \n(Ppu 2693275970Scy.ne 2 2694275970Scy 2695275970ScyConfiguration keywords are formed by concatenating the message class with 2696275970Scythe event class. 2697275970ScyThe 2698275970Scy\f\*[B-Font]all\f[] 2699275970Scyprefix can be used instead of a message class. 2700275970ScyA 2701275970Scymessage class may also be followed by the 2702275970Scy\f\*[B-Font]all\f[] 2703275970Scykeyword to enable/disable all 2704275970Scymessages of the respective message class.Thus, a minimal log configuration 2705275970Scycould look like this: 2706275970Scy.br 2707275970Scy.in +4 2708275970Scy.nf 2709275970Scylogconfig =syncstatus +sysevents 2710275970Scy.in -4 2711275970Scy.fi 2712275970Scy.sp \n(Ppu 2713275970Scy.ne 2 2714275970Scy 2715275970ScyThis would just list the synchronizations state of 2716275970Scy\fCntpd\fR(@NTPD_MS@)\f[] 2717275970Scyand the major system events. 2718275970ScyFor a simple reference server, the 2719275970Scyfollowing minimum message configuration could be useful: 2720275970Scy.br 2721275970Scy.in +4 2722275970Scy.nf 2723275970Scylogconfig =syncall +clockall 2724275970Scy.in -4 2725275970Scy.fi 2726275970Scy.sp \n(Ppu 2727275970Scy.ne 2 2728275970Scy 2729275970ScyThis configuration will list all clock information and 2730275970Scysynchronization information. 2731275970ScyAll other events and messages about 2732275970Scypeers, system events and so on is suppressed. 2733275970Scy.TP 7 2734275970Scy.NOP \f\*[B-Font]logfile\f[] \f\*[I-Font]logfile\f[] 2735275970ScyThis command specifies the location of an alternate log file to 2736275970Scybe used instead of the default system 2737275970Scy\fCsyslog\fR(3)\f[] 2738275970Scyfacility. 2739275970ScyThis is the same operation as the \-l command line option. 2740275970Scy.TP 7 2741275970Scy.NOP \f\*[B-Font]setvar\f[] \f\*[I-Font]variable\f[] [\f\*[B-Font]default\f[]] 2742275970ScyThis command adds an additional system variable. 2743275970ScyThese 2744275970Scyvariables can be used to distribute additional information such as 2745275970Scythe access policy. 2746275970ScyIf the variable of the form 2747275970Scy\fIname\f[]\fI=\f[]\f\*[I-Font]value\f[] 2748275970Scyis followed by the 2749275970Scy\f\*[B-Font]default\f[] 2750275970Scykeyword, the 2751275970Scyvariable will be listed as part of the default system variables 2752275970Scy(\fCntpq\fR(@NTPQ_MS@)\f[] \f\*[B-Font]rv\f[] command)). 2753275970ScyThese additional variables serve 2754275970Scyinformational purposes only. 2755275970ScyThey are not related to the protocol 2756275970Scyother that they can be listed. 2757275970ScyThe known protocol variables will 2758275970Scyalways override any variables defined via the 2759275970Scy\f\*[B-Font]setvar\f[] 2760275970Scymechanism. 2761275970ScyThere are three special variables that contain the names 2762275970Scyof all variable of the same group. 2763275970ScyThe 2764275970Scy\fIsys_var_list\f[] 2765275970Scyholds 2766275970Scythe names of all system variables. 2767275970ScyThe 2768275970Scy\fIpeer_var_list\f[] 2769275970Scyholds 2770275970Scythe names of all peer variables and the 2771275970Scy\fIclock_var_list\f[] 2772275970Scyholds the names of the reference clock variables. 2773275970Scy.TP 7 2774275970Scy.NOP \f\*[B-Font]tinker\f[] [\f\*[B-Font]allan\f[] \f\*[I-Font]allan\f[] | \f\*[B-Font]dispersion\f[] \f\*[I-Font]dispersion\f[] | \f\*[B-Font]freq\f[] \f\*[I-Font]freq\f[] | \f\*[B-Font]huffpuff\f[] \f\*[I-Font]huffpuff\f[] | \f\*[B-Font]panic\f[] \f\*[I-Font]panic\f[] | \f\*[B-Font]step\f[] \f\*[I-Font]srep\f[] | \f\*[B-Font]stepout\f[] \f\*[I-Font]stepout\f[]] 2775275970ScyThis command can be used to alter several system variables in 2776275970Scyvery exceptional circumstances. 2777275970ScyIt should occur in the 2778275970Scyconfiguration file before any other configuration options. 2779275970ScyThe 2780275970Scydefault values of these variables have been carefully optimized for 2781275970Scya wide range of network speeds and reliability expectations. 2782275970ScyIn 2783275970Scygeneral, they interact in intricate ways that are hard to predict 2784275970Scyand some combinations can result in some very nasty behavior. 2785275970ScyVery 2786275970Scyrarely is it necessary to change the default values; but, some 2787275970Scyfolks cannot resist twisting the knobs anyway and this command is 2788275970Scyfor them. 2789275970ScyEmphasis added: twisters are on their own and can expect 2790275970Scyno help from the support group. 2791275970Scy.sp \n(Ppu 2792275970Scy.ne 2 2793275970Scy 2794275970ScyThe variables operate as follows: 2795275970Scy.RS 2796275970Scy.TP 7 2797275970Scy.NOP \f\*[B-Font]allan\f[] \f\*[I-Font]allan\f[] 2798275970ScyThe argument becomes the new value for the minimum Allan 2799275970Scyintercept, which is a parameter of the PLL/FLL clock discipline 2800275970Scyalgorithm. 2801275970ScyThe value in log2 seconds defaults to 7 (1024 s), which is also the lower 2802275970Scylimit. 2803275970Scy.TP 7 2804275970Scy.NOP \f\*[B-Font]dispersion\f[] \f\*[I-Font]dispersion\f[] 2805275970ScyThe argument becomes the new value for the dispersion increase rate, 2806275970Scynormally .000015 s/s. 2807275970Scy.TP 7 2808275970Scy.NOP \f\*[B-Font]freq\f[] \f\*[I-Font]freq\f[] 2809275970ScyThe argument becomes the initial value of the frequency offset in 2810275970Scyparts-per-million. 2811275970ScyThis overrides the value in the frequency file, if 2812275970Scypresent, and avoids the initial training state if it is not. 2813275970Scy.TP 7 2814275970Scy.NOP \f\*[B-Font]huffpuff\f[] \f\*[I-Font]huffpuff\f[] 2815275970ScyThe argument becomes the new value for the experimental 2816275970Scyhuff-n'-puff filter span, which determines the most recent interval 2817275970Scythe algorithm will search for a minimum delay. 2818275970ScyThe lower limit is 2819275970Scy900 s (15 m), but a more reasonable value is 7200 (2 hours). 2820275970ScyThere 2821275970Scyis no default, since the filter is not enabled unless this command 2822275970Scyis given. 2823275970Scy.TP 7 2824275970Scy.NOP \f\*[B-Font]panic\f[] \f\*[I-Font]panic\f[] 2825275970ScyThe argument is the panic threshold, normally 1000 s. 2826275970ScyIf set to zero, 2827275970Scythe panic sanity check is disabled and a clock offset of any value will 2828275970Scybe accepted. 2829275970Scy.TP 7 2830275970Scy.NOP \f\*[B-Font]step\f[] \f\*[I-Font]step\f[] 2831275970ScyThe argument is the step threshold, which by default is 0.128 s. 2832275970ScyIt can 2833275970Scybe set to any positive number in seconds. 2834275970ScyIf set to zero, step 2835275970Scyadjustments will never occur. 2836275970ScyNote: The kernel time discipline is 2837275970Scydisabled if the step threshold is set to zero or greater than the 2838275970Scydefault. 2839275970Scy.TP 7 2840275970Scy.NOP \f\*[B-Font]stepout\f[] \f\*[I-Font]stepout\f[] 2841275970ScyThe argument is the stepout timeout, which by default is 900 s. 2842275970ScyIt can 2843275970Scybe set to any positive number in seconds. 2844275970ScyIf set to zero, the stepout 2845275970Scypulses will not be suppressed. 2846275970Scy.RE 2847275970Scy.TP 7 2848275970Scy.NOP \f\*[B-Font]rlimit\f[] [\f\*[B-Font]memlock\f[] \f\*[I-Font]Nmegabytes\f[] | \f\*[B-Font]stacksize\f[] \f\*[I-Font]N4kPages\f[] \f\*[B-Font]filenum\f[] \f\*[I-Font]Nfiledescriptors\f[]] 2849275970Scy.RS 2850275970Scy.TP 7 2851275970Scy.NOP \f\*[B-Font]memlock\f[] \f\*[I-Font]Nmegabytes\f[] 2852275970ScySpecify the number of megabytes of memory that can be allocated. 2853275970ScyProbably only available under Linux, this option is useful 2854275970Scywhen dropping root (the 2855275970Scy\f\*[B-Font]\-i\f[] 2856275970Scyoption). 2857275970ScyThe default is 32 megabytes. Setting this to zero will prevent any attemp to lock memory. 2858275970Scy.TP 7 2859275970Scy.NOP \f\*[B-Font]stacksize\f[] \f\*[I-Font]N4kPages\f[] 2860275970ScySpecifies the maximum size of the process stack on systems with the 2861275970Scy.TP 7 2862275970Scy.NOP \f\*[B-Font]filenum\f[] \f\*[I-Font]Nfiledescriptors\f[] 2863275970ScySpecifies the maximum number of file descriptors ntpd may have open at once. Defaults to the system default. 2864275970Scy\fBmlockall\fR()\f[] 2865275970Scyfunction. 2866275970ScyDefaults to 50 4k pages (200 4k pages in OpenBSD). 2867275970Scy.RE 2868275970Scy.TP 7 2869275970Scy.NOP \f\*[B-Font]trap\f[] \f\*[I-Font]host_address\f[] [\f\*[B-Font]port\f[] \f\*[I-Font]port_number\f[]] [\f\*[B-Font]interface\f[] \f\*[I-Font]interface_address\f[]] 2870275970ScyThis command configures a trap receiver at the given host 2871275970Scyaddress and port number for sending messages with the specified 2872275970Scylocal interface address. 2873275970ScyIf the port number is unspecified, a value 2874275970Scyof 18447 is used. 2875275970ScyIf the interface address is not specified, the 2876275970Scymessage is sent with a source address of the local interface the 2877275970Scymessage is sent through. 2878275970ScyNote that on a multihomed host the 2879275970Scyinterface used may vary from time to time with routing changes. 2880275970Scy.sp \n(Ppu 2881275970Scy.ne 2 2882275970Scy 2883275970ScyThe trap receiver will generally log event messages and other 2884275970Scyinformation from the server in a log file. 2885275970ScyWhile such monitor 2886275970Scyprograms may also request their own trap dynamically, configuring a 2887275970Scytrap receiver will ensure that no messages are lost when the server 2888275970Scyis started. 2889275970Scy.TP 7 2890275970Scy.NOP \f\*[B-Font]hop\f[] \f\*[I-Font]...\f[] 2891275970ScyThis command specifies a list of TTL values in increasing order, up to 8 2892275970Scyvalues can be specified. 2893275970ScyIn manycast mode these values are used in turn in 2894275970Scyan expanding-ring search. 2895275970ScyThe default is eight multiples of 32 starting at 2896275970Scy31. 2897275970Scy.PP 2898275970Scy.SH "OPTIONS" 2899275970Scy.TP 2900275970Scy.NOP \f\*[B-Font]\-\-help\f[] 2901275970ScyDisplay usage information and exit. 2902275970Scy.TP 2903275970Scy.NOP \f\*[B-Font]\-\-more-help\f[] 2904275970ScyPass the extended usage information through a pager. 2905275970Scy.TP 2906275970Scy.NOP \f\*[B-Font]\-\-version\f[] [{\f\*[I-Font]v|c|n\f[]}] 2907275970ScyOutput version of program and exit. The default mode is `v', a simple 2908275970Scyversion. The `c' mode will print copyright information and `n' will 2909275970Scyprint the full copyright notice. 2910275970Scy.PP 2911275970Scy.SH "OPTION PRESETS" 2912275970ScyAny option that is not marked as \fInot presettable\fP may be preset 2913275970Scyby loading values from environment variables named: 2914275970Scy.nf 2915275970Scy \fBNTP_CONF_<option-name>\fP or \fBNTP_CONF\fP 2916275970Scy.fi 2917275970Scy.ad 2918275970Scy.SH "ENVIRONMENT" 2919275970ScySee \fBOPTION PRESETS\fP for configuration environment variables. 2920275970Scy.SH FILES 2921275970Scy.TP 15 2922275970Scy.NOP \fI/etc/ntp.conf\f[] 2923275970Scythe default name of the configuration file 2924275970Scy.br 2925275970Scy.ns 2926275970Scy.TP 15 2927275970Scy.NOP \fIntp.keys\f[] 2928275970Scyprivate MD5 keys 2929275970Scy.br 2930275970Scy.ns 2931275970Scy.TP 15 2932275970Scy.NOP \fIntpkey\f[] 2933275970ScyRSA private key 2934275970Scy.br 2935275970Scy.ns 2936275970Scy.TP 15 2937275970Scy.NOP \fIntpkey_\f[]\f\*[I-Font]host\f[] 2938275970ScyRSA public key 2939275970Scy.br 2940275970Scy.ns 2941275970Scy.TP 15 2942275970Scy.NOP \fIntp_dh\f[] 2943275970ScyDiffie-Hellman agreement parameters 2944275970Scy.PP 2945275970Scy.SH "EXIT STATUS" 2946275970ScyOne of the following exit values will be returned: 2947275970Scy.TP 2948275970Scy.NOP 0 " (EXIT_SUCCESS)" 2949275970ScySuccessful program execution. 2950275970Scy.TP 2951275970Scy.NOP 1 " (EXIT_FAILURE)" 2952275970ScyThe operation failed or the command syntax was not valid. 2953275970Scy.TP 2954275970Scy.NOP 70 " (EX_SOFTWARE)" 2955275970Scylibopts had an internal operational error. Please report 2956275970Scyit to autogen-users@lists.sourceforge.net. Thank you. 2957275970Scy.PP 2958275970Scy.SH "SEE ALSO" 2959275970Scy\fCntpd\fR(@NTPD_MS@)\f[], 2960275970Scy\fCntpdc\fR(@NTPDC_MS@)\f[], 2961275970Scy\fCntpq\fR(@NTPQ_MS@)\f[] 2962275970Scy.sp \n(Ppu 2963275970Scy.ne 2 2964275970Scy 2965275970ScyIn addition to the manual pages provided, 2966275970Scycomprehensive documentation is available on the world wide web 2967275970Scyat 2968275970Scy\f[C]http://www.ntp.org/\f[]. 2969275970ScyA snapshot of this documentation is available in HTML format in 2970275970Scy\fI/usr/share/doc/ntp\f[]. 2971275970ScyDavid L. Mills, 2972275970Scy\fINetwork Time Protocol (Version 4)\fR, 2973275970ScyRFC5905 2974275970Scy.PP 2975275970Scy 2976275970Scy.SH "AUTHORS" 2977275970ScyThe University of Delaware 2978275970Scy.SH "COPYRIGHT" 2979275970ScyCopyright (C) 1970-2014 The University of Delaware all rights reserved. 2980275970ScyThis program is released under the terms of the NTP license, <http://ntp.org/license>. 2981275970Scy.SH BUGS 2982275970ScyThe syntax checking is not picky; some combinations of 2983275970Scyridiculous and even hilarious options and modes may not be 2984275970Scydetected. 2985275970Scy.sp \n(Ppu 2986275970Scy.ne 2 2987275970Scy 2988275970ScyThe 2989275970Scy\fIntpkey_\f[]\f\*[I-Font]host\f[] 2990275970Scyfiles are really digital 2991275970Scycertificates. 2992275970ScyThese should be obtained via secure directory 2993275970Scyservices when they become universally available. 2994275970Scy.sp \n(Ppu 2995275970Scy.ne 2 2996275970Scy 2997275970ScyPlease send bug reports to: http://bugs.ntp.org, bugs@ntp.org 2998275970Scy.SH NOTES 2999275970ScyThis document was derived from FreeBSD. 3000275970Scy.sp \n(Ppu 3001275970Scy.ne 2 3002275970Scy 3003275970ScyThis manual page was \fIAutoGen\fP-erated from the \fBntp.conf\fP 3004275970Scyoption definitions. 3005