1330567Sgordon.Dd February 27 2018 2275970Scy.Dt NTP_CONF 5 File Formats 3275970Scy.Os 4275970Scy.\" EDIT THIS FILE WITH CAUTION (ntp.mdoc) 5275970Scy.\" 6330567Sgordon.\" It has been AutoGen-ed February 27, 2018 at 05:14:42 PM by AutoGen 5.18.5 7275970Scy.\" From the definitions ntp.conf.def 8275970Scy.\" and the template file agmdoc-cmd.tpl 9275970Scy.Sh NAME 10275970Scy.Nm ntp.conf 11275970Scy.Nd Network Time Protocol (NTP) daemon configuration file format 12275970Scy.Sh SYNOPSIS 13275970Scy.Nm 14275970Scy.Op Fl \-option\-name 15275970Scy.Op Fl \-option\-name Ar value 16275970Scy.Pp 17275970ScyAll arguments must be options. 18275970Scy.Pp 19275970Scy.Sh DESCRIPTION 20275970ScyThe 21275970Scy.Nm 22275970Scyconfiguration file is read at initial startup by the 23275970Scy.Xr ntpd @NTPD_MS@ 24275970Scydaemon in order to specify the synchronization sources, 25275970Scymodes and other related information. 26275970ScyUsually, it is installed in the 27275970Scy.Pa /etc 28275970Scydirectory, 29275970Scybut could be installed elsewhere 30275970Scy(see the daemon's 31275970Scy.Fl c 32275970Scycommand line option). 33275970Scy.Pp 34275970ScyThe file format is similar to other 35275970Scy.Ux 36275970Scyconfiguration files. 37275970ScyComments begin with a 38275970Scy.Ql # 39275970Scycharacter and extend to the end of the line; 40275970Scyblank lines are ignored. 41275970ScyConfiguration commands consist of an initial keyword 42275970Scyfollowed by a list of arguments, 43275970Scysome of which may be optional, separated by whitespace. 44275970ScyCommands may not be continued over multiple lines. 45275970ScyArguments may be host names, 46275970Scyhost addresses written in numeric, dotted\-quad form, 47275970Scyintegers, floating point numbers (when specifying times in seconds) 48275970Scyand text strings. 49275970Scy.Pp 50275970ScyThe rest of this page describes the configuration and control options. 51275970ScyThe 52275970Scy.Qq Notes on Configuring NTP and Setting up an NTP Subnet 53275970Scypage 54275970Scy(available as part of the HTML documentation 55275970Scyprovided in 56275970Scy.Pa /usr/share/doc/ntp ) 57275970Scycontains an extended discussion of these options. 58275970ScyIn addition to the discussion of general 59275970Scy.Sx Configuration Options , 60275970Scythere are sections describing the following supported functionality 61275970Scyand the options used to control it: 62275970Scy.Bl -bullet -offset indent 63275970Scy.It 64275970Scy.Sx Authentication Support 65275970Scy.It 66275970Scy.Sx Monitoring Support 67275970Scy.It 68275970Scy.Sx Access Control Support 69275970Scy.It 70275970Scy.Sx Automatic NTP Configuration Options 71275970Scy.It 72275970Scy.Sx Reference Clock Support 73275970Scy.It 74275970Scy.Sx Miscellaneous Options 75275970Scy.El 76275970Scy.Pp 77275970ScyFollowing these is a section describing 78275970Scy.Sx Miscellaneous Options . 79275970ScyWhile there is a rich set of options available, 80275970Scythe only required option is one or more 81275970Scy.Ic pool , 82275970Scy.Ic server , 83275970Scy.Ic peer , 84275970Scy.Ic broadcast 85275970Scyor 86275970Scy.Ic manycastclient 87275970Scycommands. 88275970Scy.Sh Configuration Support 89275970ScyFollowing is a description of the configuration commands in 90275970ScyNTPv4. 91275970ScyThese commands have the same basic functions as in NTPv3 and 92275970Scyin some cases new functions and new arguments. 93275970ScyThere are two 94275970Scyclasses of commands, configuration commands that configure a 95275970Scypersistent association with a remote server or peer or reference 96275970Scyclock, and auxiliary commands that specify environmental variables 97275970Scythat control various related operations. 98275970Scy.Ss Configuration Commands 99275970ScyThe various modes are determined by the command keyword and the 100275970Scytype of the required IP address. 101275970ScyAddresses are classed by type as 102275970Scy(s) a remote server or peer (IPv4 class A, B and C), (b) the 103275970Scybroadcast address of a local interface, (m) a multicast address (IPv4 104275970Scyclass D), or (r) a reference clock address (127.127.x.x). 105275970ScyNote that 106275970Scyonly those options applicable to each command are listed below. 107275970ScyUse 108275970Scyof options not listed may not be caught as an error, but may result 109275970Scyin some weird and even destructive behavior. 110275970Scy.Pp 111275970ScyIf the Basic Socket Interface Extensions for IPv6 (RFC\-2553) 112275970Scyis detected, support for the IPv6 address family is generated 113275970Scyin addition to the default support of the IPv4 address family. 114298770SdelphijIn a few cases, including the 115298770Sdelphij.Cm reslist 116298770Sdelphijbillboard generated 117298770Sdelphijby 118298770Sdelphij.Xr ntpq @NTPQ_MS@ 119298770Sdelphijor 120298770Sdelphij.Xr ntpdc @NTPDC_MS@ , 121298770SdelphijIPv6 addresses are automatically generated. 122275970ScyIPv6 addresses can be identified by the presence of colons 123275970Scy.Dq \&: 124275970Scyin the address field. 125275970ScyIPv6 addresses can be used almost everywhere where 126275970ScyIPv4 addresses can be used, 127275970Scywith the exception of reference clock addresses, 128275970Scywhich are always IPv4. 129275970Scy.Pp 130275970ScyNote that in contexts where a host name is expected, a 131275970Scy.Fl 4 132275970Scyqualifier preceding 133275970Scythe host name forces DNS resolution to the IPv4 namespace, 134275970Scywhile a 135275970Scy.Fl 6 136275970Scyqualifier forces DNS resolution to the IPv6 namespace. 137275970ScySee IPv6 references for the 138275970Scyequivalent classes for that address family. 139275970Scy.Bl -tag -width indent 140275970Scy.It Xo Ic pool Ar address 141275970Scy.Op Cm burst 142275970Scy.Op Cm iburst 143275970Scy.Op Cm version Ar version 144275970Scy.Op Cm prefer 145275970Scy.Op Cm minpoll Ar minpoll 146275970Scy.Op Cm maxpoll Ar maxpoll 147275970Scy.Xc 148275970Scy.It Xo Ic server Ar address 149275970Scy.Op Cm key Ar key \&| Cm autokey 150275970Scy.Op Cm burst 151275970Scy.Op Cm iburst 152275970Scy.Op Cm version Ar version 153275970Scy.Op Cm prefer 154275970Scy.Op Cm minpoll Ar minpoll 155275970Scy.Op Cm maxpoll Ar maxpoll 156298770Sdelphij.Op Cm true 157275970Scy.Xc 158275970Scy.It Xo Ic peer Ar address 159275970Scy.Op Cm key Ar key \&| Cm autokey 160275970Scy.Op Cm version Ar version 161275970Scy.Op Cm prefer 162275970Scy.Op Cm minpoll Ar minpoll 163275970Scy.Op Cm maxpoll Ar maxpoll 164298770Sdelphij.Op Cm true 165298770Sdelphij.Op Cm xleave 166275970Scy.Xc 167275970Scy.It Xo Ic broadcast Ar address 168275970Scy.Op Cm key Ar key \&| Cm autokey 169275970Scy.Op Cm version Ar version 170275970Scy.Op Cm prefer 171275970Scy.Op Cm minpoll Ar minpoll 172275970Scy.Op Cm ttl Ar ttl 173298770Sdelphij.Op Cm xleave 174275970Scy.Xc 175275970Scy.It Xo Ic manycastclient Ar address 176275970Scy.Op Cm key Ar key \&| Cm autokey 177275970Scy.Op Cm version Ar version 178275970Scy.Op Cm prefer 179275970Scy.Op Cm minpoll Ar minpoll 180275970Scy.Op Cm maxpoll Ar maxpoll 181275970Scy.Op Cm ttl Ar ttl 182275970Scy.Xc 183275970Scy.El 184275970Scy.Pp 185275970ScyThese five commands specify the time server name or address to 186275970Scybe used and the mode in which to operate. 187275970ScyThe 188275970Scy.Ar address 189275970Scycan be 190275970Scyeither a DNS name or an IP address in dotted\-quad notation. 191275970ScyAdditional information on association behavior can be found in the 192275970Scy.Qq Association Management 193275970Scypage 194275970Scy(available as part of the HTML documentation 195275970Scyprovided in 196275970Scy.Pa /usr/share/doc/ntp ) . 197275970Scy.Bl -tag -width indent 198275970Scy.It Ic pool 199275970ScyFor type s addresses, this command mobilizes a persistent 200275970Scyclient mode association with a number of remote servers. 201275970ScyIn this mode the local clock can synchronized to the 202275970Scyremote server, but the remote server can never be synchronized to 203275970Scythe local clock. 204275970Scy.It Ic server 205275970ScyFor type s and r addresses, this command mobilizes a persistent 206275970Scyclient mode association with the specified remote server or local 207275970Scyradio clock. 208275970ScyIn this mode the local clock can synchronized to the 209275970Scyremote server, but the remote server can never be synchronized to 210275970Scythe local clock. 211275970ScyThis command should 212275970Scy.Em not 213275970Scybe used for type 214275970Scyb or m addresses. 215275970Scy.It Ic peer 216275970ScyFor type s addresses (only), this command mobilizes a 217275970Scypersistent symmetric\-active mode association with the specified 218275970Scyremote peer. 219275970ScyIn this mode the local clock can be synchronized to 220275970Scythe remote peer or the remote peer can be synchronized to the local 221275970Scyclock. 222275970ScyThis is useful in a network of servers where, depending on 223275970Scyvarious failure scenarios, either the local or remote peer may be 224275970Scythe better source of time. 225275970ScyThis command should NOT be used for type 226275970Scyb, m or r addresses. 227275970Scy.It Ic broadcast 228275970ScyFor type b and m addresses (only), this 229275970Scycommand mobilizes a persistent broadcast mode association. 230275970ScyMultiple 231275970Scycommands can be used to specify multiple local broadcast interfaces 232275970Scy(subnets) and/or multiple multicast groups. 233275970ScyNote that local 234275970Scybroadcast messages go only to the interface associated with the 235275970Scysubnet specified, but multicast messages go to all interfaces. 236275970ScyIn broadcast mode the local server sends periodic broadcast 237275970Scymessages to a client population at the 238275970Scy.Ar address 239275970Scyspecified, which is usually the broadcast address on (one of) the 240275970Scylocal network(s) or a multicast address assigned to NTP. 241275970ScyThe IANA 242275970Scyhas assigned the multicast group address IPv4 224.0.1.1 and 243275970ScyIPv6 ff05::101 (site local) exclusively to 244275970ScyNTP, but other nonconflicting addresses can be used to contain the 245275970Scymessages within administrative boundaries. 246275970ScyOrdinarily, this 247275970Scyspecification applies only to the local server operating as a 248275970Scysender; for operation as a broadcast client, see the 249275970Scy.Ic broadcastclient 250275970Scyor 251275970Scy.Ic multicastclient 252275970Scycommands 253275970Scybelow. 254275970Scy.It Ic manycastclient 255275970ScyFor type m addresses (only), this command mobilizes a 256275970Scymanycast client mode association for the multicast address 257275970Scyspecified. 258275970ScyIn this case a specific address must be supplied which 259275970Scymatches the address used on the 260275970Scy.Ic manycastserver 261275970Scycommand for 262275970Scythe designated manycast servers. 263275970ScyThe NTP multicast address 264275970Scy224.0.1.1 assigned by the IANA should NOT be used, unless specific 265275970Scymeans are taken to avoid spraying large areas of the Internet with 266275970Scythese messages and causing a possibly massive implosion of replies 267275970Scyat the sender. 268275970ScyThe 269275970Scy.Ic manycastserver 270275970Scycommand specifies that the local server 271275970Scyis to operate in client mode with the remote servers that are 272275970Scydiscovered as the result of broadcast/multicast messages. 273275970ScyThe 274275970Scyclient broadcasts a request message to the group address associated 275275970Scywith the specified 276275970Scy.Ar address 277275970Scyand specifically enabled 278275970Scyservers respond to these messages. 279275970ScyThe client selects the servers 280275970Scyproviding the best time and continues as with the 281275970Scy.Ic server 282275970Scycommand. 283275970ScyThe remaining servers are discarded as if never 284275970Scyheard. 285275970Scy.El 286275970Scy.Pp 287275970ScyOptions: 288275970Scy.Bl -tag -width indent 289275970Scy.It Cm autokey 290275970ScyAll packets sent to and received from the server or peer are to 291275970Scyinclude authentication fields encrypted using the autokey scheme 292275970Scydescribed in 293275970Scy.Sx Authentication Options . 294275970Scy.It Cm burst 295275970Scywhen the server is reachable, send a burst of eight packets 296275970Scyinstead of the usual one. 297275970ScyThe packet spacing is normally 2 s; 298275970Scyhowever, the spacing between the first and second packets 299298770Sdelphijcan be changed with the 300298770Sdelphij.Ic calldelay 301298770Sdelphijcommand to allow 302275970Scyadditional time for a modem or ISDN call to complete. 303275970ScyThis is designed to improve timekeeping quality 304275970Scywith the 305275970Scy.Ic server 306275970Scycommand and s addresses. 307275970Scy.It Cm iburst 308275970ScyWhen the server is unreachable, send a burst of eight packets 309275970Scyinstead of the usual one. 310275970ScyThe packet spacing is normally 2 s; 311275970Scyhowever, the spacing between the first two packets can be 312298770Sdelphijchanged with the 313298770Sdelphij.Ic calldelay 314298770Sdelphijcommand to allow 315275970Scyadditional time for a modem or ISDN call to complete. 316275970ScyThis is designed to speed the initial synchronization 317275970Scyacquisition with the 318275970Scy.Ic server 319275970Scycommand and s addresses and when 320275970Scy.Xr ntpd @NTPD_MS@ 321275970Scyis started with the 322275970Scy.Fl q 323275970Scyoption. 324275970Scy.It Cm key Ar key 325275970ScyAll packets sent to and received from the server or peer are to 326275970Scyinclude authentication fields encrypted using the specified 327275970Scy.Ar key 328275970Scyidentifier with values from 1 to 65534, inclusive. 329275970ScyThe 330275970Scydefault is to include no encryption field. 331275970Scy.It Cm minpoll Ar minpoll 332275970Scy.It Cm maxpoll Ar maxpoll 333275970ScyThese options specify the minimum and maximum poll intervals 334275970Scyfor NTP messages, as a power of 2 in seconds 335275970ScyThe maximum poll 336275970Scyinterval defaults to 10 (1,024 s), but can be increased by the 337275970Scy.Cm maxpoll 338275970Scyoption to an upper limit of 17 (36.4 h). 339275970ScyThe 340275970Scyminimum poll interval defaults to 6 (64 s), but can be decreased by 341275970Scythe 342275970Scy.Cm minpoll 343275970Scyoption to a lower limit of 4 (16 s). 344275970Scy.It Cm noselect 345275970ScyMarks the server as unused, except for display purposes. 346275970ScyThe server is discarded by the selection algroithm. 347298770Sdelphij.It Cm preempt 348298770SdelphijSays the association can be preempted. 349298770Sdelphij.It Cm true 350298770SdelphijMarks the server as a truechimer. 351298770SdelphijUse this option only for testing. 352275970Scy.It Cm prefer 353275970ScyMarks the server as preferred. 354275970ScyAll other things being equal, 355275970Scythis host will be chosen for synchronization among a set of 356275970Scycorrectly operating hosts. 357275970ScySee the 358275970Scy.Qq Mitigation Rules and the prefer Keyword 359275970Scypage 360275970Scy(available as part of the HTML documentation 361275970Scyprovided in 362275970Scy.Pa /usr/share/doc/ntp ) 363275970Scyfor further information. 364298770Sdelphij.It Cm true 365298770SdelphijForces the association to always survive the selection and clustering algorithms. 366298770SdelphijThis option should almost certainly 367298770Sdelphij.Em only 368298770Sdelphijbe used while testing an association. 369275970Scy.It Cm ttl Ar ttl 370275970ScyThis option is used only with broadcast server and manycast 371275970Scyclient modes. 372275970ScyIt specifies the time\-to\-live 373275970Scy.Ar ttl 374275970Scyto 375275970Scyuse on broadcast server and multicast server and the maximum 376275970Scy.Ar ttl 377275970Scyfor the expanding ring search with manycast 378275970Scyclient packets. 379275970ScySelection of the proper value, which defaults to 380275970Scy127, is something of a black art and should be coordinated with the 381275970Scynetwork administrator. 382275970Scy.It Cm version Ar version 383275970ScySpecifies the version number to be used for outgoing NTP 384275970Scypackets. 385275970ScyVersions 1\-4 are the choices, with version 4 the 386275970Scydefault. 387298770Sdelphij.It Cm xleave 388298770SdelphijValid in 389298770Sdelphij.Cm peer 390298770Sdelphijand 391298770Sdelphij.Cm broadcast 392298770Sdelphijmodes only, this flag enables interleave mode. 393275970Scy.El 394275970Scy.Ss Auxiliary Commands 395275970Scy.Bl -tag -width indent 396275970Scy.It Ic broadcastclient 397275970ScyThis command enables reception of broadcast server messages to 398275970Scyany local interface (type b) address. 399275970ScyUpon receiving a message for 400275970Scythe first time, the broadcast client measures the nominal server 401275970Scypropagation delay using a brief client/server exchange with the 402275970Scyserver, then enters the broadcast client mode, in which it 403275970Scysynchronizes to succeeding broadcast messages. 404275970ScyNote that, in order 405275970Scyto avoid accidental or malicious disruption in this mode, both the 406275970Scyserver and client should operate using symmetric\-key or public\-key 407275970Scyauthentication as described in 408275970Scy.Sx Authentication Options . 409275970Scy.It Ic manycastserver Ar address ... 410275970ScyThis command enables reception of manycast client messages to 411275970Scythe multicast group address(es) (type m) specified. 412275970ScyAt least one 413275970Scyaddress is required, but the NTP multicast address 224.0.1.1 414275970Scyassigned by the IANA should NOT be used, unless specific means are 415275970Scytaken to limit the span of the reply and avoid a possibly massive 416275970Scyimplosion at the original sender. 417275970ScyNote that, in order to avoid 418275970Scyaccidental or malicious disruption in this mode, both the server 419275970Scyand client should operate using symmetric\-key or public\-key 420275970Scyauthentication as described in 421275970Scy.Sx Authentication Options . 422275970Scy.It Ic multicastclient Ar address ... 423275970ScyThis command enables reception of multicast server messages to 424275970Scythe multicast group address(es) (type m) specified. 425275970ScyUpon receiving 426275970Scya message for the first time, the multicast client measures the 427275970Scynominal server propagation delay using a brief client/server 428275970Scyexchange with the server, then enters the broadcast client mode, in 429275970Scywhich it synchronizes to succeeding multicast messages. 430275970ScyNote that, 431275970Scyin order to avoid accidental or malicious disruption in this mode, 432275970Scyboth the server and client should operate using symmetric\-key or 433275970Scypublic\-key authentication as described in 434275970Scy.Sx Authentication Options . 435280849Scy.It Ic mdnstries Ar number 436280849ScyIf we are participating in mDNS, 437280849Scyafter we have synched for the first time 438280849Scywe attempt to register with the mDNS system. 439280849ScyIf that registration attempt fails, 440280849Scywe try again at one minute intervals for up to 441280849Scy.Ic mdnstries 442280849Scytimes. 443280849ScyAfter all, 444280849Scy.Ic ntpd 445280849Scymay be starting before mDNS. 446280849ScyThe default value for 447280849Scy.Ic mdnstries 448280849Scyis 5. 449275970Scy.El 450275970Scy.Sh Authentication Support 451275970ScyAuthentication support allows the NTP client to verify that the 452275970Scyserver is in fact known and trusted and not an intruder intending 453275970Scyaccidentally or on purpose to masquerade as that server. 454275970ScyThe NTPv3 455275970Scyspecification RFC\-1305 defines a scheme which provides 456275970Scycryptographic authentication of received NTP packets. 457275970ScyOriginally, 458275970Scythis was done using the Data Encryption Standard (DES) algorithm 459275970Scyoperating in Cipher Block Chaining (CBC) mode, commonly called 460275970ScyDES\-CBC. 461275970ScySubsequently, this was replaced by the RSA Message Digest 462275970Scy5 (MD5) algorithm using a private key, commonly called keyed\-MD5. 463275970ScyEither algorithm computes a message digest, or one\-way hash, which 464275970Scycan be used to verify the server has the correct private key and 465275970Scykey identifier. 466275970Scy.Pp 467275970ScyNTPv4 retains the NTPv3 scheme, properly described as symmetric key 468275970Scycryptography and, in addition, provides a new Autokey scheme 469275970Scybased on public key cryptography. 470275970ScyPublic key cryptography is generally considered more secure 471275970Scythan symmetric key cryptography, since the security is based 472275970Scyon a private value which is generated by each server and 473275970Scynever revealed. 474275970ScyWith Autokey all key distribution and 475275970Scymanagement functions involve only public values, which 476275970Scyconsiderably simplifies key distribution and storage. 477275970ScyPublic key management is based on X.509 certificates, 478275970Scywhich can be provided by commercial services or 479275970Scyproduced by utility programs in the OpenSSL software library 480275970Scyor the NTPv4 distribution. 481275970Scy.Pp 482275970ScyWhile the algorithms for symmetric key cryptography are 483275970Scyincluded in the NTPv4 distribution, public key cryptography 484275970Scyrequires the OpenSSL software library to be installed 485275970Scybefore building the NTP distribution. 486275970ScyDirections for doing that 487275970Scyare on the Building and Installing the Distribution page. 488275970Scy.Pp 489275970ScyAuthentication is configured separately for each association 490275970Scyusing the 491275970Scy.Cm key 492275970Scyor 493275970Scy.Cm autokey 494275970Scysubcommand on the 495275970Scy.Ic peer , 496275970Scy.Ic server , 497275970Scy.Ic broadcast 498275970Scyand 499275970Scy.Ic manycastclient 500275970Scyconfiguration commands as described in 501275970Scy.Sx Configuration Options 502275970Scypage. 503275970ScyThe authentication 504275970Scyoptions described below specify the locations of the key files, 505275970Scyif other than default, which symmetric keys are trusted 506275970Scyand the interval between various operations, if other than default. 507275970Scy.Pp 508275970ScyAuthentication is always enabled, 509275970Scyalthough ineffective if not configured as 510275970Scydescribed below. 511275970ScyIf a NTP packet arrives 512275970Scyincluding a message authentication 513275970Scycode (MAC), it is accepted only if it 514275970Scypasses all cryptographic checks. 515275970ScyThe 516275970Scychecks require correct key ID, key value 517275970Scyand message digest. 518275970ScyIf the packet has 519275970Scybeen modified in any way or replayed 520275970Scyby an intruder, it will fail one or more 521275970Scyof these checks and be discarded. 522275970ScyFurthermore, the Autokey scheme requires a 523275970Scypreliminary protocol exchange to obtain 524275970Scythe server certificate, verify its 525275970Scycredentials and initialize the protocol 526275970Scy.Pp 527275970ScyThe 528275970Scy.Cm auth 529275970Scyflag controls whether new associations or 530275970Scyremote configuration commands require cryptographic authentication. 531275970ScyThis flag can be set or reset by the 532275970Scy.Ic enable 533275970Scyand 534275970Scy.Ic disable 535275970Scycommands and also by remote 536275970Scyconfiguration commands sent by a 537275970Scy.Xr ntpdc @NTPDC_MS@ 538298770Sdelphijprogram running on 539275970Scyanother machine. 540275970ScyIf this flag is enabled, which is the default 541275970Scycase, new broadcast client and symmetric passive associations and 542275970Scyremote configuration commands must be cryptographically 543275970Scyauthenticated using either symmetric key or public key cryptography. 544275970ScyIf this 545275970Scyflag is disabled, these operations are effective 546275970Scyeven if not cryptographic 547275970Scyauthenticated. 548275970ScyIt should be understood 549275970Scythat operating with the 550275970Scy.Ic auth 551275970Scyflag disabled invites a significant vulnerability 552275970Scywhere a rogue hacker can 553275970Scymasquerade as a falseticker and seriously 554275970Scydisrupt system timekeeping. 555275970ScyIt is 556275970Scyimportant to note that this flag has no purpose 557275970Scyother than to allow or disallow 558275970Scya new association in response to new broadcast 559275970Scyand symmetric active messages 560275970Scyand remote configuration commands and, in particular, 561275970Scythe flag has no effect on 562275970Scythe authentication process itself. 563275970Scy.Pp 564275970ScyAn attractive alternative where multicast support is available 565275970Scyis manycast mode, in which clients periodically troll 566275970Scyfor servers as described in the 567275970Scy.Sx Automatic NTP Configuration Options 568275970Scypage. 569275970ScyEither symmetric key or public key 570275970Scycryptographic authentication can be used in this mode. 571275970ScyThe principle advantage 572275970Scyof manycast mode is that potential servers need not be 573275970Scyconfigured in advance, 574275970Scysince the client finds them during regular operation, 575275970Scyand the configuration 576275970Scyfiles for all clients can be identical. 577275970Scy.Pp 578275970ScyThe security model and protocol schemes for 579275970Scyboth symmetric key and public key 580275970Scycryptography are summarized below; 581275970Scyfurther details are in the briefings, papers 582275970Scyand reports at the NTP project page linked from 583275970Scy.Li http://www.ntp.org/ . 584275970Scy.Ss Symmetric\-Key Cryptography 585275970ScyThe original RFC\-1305 specification allows any one of possibly 586275970Scy65,534 keys, each distinguished by a 32\-bit key identifier, to 587275970Scyauthenticate an association. 588275970ScyThe servers and clients involved must 589275970Scyagree on the key and key identifier to 590275970Scyauthenticate NTP packets. 591275970ScyKeys and 592275970Scyrelated information are specified in a key 593275970Scyfile, usually called 594275970Scy.Pa ntp.keys , 595275970Scywhich must be distributed and stored using 596275970Scysecure means beyond the scope of the NTP protocol itself. 597275970ScyBesides the keys used 598275970Scyfor ordinary NTP associations, 599275970Scyadditional keys can be used as passwords for the 600275970Scy.Xr ntpq @NTPQ_MS@ 601275970Scyand 602275970Scy.Xr ntpdc @NTPDC_MS@ 603275970Scyutility programs. 604275970Scy.Pp 605275970ScyWhen 606275970Scy.Xr ntpd @NTPD_MS@ 607275970Scyis first started, it reads the key file specified in the 608275970Scy.Ic keys 609275970Scyconfiguration command and installs the keys 610275970Scyin the key cache. 611275970ScyHowever, 612275970Scyindividual keys must be activated with the 613275970Scy.Ic trusted 614275970Scycommand before use. 615275970ScyThis 616275970Scyallows, for instance, the installation of possibly 617275970Scyseveral batches of keys and 618275970Scythen activating or deactivating each batch 619275970Scyremotely using 620275970Scy.Xr ntpdc @NTPDC_MS@ . 621275970ScyThis also provides a revocation capability that can be used 622275970Scyif a key becomes compromised. 623275970ScyThe 624275970Scy.Ic requestkey 625275970Scycommand selects the key used as the password for the 626275970Scy.Xr ntpdc @NTPDC_MS@ 627275970Scyutility, while the 628275970Scy.Ic controlkey 629275970Scycommand selects the key used as the password for the 630275970Scy.Xr ntpq @NTPQ_MS@ 631275970Scyutility. 632275970Scy.Ss Public Key Cryptography 633275970ScyNTPv4 supports the original NTPv3 symmetric key scheme 634275970Scydescribed in RFC\-1305 and in addition the Autokey protocol, 635275970Scywhich is based on public key cryptography. 636275970ScyThe Autokey Version 2 protocol described on the Autokey Protocol 637275970Scypage verifies packet integrity using MD5 message digests 638275970Scyand verifies the source with digital signatures and any of several 639275970Scydigest/signature schemes. 640275970ScyOptional identity schemes described on the Identity Schemes 641275970Scypage and based on cryptographic challenge/response algorithms 642275970Scyare also available. 643275970ScyUsing all of these schemes provides strong security against 644275970Scyreplay with or without modification, spoofing, masquerade 645275970Scyand most forms of clogging attacks. 646275970Scy.\" .Pp 647275970Scy.\" The cryptographic means necessary for all Autokey operations 648275970Scy.\" is provided by the OpenSSL software library. 649275970Scy.\" This library is available from http://www.openssl.org/ 650275970Scy.\" and can be installed using the procedures outlined 651275970Scy.\" in the Building and Installing the Distribution page. 652275970Scy.\" Once installed, 653275970Scy.\" the configure and build 654275970Scy.\" process automatically detects the library and links 655275970Scy.\" the library routines required. 656275970Scy.Pp 657275970ScyThe Autokey protocol has several modes of operation 658275970Scycorresponding to the various NTP modes supported. 659275970ScyMost modes use a special cookie which can be 660275970Scycomputed independently by the client and server, 661275970Scybut encrypted in transmission. 662275970ScyAll modes use in addition a variant of the S\-KEY scheme, 663275970Scyin which a pseudo\-random key list is generated and used 664275970Scyin reverse order. 665275970ScyThese schemes are described along with an executive summary, 666275970Scycurrent status, briefing slides and reading list on the 667275970Scy.Sx Autonomous Authentication 668275970Scypage. 669275970Scy.Pp 670275970ScyThe specific cryptographic environment used by Autokey servers 671275970Scyand clients is determined by a set of files 672275970Scyand soft links generated by the 673275970Scy.Xr ntp\-keygen 1ntpkeygenmdoc 674275970Scyprogram. 675275970ScyThis includes a required host key file, 676275970Scyrequired certificate file and optional sign key file, 677275970Scyleapsecond file and identity scheme files. 678275970ScyThe 679275970Scydigest/signature scheme is specified in the X.509 certificate 680275970Scyalong with the matching sign key. 681275970ScyThere are several schemes 682275970Scyavailable in the OpenSSL software library, each identified 683275970Scyby a specific string such as 684275970Scy.Cm md5WithRSAEncryption , 685275970Scywhich stands for the MD5 message digest with RSA 686275970Scyencryption scheme. 687275970ScyThe current NTP distribution supports 688275970Scyall the schemes in the OpenSSL library, including 689275970Scythose based on RSA and DSA digital signatures. 690275970Scy.Pp 691275970ScyNTP secure groups can be used to define cryptographic compartments 692275970Scyand security hierarchies. 693275970ScyIt is important that every host 694275970Scyin the group be able to construct a certificate trail to one 695275970Scyor more trusted hosts in the same group. 696275970ScyEach group 697275970Scyhost runs the Autokey protocol to obtain the certificates 698275970Scyfor all hosts along the trail to one or more trusted hosts. 699275970ScyThis requires the configuration file in all hosts to be 700275970Scyengineered so that, even under anticipated failure conditions, 701275970Scythe NTP subnet will form such that every group host can find 702275970Scya trail to at least one trusted host. 703275970Scy.Ss Naming and Addressing 704275970ScyIt is important to note that Autokey does not use DNS to 705275970Scyresolve addresses, since DNS can't be completely trusted 706275970Scyuntil the name servers have synchronized clocks. 707275970ScyThe cryptographic name used by Autokey to bind the host identity 708275970Scycredentials and cryptographic values must be independent 709275970Scyof interface, network and any other naming convention. 710275970ScyThe name appears in the host certificate in either or both 711275970Scythe subject and issuer fields, so protection against 712275970ScyDNS compromise is essential. 713275970Scy.Pp 714275970ScyBy convention, the name of an Autokey host is the name returned 715275970Scyby the Unix 716275970Scy.Xr gethostname 2 717275970Scysystem call or equivalent in other systems. 718275970ScyBy the system design 719275970Scymodel, there are no provisions to allow alternate names or aliases. 720275970ScyHowever, this is not to say that DNS aliases, different names 721275970Scyfor each interface, etc., are constrained in any way. 722275970Scy.Pp 723275970ScyIt is also important to note that Autokey verifies authenticity 724275970Scyusing the host name, network address and public keys, 725275970Scyall of which are bound together by the protocol specifically 726275970Scyto deflect masquerade attacks. 727275970ScyFor this reason Autokey 728298770Sdelphijincludes the source and destination IP addresses in message digest 729275970Scycomputations and so the same addresses must be available 730275970Scyat both the server and client. 731275970ScyFor this reason operation 732275970Scywith network address translation schemes is not possible. 733275970ScyThis reflects the intended robust security model where government 734275970Scyand corporate NTP servers are operated outside firewall perimeters. 735275970Scy.Ss Operation 736275970ScyA specific combination of authentication scheme (none, 737275970Scysymmetric key, public key) and identity scheme is called 738275970Scya cryptotype, although not all combinations are compatible. 739275970ScyThere may be management configurations where the clients, 740275970Scyservers and peers may not all support the same cryptotypes. 741275970ScyA secure NTPv4 subnet can be configured in many ways while 742275970Scykeeping in mind the principles explained above and 743275970Scyin this section. 744275970ScyNote however that some cryptotype 745275970Scycombinations may successfully interoperate with each other, 746275970Scybut may not represent good security practice. 747275970Scy.Pp 748275970ScyThe cryptotype of an association is determined at the time 749275970Scyof mobilization, either at configuration time or some time 750275970Scylater when a message of appropriate cryptotype arrives. 751275970ScyWhen mobilized by a 752275970Scy.Ic server 753275970Scyor 754275970Scy.Ic peer 755275970Scyconfiguration command and no 756275970Scy.Ic key 757275970Scyor 758275970Scy.Ic autokey 759275970Scysubcommands are present, the association is not 760275970Scyauthenticated; if the 761275970Scy.Ic key 762275970Scysubcommand is present, the association is authenticated 763275970Scyusing the symmetric key ID specified; if the 764275970Scy.Ic autokey 765275970Scysubcommand is present, the association is authenticated 766275970Scyusing Autokey. 767275970Scy.Pp 768275970ScyWhen multiple identity schemes are supported in the Autokey 769275970Scyprotocol, the first message exchange determines which one is used. 770275970ScyThe client request message contains bits corresponding 771275970Scyto which schemes it has available. 772275970ScyThe server response message 773275970Scycontains bits corresponding to which schemes it has available. 774275970ScyBoth server and client match the received bits with their own 775275970Scyand select a common scheme. 776275970Scy.Pp 777275970ScyFollowing the principle that time is a public value, 778275970Scya server responds to any client packet that matches 779275970Scyits cryptotype capabilities. 780275970ScyThus, a server receiving 781275970Scyan unauthenticated packet will respond with an unauthenticated 782275970Scypacket, while the same server receiving a packet of a cryptotype 783275970Scyit supports will respond with packets of that cryptotype. 784275970ScyHowever, unconfigured broadcast or manycast client 785275970Scyassociations or symmetric passive associations will not be 786275970Scymobilized unless the server supports a cryptotype compatible 787275970Scywith the first packet received. 788275970ScyBy default, unauthenticated associations will not be mobilized 789275970Scyunless overridden in a decidedly dangerous way. 790275970Scy.Pp 791275970ScySome examples may help to reduce confusion. 792275970ScyClient Alice has no specific cryptotype selected. 793275970ScyServer Bob has both a symmetric key file and minimal Autokey files. 794275970ScyAlice's unauthenticated messages arrive at Bob, who replies with 795275970Scyunauthenticated messages. 796275970ScyCathy has a copy of Bob's symmetric 797275970Scykey file and has selected key ID 4 in messages to Bob. 798275970ScyBob verifies the message with his key ID 4. 799275970ScyIf it's the 800275970Scysame key and the message is verified, Bob sends Cathy a reply 801275970Scyauthenticated with that key. 802275970ScyIf verification fails, 803275970ScyBob sends Cathy a thing called a crypto\-NAK, which tells her 804275970Scysomething broke. 805275970ScyShe can see the evidence using the 806275970Scy.Xr ntpq @NTPQ_MS@ 807275970Scyprogram. 808275970Scy.Pp 809275970ScyDenise has rolled her own host key and certificate. 810275970ScyShe also uses one of the identity schemes as Bob. 811275970ScyShe sends the first Autokey message to Bob and they 812275970Scyboth dance the protocol authentication and identity steps. 813275970ScyIf all comes out okay, Denise and Bob continue as described above. 814275970Scy.Pp 815275970ScyIt should be clear from the above that Bob can support 816275970Scyall the girls at the same time, as long as he has compatible 817275970Scyauthentication and identity credentials. 818275970ScyNow, Bob can act just like the girls in his own choice of servers; 819275970Scyhe can run multiple configured associations with multiple different 820275970Scyservers (or the same server, although that might not be useful). 821275970ScyBut, wise security policy might preclude some cryptotype 822275970Scycombinations; for instance, running an identity scheme 823275970Scywith one server and no authentication with another might not be wise. 824275970Scy.Ss Key Management 825275970ScyThe cryptographic values used by the Autokey protocol are 826275970Scyincorporated as a set of files generated by the 827275970Scy.Xr ntp\-keygen 1ntpkeygenmdoc 828275970Scyutility program, including symmetric key, host key and 829275970Scypublic certificate files, as well as sign key, identity parameters 830275970Scyand leapseconds files. 831275970ScyAlternatively, host and sign keys and 832275970Scycertificate files can be generated by the OpenSSL utilities 833275970Scyand certificates can be imported from public certificate 834275970Scyauthorities. 835275970ScyNote that symmetric keys are necessary for the 836275970Scy.Xr ntpq @NTPQ_MS@ 837275970Scyand 838275970Scy.Xr ntpdc @NTPDC_MS@ 839275970Scyutility programs. 840275970ScyThe remaining files are necessary only for the 841275970ScyAutokey protocol. 842275970Scy.Pp 843275970ScyCertificates imported from OpenSSL or public certificate 844275970Scyauthorities have certian limitations. 845275970ScyThe certificate should be in ASN.1 syntax, X.509 Version 3 846275970Scyformat and encoded in PEM, which is the same format 847275970Scyused by OpenSSL. 848275970ScyThe overall length of the certificate encoded 849275970Scyin ASN.1 must not exceed 1024 bytes. 850275970ScyThe subject distinguished 851275970Scyname field (CN) is the fully qualified name of the host 852275970Scyon which it is used; the remaining subject fields are ignored. 853275970ScyThe certificate extension fields must not contain either 854275970Scya subject key identifier or a issuer key identifier field; 855275970Scyhowever, an extended key usage field for a trusted host must 856275970Scycontain the value 857275970Scy.Cm trustRoot ; . 858275970ScyOther extension fields are ignored. 859275970Scy.Ss Authentication Commands 860275970Scy.Bl -tag -width indent 861275970Scy.It Ic autokey Op Ar logsec 862275970ScySpecifies the interval between regenerations of the session key 863275970Scylist used with the Autokey protocol. 864275970ScyNote that the size of the key 865275970Scylist for each association depends on this interval and the current 866275970Scypoll interval. 867275970ScyThe default value is 12 (4096 s or about 1.1 hours). 868275970ScyFor poll intervals above the specified interval, a session key list 869275970Scywith a single entry will be regenerated for every message 870275970Scysent. 871275970Scy.It Ic controlkey Ar key 872275970ScySpecifies the key identifier to use with the 873275970Scy.Xr ntpq @NTPQ_MS@ 874275970Scyutility, which uses the standard 875275970Scyprotocol defined in RFC\-1305. 876275970ScyThe 877275970Scy.Ar key 878275970Scyargument is 879275970Scythe key identifier for a trusted key, where the value can be in the 880275970Scyrange 1 to 65,534, inclusive. 881275970Scy.It Xo Ic crypto 882275970Scy.Op Cm cert Ar file 883275970Scy.Op Cm leap Ar file 884275970Scy.Op Cm randfile Ar file 885275970Scy.Op Cm host Ar file 886275970Scy.Op Cm sign Ar file 887275970Scy.Op Cm gq Ar file 888275970Scy.Op Cm gqpar Ar file 889275970Scy.Op Cm iffpar Ar file 890275970Scy.Op Cm mvpar Ar file 891275970Scy.Op Cm pw Ar password 892275970Scy.Xc 893275970ScyThis command requires the OpenSSL library. 894275970ScyIt activates public key 895275970Scycryptography, selects the message digest and signature 896275970Scyencryption scheme and loads the required private and public 897275970Scyvalues described above. 898275970ScyIf one or more files are left unspecified, 899275970Scythe default names are used as described above. 900275970ScyUnless the complete path and name of the file are specified, the 901275970Scylocation of a file is relative to the keys directory specified 902275970Scyin the 903275970Scy.Ic keysdir 904275970Scycommand or default 905275970Scy.Pa /usr/local/etc . 906275970ScyFollowing are the subcommands: 907275970Scy.Bl -tag -width indent 908275970Scy.It Cm cert Ar file 909275970ScySpecifies the location of the required host public certificate file. 910275970ScyThis overrides the link 911275970Scy.Pa ntpkey_cert_ Ns Ar hostname 912275970Scyin the keys directory. 913275970Scy.It Cm gqpar Ar file 914275970ScySpecifies the location of the optional GQ parameters file. 915275970ScyThis 916275970Scyoverrides the link 917275970Scy.Pa ntpkey_gq_ Ns Ar hostname 918275970Scyin the keys directory. 919275970Scy.It Cm host Ar file 920275970ScySpecifies the location of the required host key file. 921275970ScyThis overrides 922275970Scythe link 923275970Scy.Pa ntpkey_key_ Ns Ar hostname 924275970Scyin the keys directory. 925275970Scy.It Cm iffpar Ar file 926298770SdelphijSpecifies the location of the optional IFF parameters file. 927298770SdelphijThis overrides the link 928275970Scy.Pa ntpkey_iff_ Ns Ar hostname 929275970Scyin the keys directory. 930275970Scy.It Cm leap Ar file 931275970ScySpecifies the location of the optional leapsecond file. 932275970ScyThis overrides the link 933275970Scy.Pa ntpkey_leap 934275970Scyin the keys directory. 935275970Scy.It Cm mvpar Ar file 936275970ScySpecifies the location of the optional MV parameters file. 937298770SdelphijThis overrides the link 938275970Scy.Pa ntpkey_mv_ Ns Ar hostname 939275970Scyin the keys directory. 940275970Scy.It Cm pw Ar password 941275970ScySpecifies the password to decrypt files containing private keys and 942275970Scyidentity parameters. 943275970ScyThis is required only if these files have been 944275970Scyencrypted. 945275970Scy.It Cm randfile Ar file 946275970ScySpecifies the location of the random seed file used by the OpenSSL 947275970Scylibrary. 948275970ScyThe defaults are described in the main text above. 949275970Scy.It Cm sign Ar file 950275970ScySpecifies the location of the optional sign key file. 951275970ScyThis overrides 952275970Scythe link 953275970Scy.Pa ntpkey_sign_ Ns Ar hostname 954275970Scyin the keys directory. 955275970ScyIf this file is 956275970Scynot found, the host key is also the sign key. 957275970Scy.El 958275970Scy.It Ic keys Ar keyfile 959275970ScySpecifies the complete path and location of the MD5 key file 960275970Scycontaining the keys and key identifiers used by 961275970Scy.Xr ntpd @NTPD_MS@ , 962275970Scy.Xr ntpq @NTPQ_MS@ 963275970Scyand 964275970Scy.Xr ntpdc @NTPDC_MS@ 965275970Scywhen operating with symmetric key cryptography. 966275970ScyThis is the same operation as the 967275970Scy.Fl k 968275970Scycommand line option. 969275970Scy.It Ic keysdir Ar path 970275970ScyThis command specifies the default directory path for 971275970Scycryptographic keys, parameters and certificates. 972275970ScyThe default is 973275970Scy.Pa /usr/local/etc/ . 974275970Scy.It Ic requestkey Ar key 975275970ScySpecifies the key identifier to use with the 976275970Scy.Xr ntpdc @NTPDC_MS@ 977275970Scyutility program, which uses a 978275970Scyproprietary protocol specific to this implementation of 979275970Scy.Xr ntpd @NTPD_MS@ . 980275970ScyThe 981275970Scy.Ar key 982275970Scyargument is a key identifier 983275970Scyfor the trusted key, where the value can be in the range 1 to 984275970Scy65,534, inclusive. 985275970Scy.It Ic revoke Ar logsec 986275970ScySpecifies the interval between re\-randomization of certain 987275970Scycryptographic values used by the Autokey scheme, as a power of 2 in 988275970Scyseconds. 989275970ScyThese values need to be updated frequently in order to 990275970Scydeflect brute\-force attacks on the algorithms of the scheme; 991275970Scyhowever, updating some values is a relatively expensive operation. 992275970ScyThe default interval is 16 (65,536 s or about 18 hours). 993275970ScyFor poll 994275970Scyintervals above the specified interval, the values will be updated 995275970Scyfor every message sent. 996275970Scy.It Ic trustedkey Ar key ... 997275970ScySpecifies the key identifiers which are trusted for the 998275970Scypurposes of authenticating peers with symmetric key cryptography, 999275970Scyas well as keys used by the 1000275970Scy.Xr ntpq @NTPQ_MS@ 1001275970Scyand 1002275970Scy.Xr ntpdc @NTPDC_MS@ 1003275970Scyprograms. 1004275970ScyThe authentication procedures require that both the local 1005275970Scyand remote servers share the same key and key identifier for this 1006275970Scypurpose, although different keys can be used with different 1007275970Scyservers. 1008275970ScyThe 1009275970Scy.Ar key 1010275970Scyarguments are 32\-bit unsigned 1011275970Scyintegers with values from 1 to 65,534. 1012275970Scy.El 1013275970Scy.Ss Error Codes 1014275970ScyThe following error codes are reported via the NTP control 1015275970Scyand monitoring protocol trap mechanism. 1016275970Scy.Bl -tag -width indent 1017275970Scy.It 101 1018275970Scy.Pq bad field format or length 1019275970ScyThe packet has invalid version, length or format. 1020275970Scy.It 102 1021275970Scy.Pq bad timestamp 1022275970ScyThe packet timestamp is the same or older than the most recent received. 1023275970ScyThis could be due to a replay or a server clock time step. 1024275970Scy.It 103 1025275970Scy.Pq bad filestamp 1026275970ScyThe packet filestamp is the same or older than the most recent received. 1027275970ScyThis could be due to a replay or a key file generation error. 1028275970Scy.It 104 1029275970Scy.Pq bad or missing public key 1030275970ScyThe public key is missing, has incorrect format or is an unsupported type. 1031275970Scy.It 105 1032275970Scy.Pq unsupported digest type 1033275970ScyThe server requires an unsupported digest/signature scheme. 1034275970Scy.It 106 1035275970Scy.Pq mismatched digest types 1036275970ScyNot used. 1037275970Scy.It 107 1038275970Scy.Pq bad signature length 1039275970ScyThe signature length does not match the current public key. 1040275970Scy.It 108 1041275970Scy.Pq signature not verified 1042275970ScyThe message fails the signature check. 1043275970ScyIt could be bogus or signed by a 1044275970Scydifferent private key. 1045275970Scy.It 109 1046275970Scy.Pq certificate not verified 1047275970ScyThe certificate is invalid or signed with the wrong key. 1048275970Scy.It 110 1049275970Scy.Pq certificate not verified 1050275970ScyThe certificate is not yet valid or has expired or the signature could not 1051275970Scybe verified. 1052275970Scy.It 111 1053275970Scy.Pq bad or missing cookie 1054275970ScyThe cookie is missing, corrupted or bogus. 1055275970Scy.It 112 1056275970Scy.Pq bad or missing leapseconds table 1057275970ScyThe leapseconds table is missing, corrupted or bogus. 1058275970Scy.It 113 1059275970Scy.Pq bad or missing certificate 1060275970ScyThe certificate is missing, corrupted or bogus. 1061275970Scy.It 114 1062275970Scy.Pq bad or missing identity 1063275970ScyThe identity key is missing, corrupt or bogus. 1064275970Scy.El 1065275970Scy.Sh Monitoring Support 1066275970Scy.Xr ntpd @NTPD_MS@ 1067275970Scyincludes a comprehensive monitoring facility suitable 1068275970Scyfor continuous, long term recording of server and client 1069275970Scytimekeeping performance. 1070275970ScySee the 1071275970Scy.Ic statistics 1072275970Scycommand below 1073275970Scyfor a listing and example of each type of statistics currently 1074275970Scysupported. 1075275970ScyStatistic files are managed using file generation sets 1076275970Scyand scripts in the 1077275970Scy.Pa ./scripts 1078298770Sdelphijdirectory of the source code distribution. 1079275970ScyUsing 1080275970Scythese facilities and 1081275970Scy.Ux 1082275970Scy.Xr cron 8 1083275970Scyjobs, the data can be 1084275970Scyautomatically summarized and archived for retrospective analysis. 1085275970Scy.Ss Monitoring Commands 1086275970Scy.Bl -tag -width indent 1087275970Scy.It Ic statistics Ar name ... 1088275970ScyEnables writing of statistics records. 1089275970ScyCurrently, eight kinds of 1090275970Scy.Ar name 1091275970Scystatistics are supported. 1092275970Scy.Bl -tag -width indent 1093275970Scy.It Cm clockstats 1094275970ScyEnables recording of clock driver statistics information. 1095275970ScyEach update 1096275970Scyreceived from a clock driver appends a line of the following form to 1097275970Scythe file generation set named 1098275970Scy.Cm clockstats : 1099275970Scy.Bd -literal 1100275970Scy49213 525.624 127.127.4.1 93 226 00:08:29.606 D 1101275970Scy.Ed 1102275970Scy.Pp 1103275970ScyThe first two fields show the date (Modified Julian Day) and time 1104275970Scy(seconds and fraction past UTC midnight). 1105275970ScyThe next field shows the 1106275970Scyclock address in dotted\-quad notation. 1107275970ScyThe final field shows the last 1108275970Scytimecode received from the clock in decoded ASCII format, where 1109275970Scymeaningful. 1110275970ScyIn some clock drivers a good deal of additional information 1111275970Scycan be gathered and displayed as well. 1112275970ScySee information specific to each 1113275970Scyclock for further details. 1114275970Scy.It Cm cryptostats 1115275970ScyThis option requires the OpenSSL cryptographic software library. 1116275970ScyIt 1117275970Scyenables recording of cryptographic public key protocol information. 1118275970ScyEach message received by the protocol module appends a line of the 1119275970Scyfollowing form to the file generation set named 1120275970Scy.Cm cryptostats : 1121275970Scy.Bd -literal 1122275970Scy49213 525.624 127.127.4.1 message 1123275970Scy.Ed 1124275970Scy.Pp 1125275970ScyThe first two fields show the date (Modified Julian Day) and time 1126275970Scy(seconds and fraction past UTC midnight). 1127275970ScyThe next field shows the peer 1128275970Scyaddress in dotted\-quad notation, The final message field includes the 1129275970Scymessage type and certain ancillary information. 1130275970ScySee the 1131275970Scy.Sx Authentication Options 1132275970Scysection for further information. 1133275970Scy.It Cm loopstats 1134275970ScyEnables recording of loop filter statistics information. 1135275970ScyEach 1136275970Scyupdate of the local clock outputs a line of the following form to 1137275970Scythe file generation set named 1138275970Scy.Cm loopstats : 1139275970Scy.Bd -literal 1140275970Scy50935 75440.031 0.000006019 13.778190 0.000351733 0.0133806 1141275970Scy.Ed 1142275970Scy.Pp 1143275970ScyThe first two fields show the date (Modified Julian Day) and 1144275970Scytime (seconds and fraction past UTC midnight). 1145275970ScyThe next five fields 1146275970Scyshow time offset (seconds), frequency offset (parts per million \- 1147275970ScyPPM), RMS jitter (seconds), Allan deviation (PPM) and clock 1148275970Scydiscipline time constant. 1149275970Scy.It Cm peerstats 1150275970ScyEnables recording of peer statistics information. 1151275970ScyThis includes 1152275970Scystatistics records of all peers of a NTP server and of special 1153275970Scysignals, where present and configured. 1154275970ScyEach valid update appends a 1155275970Scyline of the following form to the current element of a file 1156275970Scygeneration set named 1157275970Scy.Cm peerstats : 1158275970Scy.Bd -literal 1159275970Scy48773 10847.650 127.127.4.1 9714 \-0.001605376 0.000000000 0.001424877 0.000958674 1160275970Scy.Ed 1161275970Scy.Pp 1162275970ScyThe first two fields show the date (Modified Julian Day) and 1163275970Scytime (seconds and fraction past UTC midnight). 1164275970ScyThe next two fields 1165275970Scyshow the peer address in dotted\-quad notation and status, 1166275970Scyrespectively. 1167275970ScyThe status field is encoded in hex in the format 1168275970Scydescribed in Appendix A of the NTP specification RFC 1305. 1169275970ScyThe final four fields show the offset, 1170275970Scydelay, dispersion and RMS jitter, all in seconds. 1171275970Scy.It Cm rawstats 1172275970ScyEnables recording of raw\-timestamp statistics information. 1173275970ScyThis 1174275970Scyincludes statistics records of all peers of a NTP server and of 1175275970Scyspecial signals, where present and configured. 1176275970ScyEach NTP message 1177275970Scyreceived from a peer or clock driver appends a line of the 1178275970Scyfollowing form to the file generation set named 1179275970Scy.Cm rawstats : 1180275970Scy.Bd -literal 1181275970Scy50928 2132.543 128.4.1.1 128.4.1.20 3102453281.584327000 3102453281.58622800031 02453332.540806000 3102453332.541458000 1182275970Scy.Ed 1183275970Scy.Pp 1184275970ScyThe first two fields show the date (Modified Julian Day) and 1185275970Scytime (seconds and fraction past UTC midnight). 1186275970ScyThe next two fields 1187275970Scyshow the remote peer or clock address followed by the local address 1188275970Scyin dotted\-quad notation. 1189275970ScyThe final four fields show the originate, 1190275970Scyreceive, transmit and final NTP timestamps in order. 1191275970ScyThe timestamp 1192275970Scyvalues are as received and before processing by the various data 1193275970Scysmoothing and mitigation algorithms. 1194275970Scy.It Cm sysstats 1195275970ScyEnables recording of ntpd statistics counters on a periodic basis. 1196275970ScyEach 1197275970Scyhour a line of the following form is appended to the file generation 1198275970Scyset named 1199275970Scy.Cm sysstats : 1200275970Scy.Bd -literal 1201275970Scy50928 2132.543 36000 81965 0 9546 56 71793 512 540 10 147 1202275970Scy.Ed 1203275970Scy.Pp 1204275970ScyThe first two fields show the date (Modified Julian Day) and time 1205275970Scy(seconds and fraction past UTC midnight). 1206275970ScyThe remaining ten fields show 1207275970Scythe statistics counter values accumulated since the last generated 1208275970Scyline. 1209275970Scy.Bl -tag -width indent 1210275970Scy.It Time since restart Cm 36000 1211275970ScyTime in hours since the system was last rebooted. 1212275970Scy.It Packets received Cm 81965 1213275970ScyTotal number of packets received. 1214275970Scy.It Packets processed Cm 0 1215275970ScyNumber of packets received in response to previous packets sent 1216275970Scy.It Current version Cm 9546 1217275970ScyNumber of packets matching the current NTP version. 1218275970Scy.It Previous version Cm 56 1219275970ScyNumber of packets matching the previous NTP version. 1220275970Scy.It Bad version Cm 71793 1221275970ScyNumber of packets matching neither NTP version. 1222275970Scy.It Access denied Cm 512 1223275970ScyNumber of packets denied access for any reason. 1224275970Scy.It Bad length or format Cm 540 1225275970ScyNumber of packets with invalid length, format or port number. 1226275970Scy.It Bad authentication Cm 10 1227275970ScyNumber of packets not verified as authentic. 1228275970Scy.It Rate exceeded Cm 147 1229275970ScyNumber of packets discarded due to rate limitation. 1230275970Scy.El 1231275970Scy.It Cm statsdir Ar directory_path 1232275970ScyIndicates the full path of a directory where statistics files 1233275970Scyshould be created (see below). 1234275970ScyThis keyword allows 1235275970Scythe (otherwise constant) 1236275970Scy.Cm filegen 1237275970Scyfilename prefix to be modified for file generation sets, which 1238275970Scyis useful for handling statistics logs. 1239275970Scy.It Cm filegen Ar name Xo 1240275970Scy.Op Cm file Ar filename 1241275970Scy.Op Cm type Ar typename 1242275970Scy.Op Cm link | nolink 1243275970Scy.Op Cm enable | disable 1244275970Scy.Xc 1245275970ScyConfigures setting of generation file set name. 1246275970ScyGeneration 1247275970Scyfile sets provide a means for handling files that are 1248275970Scycontinuously growing during the lifetime of a server. 1249275970ScyServer statistics are a typical example for such files. 1250275970ScyGeneration file sets provide access to a set of files used 1251275970Scyto store the actual data. 1252275970ScyAt any time at most one element 1253275970Scyof the set is being written to. 1254275970ScyThe type given specifies 1255275970Scywhen and how data will be directed to a new element of the set. 1256275970ScyThis way, information stored in elements of a file set 1257275970Scythat are currently unused are available for administrational 1258275970Scyoperations without the risk of disturbing the operation of ntpd. 1259275970Scy(Most important: they can be removed to free space for new data 1260275970Scyproduced.) 1261275970Scy.Pp 1262275970ScyNote that this command can be sent from the 1263275970Scy.Xr ntpdc @NTPDC_MS@ 1264275970Scyprogram running at a remote location. 1265275970Scy.Bl -tag -width indent 1266275970Scy.It Cm name 1267275970ScyThis is the type of the statistics records, as shown in the 1268275970Scy.Cm statistics 1269275970Scycommand. 1270275970Scy.It Cm file Ar filename 1271275970ScyThis is the file name for the statistics records. 1272275970ScyFilenames of set 1273275970Scymembers are built from three concatenated elements 1274275970Scy.Ar Cm prefix , 1275275970Scy.Ar Cm filename 1276275970Scyand 1277275970Scy.Ar Cm suffix : 1278275970Scy.Bl -tag -width indent 1279275970Scy.It Cm prefix 1280275970ScyThis is a constant filename path. 1281275970ScyIt is not subject to 1282275970Scymodifications via the 1283275970Scy.Ar filegen 1284275970Scyoption. 1285275970ScyIt is defined by the 1286275970Scyserver, usually specified as a compile\-time constant. 1287275970ScyIt may, 1288275970Scyhowever, be configurable for individual file generation sets 1289275970Scyvia other commands. 1290275970ScyFor example, the prefix used with 1291275970Scy.Ar loopstats 1292275970Scyand 1293275970Scy.Ar peerstats 1294275970Scygeneration can be configured using the 1295275970Scy.Ar statsdir 1296275970Scyoption explained above. 1297275970Scy.It Cm filename 1298275970ScyThis string is directly concatenated to the prefix mentioned 1299275970Scyabove (no intervening 1300275970Scy.Ql / ) . 1301275970ScyThis can be modified using 1302275970Scythe file argument to the 1303275970Scy.Ar filegen 1304275970Scystatement. 1305275970ScyNo 1306275970Scy.Pa .. 1307275970Scyelements are 1308275970Scyallowed in this component to prevent filenames referring to 1309275970Scyparts outside the filesystem hierarchy denoted by 1310275970Scy.Ar prefix . 1311275970Scy.It Cm suffix 1312275970ScyThis part is reflects individual elements of a file set. 1313275970ScyIt is 1314275970Scygenerated according to the type of a file set. 1315275970Scy.El 1316275970Scy.It Cm type Ar typename 1317275970ScyA file generation set is characterized by its type. 1318275970ScyThe following 1319275970Scytypes are supported: 1320275970Scy.Bl -tag -width indent 1321275970Scy.It Cm none 1322275970ScyThe file set is actually a single plain file. 1323275970Scy.It Cm pid 1324275970ScyOne element of file set is used per incarnation of a ntpd 1325275970Scyserver. 1326275970ScyThis type does not perform any changes to file set 1327275970Scymembers during runtime, however it provides an easy way of 1328275970Scyseparating files belonging to different 1329275970Scy.Xr ntpd @NTPD_MS@ 1330275970Scyserver incarnations. 1331275970ScyThe set member filename is built by appending a 1332275970Scy.Ql \&. 1333275970Scyto concatenated 1334275970Scy.Ar prefix 1335275970Scyand 1336275970Scy.Ar filename 1337275970Scystrings, and 1338275970Scyappending the decimal representation of the process ID of the 1339275970Scy.Xr ntpd @NTPD_MS@ 1340275970Scyserver process. 1341275970Scy.It Cm day 1342275970ScyOne file generation set element is created per day. 1343275970ScyA day is 1344275970Scydefined as the period between 00:00 and 24:00 UTC. 1345275970ScyThe file set 1346275970Scymember suffix consists of a 1347275970Scy.Ql \&. 1348275970Scyand a day specification in 1349275970Scythe form 1350275970Scy.Cm YYYYMMdd . 1351275970Scy.Cm YYYY 1352275970Scyis a 4\-digit year number (e.g., 1992). 1353275970Scy.Cm MM 1354275970Scyis a two digit month number. 1355275970Scy.Cm dd 1356275970Scyis a two digit day number. 1357275970ScyThus, all information written at 10 December 1992 would end up 1358275970Scyin a file named 1359275970Scy.Ar prefix 1360275970Scy.Ar filename Ns .19921210 . 1361275970Scy.It Cm week 1362275970ScyAny file set member contains data related to a certain week of 1363275970Scya year. 1364275970ScyThe term week is defined by computing day\-of\-year 1365275970Scymodulo 7. 1366275970ScyElements of such a file generation set are 1367275970Scydistinguished by appending the following suffix to the file set 1368275970Scyfilename base: A dot, a 4\-digit year number, the letter 1369275970Scy.Cm W , 1370275970Scyand a 2\-digit week number. 1371275970ScyFor example, information from January, 1372275970Scy10th 1992 would end up in a file with suffix 1373275970Scy.No . Ns Ar 1992W1 . 1374275970Scy.It Cm month 1375275970ScyOne generation file set element is generated per month. 1376275970ScyThe 1377275970Scyfile name suffix consists of a dot, a 4\-digit year number, and 1378275970Scya 2\-digit month. 1379275970Scy.It Cm year 1380275970ScyOne generation file element is generated per year. 1381275970ScyThe filename 1382275970Scysuffix consists of a dot and a 4 digit year number. 1383275970Scy.It Cm age 1384275970ScyThis type of file generation sets changes to a new element of 1385275970Scythe file set every 24 hours of server operation. 1386275970ScyThe filename 1387275970Scysuffix consists of a dot, the letter 1388275970Scy.Cm a , 1389275970Scyand an 8\-digit number. 1390275970ScyThis number is taken to be the number of seconds the server is 1391275970Scyrunning at the start of the corresponding 24\-hour period. 1392275970ScyInformation is only written to a file generation by specifying 1393275970Scy.Cm enable ; 1394275970Scyoutput is prevented by specifying 1395275970Scy.Cm disable . 1396275970Scy.El 1397275970Scy.It Cm link | nolink 1398275970ScyIt is convenient to be able to access the current element of a file 1399275970Scygeneration set by a fixed name. 1400275970ScyThis feature is enabled by 1401275970Scyspecifying 1402275970Scy.Cm link 1403275970Scyand disabled using 1404275970Scy.Cm nolink . 1405275970ScyIf link is specified, a 1406275970Scyhard link from the current file set element to a file without 1407275970Scysuffix is created. 1408275970ScyWhen there is already a file with this name and 1409275970Scythe number of links of this file is one, it is renamed appending a 1410275970Scydot, the letter 1411275970Scy.Cm C , 1412298770Sdelphijand the pid of the 1413298770Sdelphij.Xr ntpd @NTPD_MS@ 1414298770Sdelphijserver process. 1415275970ScyWhen the 1416275970Scynumber of links is greater than one, the file is unlinked. 1417275970ScyThis 1418275970Scyallows the current file to be accessed by a constant name. 1419275970Scy.It Cm enable \&| Cm disable 1420275970ScyEnables or disables the recording function. 1421275970Scy.El 1422275970Scy.El 1423275970Scy.El 1424275970Scy.Sh Access Control Support 1425275970ScyThe 1426275970Scy.Xr ntpd @NTPD_MS@ 1427275970Scydaemon implements a general purpose address/mask based restriction 1428275970Scylist. 1429275970ScyThe list contains address/match entries sorted first 1430275970Scyby increasing address values and and then by increasing mask values. 1431275970ScyA match occurs when the bitwise AND of the mask and the packet 1432275970Scysource address is equal to the bitwise AND of the mask and 1433275970Scyaddress in the list. 1434275970ScyThe list is searched in order with the 1435275970Scylast match found defining the restriction flags associated 1436275970Scywith the entry. 1437275970ScyAdditional information and examples can be found in the 1438275970Scy.Qq Notes on Configuring NTP and Setting up a NTP Subnet 1439275970Scypage 1440275970Scy(available as part of the HTML documentation 1441275970Scyprovided in 1442275970Scy.Pa /usr/share/doc/ntp ) . 1443275970Scy.Pp 1444275970ScyThe restriction facility was implemented in conformance 1445275970Scywith the access policies for the original NSFnet backbone 1446275970Scytime servers. 1447275970ScyLater the facility was expanded to deflect 1448275970Scycryptographic and clogging attacks. 1449275970ScyWhile this facility may 1450275970Scybe useful for keeping unwanted or broken or malicious clients 1451275970Scyfrom congesting innocent servers, it should not be considered 1452275970Scyan alternative to the NTP authentication facilities. 1453275970ScySource address based restrictions are easily circumvented 1454275970Scyby a determined cracker. 1455275970Scy.Pp 1456275970ScyClients can be denied service because they are explicitly 1457298770Sdelphijincluded in the restrict list created by the 1458298770Sdelphij.Ic restrict 1459298770Sdelphijcommand 1460275970Scyor implicitly as the result of cryptographic or rate limit 1461275970Scyviolations. 1462275970ScyCryptographic violations include certificate 1463275970Scyor identity verification failure; rate limit violations generally 1464275970Scyresult from defective NTP implementations that send packets 1465275970Scyat abusive rates. 1466275970ScySome violations cause denied service 1467275970Scyonly for the offending packet, others cause denied service 1468275970Scyfor a timed period and others cause the denied service for 1469298770Sdelphijan indefinite period. 1470275970ScyWhen a client or network is denied access 1471298770Sdelphijfor an indefinite period, the only way at present to remove 1472275970Scythe restrictions is by restarting the server. 1473275970Scy.Ss The Kiss\-of\-Death Packet 1474275970ScyOrdinarily, packets denied service are simply dropped with no 1475275970Scyfurther action except incrementing statistics counters. 1476275970ScySometimes a 1477275970Scymore proactive response is needed, such as a server message that 1478275970Scyexplicitly requests the client to stop sending and leave a message 1479275970Scyfor the system operator. 1480275970ScyA special packet format has been created 1481275970Scyfor this purpose called the "kiss\-of\-death" (KoD) packet. 1482275970ScyKoD packets have the leap bits set unsynchronized and stratum set 1483275970Scyto zero and the reference identifier field set to a four\-byte 1484275970ScyASCII code. 1485275970ScyIf the 1486275970Scy.Cm noserve 1487275970Scyor 1488275970Scy.Cm notrust 1489275970Scyflag of the matching restrict list entry is set, 1490275970Scythe code is "DENY"; if the 1491275970Scy.Cm limited 1492275970Scyflag is set and the rate limit 1493275970Scyis exceeded, the code is "RATE". 1494275970ScyFinally, if a cryptographic violation occurs, the code is "CRYP". 1495275970Scy.Pp 1496275970ScyA client receiving a KoD performs a set of sanity checks to 1497275970Scyminimize security exposure, then updates the stratum and 1498275970Scyreference identifier peer variables, sets the access 1499275970Scydenied (TEST4) bit in the peer flash variable and sends 1500275970Scya message to the log. 1501275970ScyAs long as the TEST4 bit is set, 1502275970Scythe client will send no further packets to the server. 1503275970ScyThe only way at present to recover from this condition is 1504275970Scyto restart the protocol at both the client and server. 1505275970ScyThis 1506275970Scyhappens automatically at the client when the association times out. 1507275970ScyIt will happen at the server only if the server operator cooperates. 1508275970Scy.Ss Access Control Commands 1509275970Scy.Bl -tag -width indent 1510275970Scy.It Xo Ic discard 1511275970Scy.Op Cm average Ar avg 1512275970Scy.Op Cm minimum Ar min 1513275970Scy.Op Cm monitor Ar prob 1514275970Scy.Xc 1515275970ScySet the parameters of the 1516275970Scy.Cm limited 1517275970Scyfacility which protects the server from 1518275970Scyclient abuse. 1519275970ScyThe 1520275970Scy.Cm average 1521275970Scysubcommand specifies the minimum average packet 1522275970Scyspacing, while the 1523275970Scy.Cm minimum 1524275970Scysubcommand specifies the minimum packet spacing. 1525275970ScyPackets that violate these minima are discarded 1526275970Scyand a kiss\-o'\-death packet returned if enabled. 1527275970ScyThe default 1528275970Scyminimum average and minimum are 5 and 2, respectively. 1529298770SdelphijThe 1530298770Sdelphij.Ic monitor 1531298770Sdelphijsubcommand specifies the probability of discard 1532275970Scyfor packets that overflow the rate\-control window. 1533275970Scy.It Xo Ic restrict address 1534275970Scy.Op Cm mask Ar mask 1535330567Sgordon.Op Cm ippeerlimit Ar int 1536275970Scy.Op Ar flag ... 1537275970Scy.Xc 1538275970ScyThe 1539275970Scy.Ar address 1540275970Scyargument expressed in 1541275970Scydotted\-quad form is the address of a host or network. 1542275970ScyAlternatively, the 1543275970Scy.Ar address 1544275970Scyargument can be a valid host DNS name. 1545275970ScyThe 1546275970Scy.Ar mask 1547275970Scyargument expressed in dotted\-quad form defaults to 1548275970Scy.Cm 255.255.255.255 , 1549275970Scymeaning that the 1550275970Scy.Ar address 1551275970Scyis treated as the address of an individual host. 1552275970ScyA default entry (address 1553275970Scy.Cm 0.0.0.0 , 1554275970Scymask 1555275970Scy.Cm 0.0.0.0 ) 1556275970Scyis always included and is always the first entry in the list. 1557275970ScyNote that text string 1558275970Scy.Cm default , 1559275970Scywith no mask option, may 1560275970Scybe used to indicate the default entry. 1561330567SgordonThe 1562330567Sgordon.Cm ippeerlimit 1563330567Sgordondirective limits the number of peer requests for each IP to 1564330567Sgordon.Ar int , 1565330567Sgordonwhere a value of \-1 means "unlimited", the current default. 1566330567SgordonA value of 0 means "none". 1567330567SgordonThere would usually be at most 1 peering request per IP, 1568330567Sgordonbut if the remote peering requests are behind a proxy 1569330567Sgordonthere could well be more than 1 per IP. 1570275970ScyIn the current implementation, 1571275970Scy.Cm flag 1572275970Scyalways 1573275970Scyrestricts access, i.e., an entry with no flags indicates that free 1574275970Scyaccess to the server is to be given. 1575275970ScyThe flags are not orthogonal, 1576275970Scyin that more restrictive flags will often make less restrictive 1577275970Scyones redundant. 1578275970ScyThe flags can generally be classed into two 1579275970Scycategories, those which restrict time service and those which 1580275970Scyrestrict informational queries and attempts to do run\-time 1581275970Scyreconfiguration of the server. 1582275970ScyOne or more of the following flags 1583275970Scymay be specified: 1584275970Scy.Bl -tag -width indent 1585275970Scy.It Cm ignore 1586275970ScyDeny packets of all kinds, including 1587275970Scy.Xr ntpq @NTPQ_MS@ 1588275970Scyand 1589275970Scy.Xr ntpdc @NTPDC_MS@ 1590275970Scyqueries. 1591275970Scy.It Cm kod 1592275970ScyIf this flag is set when an access violation occurs, a kiss\-o'\-death 1593275970Scy(KoD) packet is sent. 1594275970ScyKoD packets are rate limited to no more than one 1595275970Scyper second. 1596275970ScyIf another KoD packet occurs within one second after the 1597275970Scylast one, the packet is dropped. 1598275970Scy.It Cm limited 1599275970ScyDeny service if the packet spacing violates the lower limits specified 1600298770Sdelphijin the 1601298770Sdelphij.Ic discard 1602298770Sdelphijcommand. 1603275970ScyA history of clients is kept using the 1604275970Scymonitoring capability of 1605275970Scy.Xr ntpd @NTPD_MS@ . 1606275970ScyThus, monitoring is always active as 1607275970Scylong as there is a restriction entry with the 1608275970Scy.Cm limited 1609275970Scyflag. 1610275970Scy.It Cm lowpriotrap 1611275970ScyDeclare traps set by matching hosts to be low priority. 1612275970ScyThe 1613275970Scynumber of traps a server can maintain is limited (the current limit 1614275970Scyis 3). 1615275970ScyTraps are usually assigned on a first come, first served 1616275970Scybasis, with later trap requestors being denied service. 1617275970ScyThis flag 1618275970Scymodifies the assignment algorithm by allowing low priority traps to 1619275970Scybe overridden by later requests for normal priority traps. 1620330567Sgordon.It Cm noepeer 1621330567SgordonDeny ephemeral peer requests, 1622330567Sgordoneven if they come from an authenticated source. 1623330567SgordonNote that the ability to use a symmetric key for authentication may be restricted to 1624330567Sgordonone or more IPs or subnets via the third field of the 1625330567Sgordon.Pa ntp.keys 1626330567Sgordonfile. 1627330567SgordonThis restriction is not enabled by default, 1628330567Sgordonto maintain backward compatability. 1629330567SgordonExpect 1630330567Sgordon.Cm noepeer 1631330567Sgordonto become the default in ntp\-4.4. 1632275970Scy.It Cm nomodify 1633275970ScyDeny 1634275970Scy.Xr ntpq @NTPQ_MS@ 1635275970Scyand 1636275970Scy.Xr ntpdc @NTPDC_MS@ 1637275970Scyqueries which attempt to modify the state of the 1638275970Scyserver (i.e., run time reconfiguration). 1639275970ScyQueries which return 1640275970Scyinformation are permitted. 1641275970Scy.It Cm noquery 1642275970ScyDeny 1643275970Scy.Xr ntpq @NTPQ_MS@ 1644275970Scyand 1645275970Scy.Xr ntpdc @NTPDC_MS@ 1646275970Scyqueries. 1647275970ScyTime service is not affected. 1648275970Scy.It Cm nopeer 1649330567SgordonDeny unauthenticated packets which would result in mobilizing a new association. 1650330567SgordonThis includes 1651330567Sgordonbroadcast and symmetric active packets 1652330567Sgordonwhen a configured association does not exist. 1653275970ScyIt also includes 1654275970Scy.Cm pool 1655275970Scyassociations, so if you want to use servers from a 1656275970Scy.Cm pool 1657275970Scydirective and also want to use 1658275970Scy.Cm nopeer 1659275970Scyby default, you'll want a 1660330567Sgordon.Cm "restrict source ..." 1661330567Sgordonline as well that does 1662330567Sgordon.Em not 1663275970Scyinclude the 1664275970Scy.Cm nopeer 1665275970Scydirective. 1666275970Scy.It Cm noserve 1667275970ScyDeny all packets except 1668275970Scy.Xr ntpq @NTPQ_MS@ 1669275970Scyand 1670275970Scy.Xr ntpdc @NTPDC_MS@ 1671275970Scyqueries. 1672275970Scy.It Cm notrap 1673275970ScyDecline to provide mode 6 control message trap service to matching 1674275970Scyhosts. 1675298770SdelphijThe trap service is a subsystem of the 1676298770Sdelphij.Xr ntpq @NTPQ_MS@ 1677298770Sdelphijcontrol message 1678275970Scyprotocol which is intended for use by remote event logging programs. 1679275970Scy.It Cm notrust 1680275970ScyDeny service unless the packet is cryptographically authenticated. 1681275970Scy.It Cm ntpport 1682275970ScyThis is actually a match algorithm modifier, rather than a 1683275970Scyrestriction flag. 1684275970ScyIts presence causes the restriction entry to be 1685275970Scymatched only if the source port in the packet is the standard NTP 1686275970ScyUDP port (123). 1687275970ScyBoth 1688275970Scy.Cm ntpport 1689275970Scyand 1690275970Scy.Cm non\-ntpport 1691275970Scymay 1692275970Scybe specified. 1693275970ScyThe 1694275970Scy.Cm ntpport 1695275970Scyis considered more specific and 1696275970Scyis sorted later in the list. 1697275970Scy.It Cm version 1698275970ScyDeny packets that do not match the current NTP version. 1699275970Scy.El 1700275970Scy.Pp 1701275970ScyDefault restriction list entries with the flags ignore, interface, 1702275970Scyntpport, for each of the local host's interface addresses are 1703275970Scyinserted into the table at startup to prevent the server 1704275970Scyfrom attempting to synchronize to its own time. 1705275970ScyA default entry is also always present, though if it is 1706275970Scyotherwise unconfigured; no flags are associated 1707275970Scywith the default entry (i.e., everything besides your own 1708275970ScyNTP server is unrestricted). 1709275970Scy.El 1710275970Scy.Sh Automatic NTP Configuration Options 1711275970Scy.Ss Manycasting 1712275970ScyManycasting is a automatic discovery and configuration paradigm 1713275970Scynew to NTPv4. 1714275970ScyIt is intended as a means for a multicast client 1715275970Scyto troll the nearby network neighborhood to find cooperating 1716275970Scymanycast servers, validate them using cryptographic means 1717275970Scyand evaluate their time values with respect to other servers 1718275970Scythat might be lurking in the vicinity. 1719275970ScyThe intended result is that each manycast client mobilizes 1720275970Scyclient associations with some number of the "best" 1721275970Scyof the nearby manycast servers, yet automatically reconfigures 1722275970Scyto sustain this number of servers should one or another fail. 1723275970Scy.Pp 1724275970ScyNote that the manycasting paradigm does not coincide 1725275970Scywith the anycast paradigm described in RFC\-1546, 1726275970Scywhich is designed to find a single server from a clique 1727275970Scyof servers providing the same service. 1728275970ScyThe manycast paradigm is designed to find a plurality 1729275970Scyof redundant servers satisfying defined optimality criteria. 1730275970Scy.Pp 1731275970ScyManycasting can be used with either symmetric key 1732275970Scyor public key cryptography. 1733275970ScyThe public key infrastructure (PKI) 1734275970Scyoffers the best protection against compromised keys 1735275970Scyand is generally considered stronger, at least with relatively 1736275970Scylarge key sizes. 1737275970ScyIt is implemented using the Autokey protocol and 1738275970Scythe OpenSSL cryptographic library available from 1739275970Scy.Li http://www.openssl.org/ . 1740275970ScyThe library can also be used with other NTPv4 modes 1741275970Scyas well and is highly recommended, especially for broadcast modes. 1742275970Scy.Pp 1743275970ScyA persistent manycast client association is configured 1744298770Sdelphijusing the 1745298770Sdelphij.Ic manycastclient 1746298770Sdelphijcommand, which is similar to the 1747298770Sdelphij.Ic server 1748298770Sdelphijcommand but with a multicast (IPv4 class 1749275970Scy.Cm D 1750275970Scyor IPv6 prefix 1751275970Scy.Cm FF ) 1752275970Scygroup address. 1753275970ScyThe IANA has designated IPv4 address 224.1.1.1 1754275970Scyand IPv6 address FF05::101 (site local) for NTP. 1755275970ScyWhen more servers are needed, it broadcasts manycast 1756275970Scyclient messages to this address at the minimum feasible rate 1757275970Scyand minimum feasible time\-to\-live (TTL) hops, depending 1758275970Scyon how many servers have already been found. 1759275970ScyThere can be as many manycast client associations 1760275970Scyas different group address, each one serving as a template 1761275970Scyfor a future ephemeral unicast client/server association. 1762275970Scy.Pp 1763275970ScyManycast servers configured with the 1764275970Scy.Ic manycastserver 1765275970Scycommand listen on the specified group address for manycast 1766275970Scyclient messages. 1767275970ScyNote the distinction between manycast client, 1768275970Scywhich actively broadcasts messages, and manycast server, 1769275970Scywhich passively responds to them. 1770275970ScyIf a manycast server is 1771275970Scyin scope of the current TTL and is itself synchronized 1772275970Scyto a valid source and operating at a stratum level equal 1773275970Scyto or lower than the manycast client, it replies to the 1774275970Scymanycast client message with an ordinary unicast server message. 1775275970Scy.Pp 1776275970ScyThe manycast client receiving this message mobilizes 1777275970Scyan ephemeral client/server association according to the 1778275970Scymatching manycast client template, but only if cryptographically 1779275970Scyauthenticated and the server stratum is less than or equal 1780275970Scyto the client stratum. 1781275970ScyAuthentication is explicitly required 1782275970Scyand either symmetric key or public key (Autokey) can be used. 1783275970ScyThen, the client polls the server at its unicast address 1784275970Scyin burst mode in order to reliably set the host clock 1785275970Scyand validate the source. 1786275970ScyThis normally results 1787275970Scyin a volley of eight client/server at 2\-s intervals 1788275970Scyduring which both the synchronization and cryptographic 1789275970Scyprotocols run concurrently. 1790275970ScyFollowing the volley, 1791275970Scythe client runs the NTP intersection and clustering 1792275970Scyalgorithms, which act to discard all but the "best" 1793275970Scyassociations according to stratum and synchronization 1794275970Scydistance. 1795275970ScyThe surviving associations then continue 1796275970Scyin ordinary client/server mode. 1797275970Scy.Pp 1798275970ScyThe manycast client polling strategy is designed to reduce 1799275970Scyas much as possible the volume of manycast client messages 1800275970Scyand the effects of implosion due to near\-simultaneous 1801275970Scyarrival of manycast server messages. 1802275970ScyThe strategy is determined by the 1803275970Scy.Ic manycastclient , 1804275970Scy.Ic tos 1805275970Scyand 1806275970Scy.Ic ttl 1807275970Scyconfiguration commands. 1808275970ScyThe manycast poll interval is 1809275970Scynormally eight times the system poll interval, 1810275970Scywhich starts out at the 1811275970Scy.Cm minpoll 1812275970Scyvalue specified in the 1813275970Scy.Ic manycastclient , 1814275970Scycommand and, under normal circumstances, increments to the 1815275970Scy.Cm maxpolll 1816275970Scyvalue specified in this command. 1817275970ScyInitially, the TTL is 1818298770Sdelphijset at the minimum hops specified by the 1819298770Sdelphij.Ic ttl 1820298770Sdelphijcommand. 1821275970ScyAt each retransmission the TTL is increased until reaching 1822275970Scythe maximum hops specified by this command or a sufficient 1823275970Scynumber client associations have been found. 1824275970ScyFurther retransmissions use the same TTL. 1825275970Scy.Pp 1826275970ScyThe quality and reliability of the suite of associations 1827275970Scydiscovered by the manycast client is determined by the NTP 1828275970Scymitigation algorithms and the 1829275970Scy.Cm minclock 1830275970Scyand 1831275970Scy.Cm minsane 1832275970Scyvalues specified in the 1833275970Scy.Ic tos 1834275970Scyconfiguration command. 1835275970ScyAt least 1836275970Scy.Cm minsane 1837275970Scycandidate servers must be available and the mitigation 1838275970Scyalgorithms produce at least 1839275970Scy.Cm minclock 1840275970Scysurvivors in order to synchronize the clock. 1841275970ScyByzantine agreement principles require at least four 1842275970Scycandidates in order to correctly discard a single falseticker. 1843275970ScyFor legacy purposes, 1844275970Scy.Cm minsane 1845275970Scydefaults to 1 and 1846275970Scy.Cm minclock 1847275970Scydefaults to 3. 1848275970ScyFor manycast service 1849275970Scy.Cm minsane 1850275970Scyshould be explicitly set to 4, assuming at least that 1851275970Scynumber of servers are available. 1852275970Scy.Pp 1853275970ScyIf at least 1854275970Scy.Cm minclock 1855275970Scyservers are found, the manycast poll interval is immediately 1856275970Scyset to eight times 1857275970Scy.Cm maxpoll . 1858275970ScyIf less than 1859275970Scy.Cm minclock 1860275970Scyservers are found when the TTL has reached the maximum hops, 1861275970Scythe manycast poll interval is doubled. 1862275970ScyFor each transmission 1863275970Scyafter that, the poll interval is doubled again until 1864275970Scyreaching the maximum of eight times 1865275970Scy.Cm maxpoll . 1866275970ScyFurther transmissions use the same poll interval and 1867275970ScyTTL values. 1868275970ScyNote that while all this is going on, 1869275970Scyeach client/server association found is operating normally 1870275970Scyit the system poll interval. 1871275970Scy.Pp 1872275970ScyAdministratively scoped multicast boundaries are normally 1873275970Scyspecified by the network router configuration and, 1874275970Scyin the case of IPv6, the link/site scope prefix. 1875275970ScyBy default, the increment for TTL hops is 32 starting 1876275970Scyfrom 31; however, the 1877275970Scy.Ic ttl 1878275970Scyconfiguration command can be 1879275970Scyused to modify the values to match the scope rules. 1880275970Scy.Pp 1881275970ScyIt is often useful to narrow the range of acceptable 1882275970Scyservers which can be found by manycast client associations. 1883275970ScyBecause manycast servers respond only when the client 1884275970Scystratum is equal to or greater than the server stratum, 1885275970Scyprimary (stratum 1) servers fill find only primary servers 1886275970Scyin TTL range, which is probably the most common objective. 1887275970ScyHowever, unless configured otherwise, all manycast clients 1888275970Scyin TTL range will eventually find all primary servers 1889275970Scyin TTL range, which is probably not the most common 1890275970Scyobjective in large networks. 1891275970ScyThe 1892275970Scy.Ic tos 1893275970Scycommand can be used to modify this behavior. 1894275970ScyServers with stratum below 1895275970Scy.Cm floor 1896275970Scyor above 1897275970Scy.Cm ceiling 1898275970Scyspecified in the 1899275970Scy.Ic tos 1900275970Scycommand are strongly discouraged during the selection 1901275970Scyprocess; however, these servers may be temporally 1902275970Scyaccepted if the number of servers within TTL range is 1903275970Scyless than 1904275970Scy.Cm minclock . 1905275970Scy.Pp 1906275970ScyThe above actions occur for each manycast client message, 1907275970Scywhich repeats at the designated poll interval. 1908275970ScyHowever, once the ephemeral client association is mobilized, 1909275970Scysubsequent manycast server replies are discarded, 1910275970Scysince that would result in a duplicate association. 1911275970ScyIf during a poll interval the number of client associations 1912275970Scyfalls below 1913275970Scy.Cm minclock , 1914275970Scyall manycast client prototype associations are reset 1915275970Scyto the initial poll interval and TTL hops and operation 1916275970Scyresumes from the beginning. 1917275970ScyIt is important to avoid 1918275970Scyfrequent manycast client messages, since each one requires 1919275970Scyall manycast servers in TTL range to respond. 1920275970ScyThe result could well be an implosion, either minor or major, 1921275970Scydepending on the number of servers in range. 1922275970ScyThe recommended value for 1923275970Scy.Cm maxpoll 1924275970Scyis 12 (4,096 s). 1925275970Scy.Pp 1926275970ScyIt is possible and frequently useful to configure a host 1927275970Scyas both manycast client and manycast server. 1928275970ScyA number of hosts configured this way and sharing a common 1929275970Scygroup address will automatically organize themselves 1930275970Scyin an optimum configuration based on stratum and 1931275970Scysynchronization distance. 1932275970ScyFor example, consider an NTP 1933275970Scysubnet of two primary servers and a hundred or more 1934275970Scydependent clients. 1935275970ScyWith two exceptions, all servers 1936275970Scyand clients have identical configuration files including both 1937275970Scy.Ic multicastclient 1938275970Scyand 1939275970Scy.Ic multicastserver 1940275970Scycommands using, for instance, multicast group address 1941275970Scy239.1.1.1. 1942275970ScyThe only exception is that each primary server 1943275970Scyconfiguration file must include commands for the primary 1944275970Scyreference source such as a GPS receiver. 1945275970Scy.Pp 1946275970ScyThe remaining configuration files for all secondary 1947275970Scyservers and clients have the same contents, except for the 1948275970Scy.Ic tos 1949275970Scycommand, which is specific for each stratum level. 1950275970ScyFor stratum 1 and stratum 2 servers, that command is 1951275970Scynot necessary. 1952275970ScyFor stratum 3 and above servers the 1953275970Scy.Cm floor 1954275970Scyvalue is set to the intended stratum number. 1955275970ScyThus, all stratum 3 configuration files are identical, 1956275970Scyall stratum 4 files are identical and so forth. 1957275970Scy.Pp 1958275970ScyOnce operations have stabilized in this scenario, 1959275970Scythe primary servers will find the primary reference source 1960275970Scyand each other, since they both operate at the same 1961275970Scystratum (1), but not with any secondary server or client, 1962275970Scysince these operate at a higher stratum. 1963275970ScyThe secondary 1964275970Scyservers will find the servers at the same stratum level. 1965275970ScyIf one of the primary servers loses its GPS receiver, 1966275970Scyit will continue to operate as a client and other clients 1967275970Scywill time out the corresponding association and 1968275970Scyre\-associate accordingly. 1969275970Scy.Pp 1970275970ScySome administrators prefer to avoid running 1971275970Scy.Xr ntpd @NTPD_MS@ 1972275970Scycontinuously and run either 1973289997Sglebius.Xr sntp @SNTP_MS@ 1974275970Scyor 1975275970Scy.Xr ntpd @NTPD_MS@ 1976275970Scy.Fl q 1977275970Scyas a cron job. 1978275970ScyIn either case the servers must be 1979275970Scyconfigured in advance and the program fails if none are 1980275970Scyavailable when the cron job runs. 1981275970ScyA really slick 1982275970Scyapplication of manycast is with 1983275970Scy.Xr ntpd @NTPD_MS@ 1984275970Scy.Fl q . 1985275970ScyThe program wakes up, scans the local landscape looking 1986275970Scyfor the usual suspects, selects the best from among 1987275970Scythe rascals, sets the clock and then departs. 1988275970ScyServers do not have to be configured in advance and 1989275970Scyall clients throughout the network can have the same 1990275970Scyconfiguration file. 1991275970Scy.Ss Manycast Interactions with Autokey 1992275970ScyEach time a manycast client sends a client mode packet 1993275970Scyto a multicast group address, all manycast servers 1994275970Scyin scope generate a reply including the host name 1995275970Scyand status word. 1996275970ScyThe manycast clients then run 1997275970Scythe Autokey protocol, which collects and verifies 1998275970Scyall certificates involved. 1999275970ScyFollowing the burst interval 2000275970Scyall but three survivors are cast off, 2001275970Scybut the certificates remain in the local cache. 2002275970ScyIt often happens that several complete signing trails 2003275970Scyfrom the client to the primary servers are collected in this way. 2004275970Scy.Pp 2005275970ScyAbout once an hour or less often if the poll interval 2006275970Scyexceeds this, the client regenerates the Autokey key list. 2007275970ScyThis is in general transparent in client/server mode. 2008275970ScyHowever, about once per day the server private value 2009275970Scyused to generate cookies is refreshed along with all 2010275970Scymanycast client associations. 2011275970ScyIn this case all 2012275970Scycryptographic values including certificates is refreshed. 2013275970ScyIf a new certificate has been generated since 2014275970Scythe last refresh epoch, it will automatically revoke 2015275970Scyall prior certificates that happen to be in the 2016275970Scycertificate cache. 2017275970ScyAt the same time, the manycast 2018275970Scyscheme starts all over from the beginning and 2019275970Scythe expanding ring shrinks to the minimum and increments 2020275970Scyfrom there while collecting all servers in scope. 2021310419Sdelphij.Ss Broadcast Options 2022310419Sdelphij.Bl -tag -width indent 2023310419Sdelphij.It Xo Ic tos 2024310419Sdelphij.Oo 2025310419Sdelphij.Cm bcpollbstep Ar gate 2026310419Sdelphij.Oc 2027310419Sdelphij.Xc 2028310419SdelphijThis command provides a way to delay, 2029310419Sdelphijby the specified number of broadcast poll intervals, 2030310419Sdelphijbelieving backward time steps from a broadcast server. 2031310419SdelphijBroadcast time networks are expected to be trusted. 2032310419SdelphijIn the event a broadcast server's time is stepped backwards, 2033310419Sdelphijthere is clear benefit to having the clients notice this change 2034310419Sdelphijas soon as possible. 2035310419SdelphijAttacks such as replay attacks can happen, however, 2036310419Sdelphijand even though there are a number of protections built in to 2037330567Sgordonbroadcast mode, attempts to perform a replay attack are possible. 2038310419SdelphijThis value defaults to 0, but can be changed 2039310419Sdelphijto any number of poll intervals between 0 and 4. 2040330567Sgordon.El 2041275970Scy.Ss Manycast Options 2042275970Scy.Bl -tag -width indent 2043275970Scy.It Xo Ic tos 2044275970Scy.Oo 2045275970Scy.Cm ceiling Ar ceiling | 2046275970Scy.Cm cohort { 0 | 1 } | 2047275970Scy.Cm floor Ar floor | 2048275970Scy.Cm minclock Ar minclock | 2049275970Scy.Cm minsane Ar minsane 2050275970Scy.Oc 2051275970Scy.Xc 2052275970ScyThis command affects the clock selection and clustering 2053275970Scyalgorithms. 2054275970ScyIt can be used to select the quality and 2055275970Scyquantity of peers used to synchronize the system clock 2056275970Scyand is most useful in manycast mode. 2057275970ScyThe variables operate 2058275970Scyas follows: 2059275970Scy.Bl -tag -width indent 2060275970Scy.It Cm ceiling Ar ceiling 2061275970ScyPeers with strata above 2062275970Scy.Cm ceiling 2063275970Scywill be discarded if there are at least 2064275970Scy.Cm minclock 2065275970Scypeers remaining. 2066275970ScyThis value defaults to 15, but can be changed 2067275970Scyto any number from 1 to 15. 2068275970Scy.It Cm cohort Bro 0 | 1 Brc 2069275970ScyThis is a binary flag which enables (0) or disables (1) 2070275970Scymanycast server replies to manycast clients with the same 2071275970Scystratum level. 2072275970ScyThis is useful to reduce implosions where 2073275970Scylarge numbers of clients with the same stratum level 2074275970Scyare present. 2075275970ScyThe default is to enable these replies. 2076275970Scy.It Cm floor Ar floor 2077275970ScyPeers with strata below 2078275970Scy.Cm floor 2079275970Scywill be discarded if there are at least 2080275970Scy.Cm minclock 2081275970Scypeers remaining. 2082275970ScyThis value defaults to 1, but can be changed 2083275970Scyto any number from 1 to 15. 2084275970Scy.It Cm minclock Ar minclock 2085289997SglebiusThe clustering algorithm repeatedly casts out outlier 2086275970Scyassociations until no more than 2087275970Scy.Cm minclock 2088275970Scyassociations remain. 2089275970ScyThis value defaults to 3, 2090275970Scybut can be changed to any number from 1 to the number of 2091275970Scyconfigured sources. 2092275970Scy.It Cm minsane Ar minsane 2093275970ScyThis is the minimum number of candidates available 2094275970Scyto the clock selection algorithm in order to produce 2095275970Scyone or more truechimers for the clustering algorithm. 2096275970ScyIf fewer than this number are available, the clock is 2097275970Scyundisciplined and allowed to run free. 2098275970ScyThe default is 1 2099275970Scyfor legacy purposes. 2100275970ScyHowever, according to principles of 2101275970ScyByzantine agreement, 2102275970Scy.Cm minsane 2103275970Scyshould be at least 4 in order to detect and discard 2104275970Scya single falseticker. 2105275970Scy.El 2106275970Scy.It Cm ttl Ar hop ... 2107275970ScyThis command specifies a list of TTL values in increasing 2108275970Scyorder, up to 8 values can be specified. 2109275970ScyIn manycast mode these values are used in turn 2110275970Scyin an expanding\-ring search. 2111275970ScyThe default is eight 2112275970Scymultiples of 32 starting at 31. 2113275970Scy.El 2114275970Scy.Sh Reference Clock Support 2115275970ScyThe NTP Version 4 daemon supports some three dozen different radio, 2116275970Scysatellite and modem reference clocks plus a special pseudo\-clock 2117275970Scyused for backup or when no other clock source is available. 2118275970ScyDetailed descriptions of individual device drivers and options can 2119275970Scybe found in the 2120275970Scy.Qq Reference Clock Drivers 2121275970Scypage 2122275970Scy(available as part of the HTML documentation 2123275970Scyprovided in 2124275970Scy.Pa /usr/share/doc/ntp ) . 2125275970ScyAdditional information can be found in the pages linked 2126275970Scythere, including the 2127275970Scy.Qq Debugging Hints for Reference Clock Drivers 2128275970Scyand 2129275970Scy.Qq How To Write a Reference Clock Driver 2130275970Scypages 2131275970Scy(available as part of the HTML documentation 2132275970Scyprovided in 2133275970Scy.Pa /usr/share/doc/ntp ) . 2134275970ScyIn addition, support for a PPS 2135275970Scysignal is available as described in the 2136275970Scy.Qq Pulse\-per\-second (PPS) Signal Interfacing 2137275970Scypage 2138275970Scy(available as part of the HTML documentation 2139275970Scyprovided in 2140275970Scy.Pa /usr/share/doc/ntp ) . 2141275970ScyMany 2142275970Scydrivers support special line discipline/streams modules which can 2143275970Scysignificantly improve the accuracy using the driver. 2144275970ScyThese are 2145275970Scydescribed in the 2146275970Scy.Qq Line Disciplines and Streams Drivers 2147275970Scypage 2148275970Scy(available as part of the HTML documentation 2149275970Scyprovided in 2150275970Scy.Pa /usr/share/doc/ntp ) . 2151275970Scy.Pp 2152275970ScyA reference clock will generally (though not always) be a radio 2153275970Scytimecode receiver which is synchronized to a source of standard 2154275970Scytime such as the services offered by the NRC in Canada and NIST and 2155275970ScyUSNO in the US. 2156275970ScyThe interface between the computer and the timecode 2157275970Scyreceiver is device dependent, but is usually a serial port. 2158275970ScyA 2159275970Scydevice driver specific to each reference clock must be selected and 2160275970Scycompiled in the distribution; however, most common radio, satellite 2161275970Scyand modem clocks are included by default. 2162275970ScyNote that an attempt to 2163275970Scyconfigure a reference clock when the driver has not been compiled 2164275970Scyor the hardware port has not been appropriately configured results 2165275970Scyin a scalding remark to the system log file, but is otherwise non 2166275970Scyhazardous. 2167275970Scy.Pp 2168275970ScyFor the purposes of configuration, 2169275970Scy.Xr ntpd @NTPD_MS@ 2170275970Scytreats 2171275970Scyreference clocks in a manner analogous to normal NTP peers as much 2172275970Scyas possible. 2173275970ScyReference clocks are identified by a syntactically 2174275970Scycorrect but invalid IP address, in order to distinguish them from 2175275970Scynormal NTP peers. 2176275970ScyReference clock addresses are of the form 2177275970Scy.Sm off 2178275970Scy.Li 127.127. Ar t . Ar u , 2179275970Scy.Sm on 2180275970Scywhere 2181275970Scy.Ar t 2182275970Scyis an integer 2183275970Scydenoting the clock type and 2184275970Scy.Ar u 2185275970Scyindicates the unit 2186275970Scynumber in the range 0\-3. 2187275970ScyWhile it may seem overkill, it is in fact 2188275970Scysometimes useful to configure multiple reference clocks of the same 2189275970Scytype, in which case the unit numbers must be unique. 2190275970Scy.Pp 2191275970ScyThe 2192275970Scy.Ic server 2193275970Scycommand is used to configure a reference 2194275970Scyclock, where the 2195275970Scy.Ar address 2196275970Scyargument in that command 2197275970Scyis the clock address. 2198275970ScyThe 2199275970Scy.Cm key , 2200275970Scy.Cm version 2201275970Scyand 2202275970Scy.Cm ttl 2203275970Scyoptions are not used for reference clock support. 2204275970ScyThe 2205275970Scy.Cm mode 2206275970Scyoption is added for reference clock support, as 2207275970Scydescribed below. 2208275970ScyThe 2209275970Scy.Cm prefer 2210275970Scyoption can be useful to 2211275970Scypersuade the server to cherish a reference clock with somewhat more 2212275970Scyenthusiasm than other reference clocks or peers. 2213275970ScyFurther 2214275970Scyinformation on this option can be found in the 2215275970Scy.Qq Mitigation Rules and the prefer Keyword 2216275970Scy(available as part of the HTML documentation 2217275970Scyprovided in 2218275970Scy.Pa /usr/share/doc/ntp ) 2219275970Scypage. 2220275970ScyThe 2221275970Scy.Cm minpoll 2222275970Scyand 2223275970Scy.Cm maxpoll 2224275970Scyoptions have 2225275970Scymeaning only for selected clock drivers. 2226275970ScySee the individual clock 2227275970Scydriver document pages for additional information. 2228275970Scy.Pp 2229275970ScyThe 2230275970Scy.Ic fudge 2231275970Scycommand is used to provide additional 2232275970Scyinformation for individual clock drivers and normally follows 2233275970Scyimmediately after the 2234275970Scy.Ic server 2235275970Scycommand. 2236275970ScyThe 2237275970Scy.Ar address 2238275970Scyargument specifies the clock address. 2239275970ScyThe 2240275970Scy.Cm refid 2241275970Scyand 2242275970Scy.Cm stratum 2243275970Scyoptions can be used to 2244275970Scyoverride the defaults for the device. 2245275970ScyThere are two optional 2246275970Scydevice\-dependent time offsets and four flags that can be included 2247275970Scyin the 2248275970Scy.Ic fudge 2249275970Scycommand as well. 2250275970Scy.Pp 2251275970ScyThe stratum number of a reference clock is by default zero. 2252275970ScySince the 2253275970Scy.Xr ntpd @NTPD_MS@ 2254275970Scydaemon adds one to the stratum of each 2255275970Scypeer, a primary server ordinarily displays an external stratum of 2256275970Scyone. 2257275970ScyIn order to provide engineered backups, it is often useful to 2258275970Scyspecify the reference clock stratum as greater than zero. 2259275970ScyThe 2260275970Scy.Cm stratum 2261275970Scyoption is used for this purpose. 2262275970ScyAlso, in cases 2263275970Scyinvolving both a reference clock and a pulse\-per\-second (PPS) 2264275970Scydiscipline signal, it is useful to specify the reference clock 2265275970Scyidentifier as other than the default, depending on the driver. 2266275970ScyThe 2267275970Scy.Cm refid 2268275970Scyoption is used for this purpose. 2269275970ScyExcept where noted, 2270275970Scythese options apply to all clock drivers. 2271275970Scy.Ss Reference Clock Commands 2272275970Scy.Bl -tag -width indent 2273275970Scy.It Xo Ic server 2274275970Scy.Sm off 2275275970Scy.Li 127.127. Ar t . Ar u 2276275970Scy.Sm on 2277275970Scy.Op Cm prefer 2278275970Scy.Op Cm mode Ar int 2279275970Scy.Op Cm minpoll Ar int 2280275970Scy.Op Cm maxpoll Ar int 2281275970Scy.Xc 2282275970ScyThis command can be used to configure reference clocks in 2283275970Scyspecial ways. 2284275970ScyThe options are interpreted as follows: 2285275970Scy.Bl -tag -width indent 2286275970Scy.It Cm prefer 2287275970ScyMarks the reference clock as preferred. 2288275970ScyAll other things being 2289275970Scyequal, this host will be chosen for synchronization among a set of 2290275970Scycorrectly operating hosts. 2291275970ScySee the 2292275970Scy.Qq Mitigation Rules and the prefer Keyword 2293275970Scypage 2294275970Scy(available as part of the HTML documentation 2295275970Scyprovided in 2296275970Scy.Pa /usr/share/doc/ntp ) 2297275970Scyfor further information. 2298275970Scy.It Cm mode Ar int 2299275970ScySpecifies a mode number which is interpreted in a 2300275970Scydevice\-specific fashion. 2301275970ScyFor instance, it selects a dialing 2302275970Scyprotocol in the ACTS driver and a device subtype in the 2303275970Scyparse 2304275970Scydrivers. 2305275970Scy.It Cm minpoll Ar int 2306275970Scy.It Cm maxpoll Ar int 2307275970ScyThese options specify the minimum and maximum polling interval 2308275970Scyfor reference clock messages, as a power of 2 in seconds 2309275970ScyFor 2310275970Scymost directly connected reference clocks, both 2311275970Scy.Cm minpoll 2312275970Scyand 2313275970Scy.Cm maxpoll 2314275970Scydefault to 6 (64 s). 2315275970ScyFor modem reference clocks, 2316275970Scy.Cm minpoll 2317275970Scydefaults to 10 (17.1 m) and 2318275970Scy.Cm maxpoll 2319275970Scydefaults to 14 (4.5 h). 2320275970ScyThe allowable range is 4 (16 s) to 17 (36.4 h) inclusive. 2321275970Scy.El 2322275970Scy.It Xo Ic fudge 2323275970Scy.Sm off 2324275970Scy.Li 127.127. Ar t . Ar u 2325275970Scy.Sm on 2326275970Scy.Op Cm time1 Ar sec 2327275970Scy.Op Cm time2 Ar sec 2328275970Scy.Op Cm stratum Ar int 2329275970Scy.Op Cm refid Ar string 2330275970Scy.Op Cm mode Ar int 2331275970Scy.Op Cm flag1 Cm 0 \&| Cm 1 2332275970Scy.Op Cm flag2 Cm 0 \&| Cm 1 2333275970Scy.Op Cm flag3 Cm 0 \&| Cm 1 2334275970Scy.Op Cm flag4 Cm 0 \&| Cm 1 2335275970Scy.Xc 2336275970ScyThis command can be used to configure reference clocks in 2337275970Scyspecial ways. 2338275970ScyIt must immediately follow the 2339275970Scy.Ic server 2340275970Scycommand which configures the driver. 2341275970ScyNote that the same capability 2342275970Scyis possible at run time using the 2343275970Scy.Xr ntpdc @NTPDC_MS@ 2344275970Scyprogram. 2345275970ScyThe options are interpreted as 2346275970Scyfollows: 2347275970Scy.Bl -tag -width indent 2348275970Scy.It Cm time1 Ar sec 2349275970ScySpecifies a constant to be added to the time offset produced by 2350275970Scythe driver, a fixed\-point decimal number in seconds. 2351275970ScyThis is used 2352275970Scyas a calibration constant to adjust the nominal time offset of a 2353275970Scyparticular clock to agree with an external standard, such as a 2354275970Scyprecision PPS signal. 2355275970ScyIt also provides a way to correct a 2356275970Scysystematic error or bias due to serial port or operating system 2357275970Scylatencies, different cable lengths or receiver internal delay. 2358275970ScyThe 2359275970Scyspecified offset is in addition to the propagation delay provided 2360275970Scyby other means, such as internal DIPswitches. 2361275970ScyWhere a calibration 2362275970Scyfor an individual system and driver is available, an approximate 2363275970Scycorrection is noted in the driver documentation pages. 2364275970ScyNote: in order to facilitate calibration when more than one 2365275970Scyradio clock or PPS signal is supported, a special calibration 2366275970Scyfeature is available. 2367275970ScyIt takes the form of an argument to the 2368275970Scy.Ic enable 2369275970Scycommand described in 2370275970Scy.Sx Miscellaneous Options 2371275970Scypage and operates as described in the 2372275970Scy.Qq Reference Clock Drivers 2373275970Scypage 2374275970Scy(available as part of the HTML documentation 2375275970Scyprovided in 2376275970Scy.Pa /usr/share/doc/ntp ) . 2377275970Scy.It Cm time2 Ar secs 2378275970ScySpecifies a fixed\-point decimal number in seconds, which is 2379275970Scyinterpreted in a driver\-dependent way. 2380275970ScySee the descriptions of 2381275970Scyspecific drivers in the 2382275970Scy.Qq Reference Clock Drivers 2383275970Scypage 2384275970Scy(available as part of the HTML documentation 2385275970Scyprovided in 2386330567Sgordon.Pa /usr/share/doc/ntp ). 2387275970Scy.It Cm stratum Ar int 2388275970ScySpecifies the stratum number assigned to the driver, an integer 2389275970Scybetween 0 and 15. 2390275970ScyThis number overrides the default stratum number 2391275970Scyordinarily assigned by the driver itself, usually zero. 2392275970Scy.It Cm refid Ar string 2393275970ScySpecifies an ASCII string of from one to four characters which 2394275970Scydefines the reference identifier used by the driver. 2395275970ScyThis string 2396275970Scyoverrides the default identifier ordinarily assigned by the driver 2397275970Scyitself. 2398275970Scy.It Cm mode Ar int 2399275970ScySpecifies a mode number which is interpreted in a 2400275970Scydevice\-specific fashion. 2401275970ScyFor instance, it selects a dialing 2402275970Scyprotocol in the ACTS driver and a device subtype in the 2403275970Scyparse 2404275970Scydrivers. 2405275970Scy.It Cm flag1 Cm 0 \&| Cm 1 2406275970Scy.It Cm flag2 Cm 0 \&| Cm 1 2407275970Scy.It Cm flag3 Cm 0 \&| Cm 1 2408275970Scy.It Cm flag4 Cm 0 \&| Cm 1 2409275970ScyThese four flags are used for customizing the clock driver. 2410275970ScyThe 2411275970Scyinterpretation of these values, and whether they are used at all, 2412275970Scyis a function of the particular clock driver. 2413275970ScyHowever, by 2414275970Scyconvention 2415275970Scy.Cm flag4 2416275970Scyis used to enable recording monitoring 2417275970Scydata to the 2418275970Scy.Cm clockstats 2419275970Scyfile configured with the 2420275970Scy.Ic filegen 2421275970Scycommand. 2422275970ScyFurther information on the 2423275970Scy.Ic filegen 2424275970Scycommand can be found in 2425275970Scy.Sx Monitoring Options . 2426275970Scy.El 2427275970Scy.El 2428275970Scy.Sh Miscellaneous Options 2429275970Scy.Bl -tag -width indent 2430275970Scy.It Ic broadcastdelay Ar seconds 2431275970ScyThe broadcast and multicast modes require a special calibration 2432275970Scyto determine the network delay between the local and remote 2433275970Scyservers. 2434275970ScyOrdinarily, this is done automatically by the initial 2435275970Scyprotocol exchanges between the client and server. 2436275970ScyIn some cases, 2437275970Scythe calibration procedure may fail due to network or server access 2438275970Scycontrols, for example. 2439275970ScyThis command specifies the default delay to 2440275970Scybe used under these circumstances. 2441275970ScyTypically (for Ethernet), a 2442275970Scynumber between 0.003 and 0.007 seconds is appropriate. 2443275970ScyThe default 2444275970Scywhen this command is not used is 0.004 seconds. 2445275970Scy.It Ic calldelay Ar delay 2446275970ScyThis option controls the delay in seconds between the first and second 2447275970Scypackets sent in burst or iburst mode to allow additional time for a modem 2448275970Scyor ISDN call to complete. 2449275970Scy.It Ic driftfile Ar driftfile 2450275970ScyThis command specifies the complete path and name of the file used to 2451275970Scyrecord the frequency of the local clock oscillator. 2452275970ScyThis is the same 2453275970Scyoperation as the 2454275970Scy.Fl f 2455275970Scycommand line option. 2456275970ScyIf the file exists, it is read at 2457275970Scystartup in order to set the initial frequency and then updated once per 2458275970Scyhour with the current frequency computed by the daemon. 2459275970ScyIf the file name is 2460275970Scyspecified, but the file itself does not exist, the starts with an initial 2461275970Scyfrequency of zero and creates the file when writing it for the first time. 2462275970ScyIf this command is not given, the daemon will always start with an initial 2463275970Scyfrequency of zero. 2464275970Scy.Pp 2465275970ScyThe file format consists of a single line containing a single 2466275970Scyfloating point number, which records the frequency offset measured 2467275970Scyin parts\-per\-million (PPM). 2468275970ScyThe file is updated by first writing 2469275970Scythe current drift value into a temporary file and then renaming 2470275970Scythis file to replace the old version. 2471275970ScyThis implies that 2472275970Scy.Xr ntpd @NTPD_MS@ 2473275970Scymust have write permission for the directory the 2474275970Scydrift file is located in, and that file system links, symbolic or 2475275970Scyotherwise, should be avoided. 2476285612Sdelphij.It Ic dscp Ar value 2477285612SdelphijThis option specifies the Differentiated Services Control Point (DSCP) value, 2478298770Sdelphija 6\-bit code. 2479298770SdelphijThe default value is 46, signifying Expedited Forwarding. 2480275970Scy.It Xo Ic enable 2481275970Scy.Oo 2482275970Scy.Cm auth | Cm bclient | 2483275970Scy.Cm calibrate | Cm kernel | 2484294569Sdelphij.Cm mode7 | Cm monitor | 2485294569Sdelphij.Cm ntp | Cm stats | 2486301301Sdelphij.Cm peer_clear_digest_early | 2487294569Sdelphij.Cm unpeer_crypto_early | Cm unpeer_crypto_nak_early | Cm unpeer_digest_early 2488275970Scy.Oc 2489275970Scy.Xc 2490275970Scy.It Xo Ic disable 2491275970Scy.Oo 2492275970Scy.Cm auth | Cm bclient | 2493275970Scy.Cm calibrate | Cm kernel | 2494294569Sdelphij.Cm mode7 | Cm monitor | 2495294569Sdelphij.Cm ntp | Cm stats | 2496301301Sdelphij.Cm peer_clear_digest_early | 2497294569Sdelphij.Cm unpeer_crypto_early | Cm unpeer_crypto_nak_early | Cm unpeer_digest_early 2498275970Scy.Oc 2499275970Scy.Xc 2500275970ScyProvides a way to enable or disable various server options. 2501275970ScyFlags not mentioned are unaffected. 2502275970ScyNote that all of these flags 2503275970Scycan be controlled remotely using the 2504275970Scy.Xr ntpdc @NTPDC_MS@ 2505275970Scyutility program. 2506275970Scy.Bl -tag -width indent 2507275970Scy.It Cm auth 2508275970ScyEnables the server to synchronize with unconfigured peers only if the 2509275970Scypeer has been correctly authenticated using either public key or 2510275970Scyprivate key cryptography. 2511275970ScyThe default for this flag is 2512275970Scy.Ic enable . 2513275970Scy.It Cm bclient 2514275970ScyEnables the server to listen for a message from a broadcast or 2515275970Scymulticast server, as in the 2516275970Scy.Ic multicastclient 2517275970Scycommand with default 2518275970Scyaddress. 2519275970ScyThe default for this flag is 2520275970Scy.Ic disable . 2521275970Scy.It Cm calibrate 2522275970ScyEnables the calibrate feature for reference clocks. 2523275970ScyThe default for 2524275970Scythis flag is 2525275970Scy.Ic disable . 2526275970Scy.It Cm kernel 2527275970ScyEnables the kernel time discipline, if available. 2528275970ScyThe default for this 2529275970Scyflag is 2530275970Scy.Ic enable 2531275970Scyif support is available, otherwise 2532275970Scy.Ic disable . 2533275970Scy.It Cm mode7 2534275970ScyEnables processing of NTP mode 7 implementation\-specific requests 2535275970Scywhich are used by the deprecated 2536275970Scy.Xr ntpdc @NTPDC_MS@ 2537275970Scyprogram. 2538275970ScyThe default for this flag is disable. 2539275970ScyThis flag is excluded from runtime configuration using 2540275970Scy.Xr ntpq @NTPQ_MS@ . 2541275970ScyThe 2542275970Scy.Xr ntpq @NTPQ_MS@ 2543275970Scyprogram provides the same capabilities as 2544275970Scy.Xr ntpdc @NTPDC_MS@ 2545275970Scyusing standard mode 6 requests. 2546275970Scy.It Cm monitor 2547275970ScyEnables the monitoring facility. 2548275970ScySee the 2549275970Scy.Xr ntpdc @NTPDC_MS@ 2550275970Scyprogram 2551275970Scyand the 2552275970Scy.Ic monlist 2553275970Scycommand or further information. 2554275970ScyThe 2555275970Scydefault for this flag is 2556275970Scy.Ic enable . 2557275970Scy.It Cm ntp 2558275970ScyEnables time and frequency discipline. 2559275970ScyIn effect, this switch opens and 2560275970Scycloses the feedback loop, which is useful for testing. 2561275970ScyThe default for 2562275970Scythis flag is 2563275970Scy.Ic enable . 2564301301Sdelphij.It Cm peer_clear_digest_early 2565301301SdelphijBy default, if 2566301301Sdelphij.Xr ntpd @NTPD_MS@ 2567301301Sdelphijis using autokey and it 2568301301Sdelphijreceives a crypto\-NAK packet that 2569301301Sdelphijpasses the duplicate packet and origin timestamp checks 2570301301Sdelphijthe peer variables are immediately cleared. 2571301301SdelphijWhile this is generally a feature 2572301301Sdelphijas it allows for quick recovery if a server key has changed, 2573301301Sdelphija properly forged and appropriately delivered crypto\-NAK packet 2574301301Sdelphijcan be used in a DoS attack. 2575301301SdelphijIf you have active noticable problems with this type of DoS attack 2576301301Sdelphijthen you should consider 2577301301Sdelphijdisabling this option. 2578301301SdelphijYou can check your 2579301301Sdelphij.Cm peerstats 2580301301Sdelphijfile for evidence of any of these attacks. 2581301301SdelphijThe 2582301301Sdelphijdefault for this flag is 2583301301Sdelphij.Ic enable . 2584275970Scy.It Cm stats 2585275970ScyEnables the statistics facility. 2586275970ScySee the 2587275970Scy.Sx Monitoring Options 2588275970Scysection for further information. 2589275970ScyThe default for this flag is 2590275970Scy.Ic disable . 2591294569Sdelphij.It Cm unpeer_crypto_early 2592294569SdelphijBy default, if 2593294569Sdelphij.Xr ntpd @NTPD_MS@ 2594294569Sdelphijreceives an autokey packet that fails TEST9, 2595294569Sdelphija crypto failure, 2596294569Sdelphijthe association is immediately cleared. 2597294569SdelphijThis is almost certainly a feature, 2598294569Sdelphijbut if, in spite of the current recommendation of not using autokey, 2599294569Sdelphijyou are 2600294569Sdelphij.B still 2601294569Sdelphijusing autokey 2602294569Sdelphij.B and 2603294569Sdelphijyou are seeing this sort of DoS attack 2604294569Sdelphijdisabling this flag will delay 2605294569Sdelphijtearing down the association until the reachability counter 2606294569Sdelphijbecomes zero. 2607294569SdelphijYou can check your 2608294569Sdelphij.Cm peerstats 2609294569Sdelphijfile for evidence of any of these attacks. 2610294569SdelphijThe 2611294569Sdelphijdefault for this flag is 2612294569Sdelphij.Ic enable . 2613294569Sdelphij.It Cm unpeer_crypto_nak_early 2614294569SdelphijBy default, if 2615294569Sdelphij.Xr ntpd @NTPD_MS@ 2616294569Sdelphijreceives a crypto\-NAK packet that 2617294569Sdelphijpasses the duplicate packet and origin timestamp checks 2618294569Sdelphijthe association is immediately cleared. 2619294569SdelphijWhile this is generally a feature 2620294569Sdelphijas it allows for quick recovery if a server key has changed, 2621294569Sdelphija properly forged and appropriately delivered crypto\-NAK packet 2622294569Sdelphijcan be used in a DoS attack. 2623294569SdelphijIf you have active noticable problems with this type of DoS attack 2624294569Sdelphijthen you should consider 2625294569Sdelphijdisabling this option. 2626294569SdelphijYou can check your 2627294569Sdelphij.Cm peerstats 2628294569Sdelphijfile for evidence of any of these attacks. 2629294569SdelphijThe 2630294569Sdelphijdefault for this flag is 2631294569Sdelphij.Ic enable . 2632294569Sdelphij.It Cm unpeer_digest_early 2633294569SdelphijBy default, if 2634294569Sdelphij.Xr ntpd @NTPD_MS@ 2635294569Sdelphijreceives what should be an authenticated packet 2636294569Sdelphijthat passes other packet sanity checks but 2637294569Sdelphijcontains an invalid digest 2638294569Sdelphijthe association is immediately cleared. 2639294569SdelphijWhile this is generally a feature 2640294569Sdelphijas it allows for quick recovery, 2641294569Sdelphijif this type of packet is carefully forged and sent 2642294569Sdelphijduring an appropriate window it can be used for a DoS attack. 2643294569SdelphijIf you have active noticable problems with this type of DoS attack 2644294569Sdelphijthen you should consider 2645294569Sdelphijdisabling this option. 2646294569SdelphijYou can check your 2647294569Sdelphij.Cm peerstats 2648294569Sdelphijfile for evidence of any of these attacks. 2649294569SdelphijThe 2650294569Sdelphijdefault for this flag is 2651294569Sdelphij.Ic enable . 2652275970Scy.El 2653275970Scy.It Ic includefile Ar includefile 2654275970ScyThis command allows additional configuration commands 2655275970Scyto be included from a separate file. 2656275970ScyInclude files may 2657275970Scybe nested to a depth of five; upon reaching the end of any 2658275970Scyinclude file, command processing resumes in the previous 2659275970Scyconfiguration file. 2660275970ScyThis option is useful for sites that run 2661275970Scy.Xr ntpd @NTPD_MS@ 2662275970Scyon multiple hosts, with (mostly) common options (e.g., a 2663275970Scyrestriction list). 2664330567Sgordon.It Xo Ic interface 2665330567Sgordon.Oo 2666330567Sgordon.Cm listen | Cm ignore | Cm drop 2667330567Sgordon.Oc 2668330567Sgordon.Oo 2669330567Sgordon.Cm all | Cm ipv4 | Cm ipv6 | Cm wildcard 2670330567Sgordon.Ar name | Ar address 2671330567Sgordon.Oo Cm / Ar prefixlen 2672330567Sgordon.Oc 2673330567Sgordon.Oc 2674330567Sgordon.Xc 2675330567SgordonThe 2676330567Sgordon.Cm interface 2677330567Sgordondirective controls which network addresses 2678330567Sgordon.Xr ntpd @NTPD_MS@ 2679330567Sgordonopens, and whether input is dropped without processing. 2680330567SgordonThe first parameter determines the action for addresses 2681330567Sgordonwhich match the second parameter. 2682330567SgordonThe second parameter specifies a class of addresses, 2683330567Sgordonor a specific interface name, 2684330567Sgordonor an address. 2685330567SgordonIn the address case, 2686330567Sgordon.Ar prefixlen 2687330567Sgordondetermines how many bits must match for this rule to apply. 2688330567Sgordon.Cm ignore 2689330567Sgordonprevents opening matching addresses, 2690330567Sgordon.Cm drop 2691330567Sgordoncauses 2692330567Sgordon.Xr ntpd @NTPD_MS@ 2693330567Sgordonto open the address and drop all received packets without examination. 2694330567SgordonMultiple 2695330567Sgordon.Cm interface 2696330567Sgordondirectives can be used. 2697330567SgordonThe last rule which matches a particular address determines the action for it. 2698330567Sgordon.Cm interface 2699330567Sgordondirectives are disabled if any 2700330567Sgordon.Fl I , 2701330567Sgordon.Fl \-interface , 2702330567Sgordon.Fl L , 2703330567Sgordonor 2704330567Sgordon.Fl \-novirtualips 2705330567Sgordoncommand\-line options are specified in the configuration file, 2706330567Sgordonall available network addresses are opened. 2707330567SgordonThe 2708330567Sgordon.Cm nic 2709330567Sgordondirective is an alias for 2710330567Sgordon.Cm interface . 2711330567Sgordon.It Ic leapfile Ar leapfile 2712330567SgordonThis command loads the IERS leapseconds file and initializes the 2713330567Sgordonleapsecond values for the next leapsecond event, leapfile expiration 2714330567Sgordontime, and TAI offset. 2715330567SgordonThe file can be obtained directly from the IERS at 2716330567Sgordon.Li https://hpiers.obspm.fr/iers/bul/bulc/ntp/leap\-seconds.list 2717330567Sgordonor 2718330567Sgordon.Li ftp://hpiers.obspm.fr/iers/bul/bulc/ntp/leap\-seconds.list . 2719330567SgordonThe 2720330567Sgordon.Cm leapfile 2721330567Sgordonis scanned when 2722330567Sgordon.Xr ntpd @NTPD_MS@ 2723330567Sgordonprocesses the 2724330567Sgordon.Cm leapfile directive or when 2725330567Sgordon.Cm ntpd detects that the 2726330567Sgordon.Ar leapfile 2727330567Sgordonhas changed. 2728330567Sgordon.Cm ntpd 2729330567Sgordonchecks once a day to see if the 2730330567Sgordon.Ar leapfile 2731330567Sgordonhas changed. 2732330567SgordonThe 2733330567Sgordon.Xr update\-leap 1update_leapmdoc 2734330567Sgordonscript can be run to see if the 2735330567Sgordon.Ar leapfile 2736330567Sgordonshould be updated. 2737285612Sdelphij.It Ic leapsmearinterval Ar seconds 2738285612SdelphijThis EXPERIMENTAL option is only available if 2739285612Sdelphij.Xr ntpd @NTPD_MS@ 2740285612Sdelphijwas built with the 2741285612Sdelphij.Cm \-\-enable\-leap\-smear 2742285612Sdelphijoption to the 2743285612Sdelphij.Cm configure 2744285612Sdelphijscript. 2745285612SdelphijIt specifies the interval over which a leap second correction will be applied. 2746285612SdelphijRecommended values for this option are between 2747285612Sdelphij7200 (2 hours) and 86400 (24 hours). 2748285612Sdelphij.Sy DO NOT USE THIS OPTION ON PUBLIC\-ACCESS SERVERS! 2749285612SdelphijSee http://bugs.ntp.org/2855 for more information. 2750275970Scy.It Ic logconfig Ar configkeyword 2751275970ScyThis command controls the amount and type of output written to 2752275970Scythe system 2753275970Scy.Xr syslog 3 2754275970Scyfacility or the alternate 2755275970Scy.Ic logfile 2756275970Scylog file. 2757275970ScyBy default, all output is turned on. 2758275970ScyAll 2759275970Scy.Ar configkeyword 2760275970Scykeywords can be prefixed with 2761275970Scy.Ql = , 2762275970Scy.Ql + 2763275970Scyand 2764275970Scy.Ql \- , 2765275970Scywhere 2766275970Scy.Ql = 2767275970Scysets the 2768275970Scy.Xr syslog 3 2769275970Scypriority mask, 2770275970Scy.Ql + 2771275970Scyadds and 2772275970Scy.Ql \- 2773275970Scyremoves 2774275970Scymessages. 2775275970Scy.Xr syslog 3 2776275970Scymessages can be controlled in four 2777275970Scyclasses 2778275970Scy.Po 2779275970Scy.Cm clock , 2780275970Scy.Cm peer , 2781275970Scy.Cm sys 2782275970Scyand 2783275970Scy.Cm sync 2784275970Scy.Pc . 2785275970ScyWithin these classes four types of messages can be 2786275970Scycontrolled: informational messages 2787275970Scy.Po 2788275970Scy.Cm info 2789275970Scy.Pc , 2790275970Scyevent messages 2791275970Scy.Po 2792275970Scy.Cm events 2793275970Scy.Pc , 2794275970Scystatistics messages 2795275970Scy.Po 2796275970Scy.Cm statistics 2797275970Scy.Pc 2798275970Scyand 2799275970Scystatus messages 2800275970Scy.Po 2801275970Scy.Cm status 2802275970Scy.Pc . 2803275970Scy.Pp 2804275970ScyConfiguration keywords are formed by concatenating the message class with 2805275970Scythe event class. 2806275970ScyThe 2807275970Scy.Cm all 2808275970Scyprefix can be used instead of a message class. 2809275970ScyA 2810275970Scymessage class may also be followed by the 2811275970Scy.Cm all 2812275970Scykeyword to enable/disable all 2813298770Sdelphijmessages of the respective message class. 2814298770SdelphijThus, a minimal log configuration 2815275970Scycould look like this: 2816275970Scy.Bd -literal 2817275970Scylogconfig =syncstatus +sysevents 2818275970Scy.Ed 2819275970Scy.Pp 2820275970ScyThis would just list the synchronizations state of 2821275970Scy.Xr ntpd @NTPD_MS@ 2822275970Scyand the major system events. 2823275970ScyFor a simple reference server, the 2824275970Scyfollowing minimum message configuration could be useful: 2825275970Scy.Bd -literal 2826275970Scylogconfig =syncall +clockall 2827275970Scy.Ed 2828275970Scy.Pp 2829275970ScyThis configuration will list all clock information and 2830275970Scysynchronization information. 2831275970ScyAll other events and messages about 2832275970Scypeers, system events and so on is suppressed. 2833275970Scy.It Ic logfile Ar logfile 2834275970ScyThis command specifies the location of an alternate log file to 2835275970Scybe used instead of the default system 2836275970Scy.Xr syslog 3 2837275970Scyfacility. 2838298770SdelphijThis is the same operation as the 2839298770Sdelphij.Fl l 2840298770Sdelphijcommand line option. 2841330567Sgordon.It Xo Ic mru 2842330567Sgordon.Oo 2843330567Sgordon.Cm maxdepth Ar count | Cm maxmem Ar kilobytes | 2844330567Sgordon.Cm mindepth Ar count | Cm maxage Ar seconds | 2845330567Sgordon.Cm initialloc Ar count | Cm initmem Ar kilobytes | 2846330567Sgordon.Cm incalloc Ar count | Cm incmem Ar kilobytes 2847330567Sgordon.Oc 2848330567Sgordon.Xc 2849330567SgordonControls size limite of the monitoring facility's Most Recently Used 2850330567Sgordon(MRU) list 2851330567Sgordonof client addresses, which is also used by the 2852330567Sgordonrate control facility. 2853330567Sgordon.Bl -tag -width indent 2854330567Sgordon.It Ic maxdepth Ar count 2855330567Sgordon.It Ic maxmem Ar kilobytes 2856330567SgordonEquivalent upper limits on the size of the MRU list, in terms of entries or kilobytes. 2857330567SgordonThe acutal limit will be up to 2858330567Sgordon.Cm incalloc 2859330567Sgordonentries or 2860330567Sgordon.Cm incmem 2861330567Sgordonkilobytes larger. 2862330567SgordonAs with all of the 2863330567Sgordon.Cm mru 2864330567Sgordonoptions offered in units of entries or kilobytes, if both 2865330567Sgordon.Cm maxdepth 2866330567Sgordonand 2867330567Sgordon.Cm maxmem are used, the last one used controls. 2868330567SgordonThe default is 1024 kilobytes. 2869330567Sgordon.It Cm mindepth Ar count 2870330567SgordonLower limit on the MRU list size. 2871330567SgordonWhen the MRU list has fewer than 2872330567Sgordon.Cm mindepth 2873330567Sgordonentries, existing entries are never removed to make room for newer ones, 2874330567Sgordonregardless of their age. 2875330567SgordonThe default is 600 entries. 2876330567Sgordon.It Cm maxage Ar seconds 2877330567SgordonOnce the MRU list has 2878330567Sgordon.Cm mindepth 2879330567Sgordonentries and an additional client is to ba added to the list, 2880330567Sgordonif the oldest entry was updated more than 2881330567Sgordon.Cm maxage 2882330567Sgordonseconds ago, that entry is removed and its storage is reused. 2883330567SgordonIf the oldest entry was updated more recently the MRU list is grown, 2884330567Sgordonsubject to 2885330567Sgordon.Cm maxdepth / moxmem . 2886330567SgordonThe default is 64 seconds. 2887330567Sgordon.It Cm initalloc Ar count 2888330567Sgordon.It Cm initmem Ar kilobytes 2889330567SgordonInitial memory allocation at the time the monitoringfacility is first enabled, 2890330567Sgordonin terms of the number of entries or kilobytes. 2891330567SgordonThe default is 4 kilobytes. 2892330567Sgordon.It Cm incalloc Ar count 2893330567Sgordon.It Cm incmem Ar kilobytes 2894330567SgordonSize of additional memory allocations when growing the MRU list, in entries or kilobytes. 2895330567SgordonThe default is 4 kilobytes. 2896330567Sgordon.El 2897330567Sgordon.It Ic nonvolatile Ar threshold 2898330567SgordonSpecify the 2899330567Sgordon.Ar threshold 2900330567Sgordondelta in seconds before an hourly change to the 2901330567Sgordon.Cm driftfile 2902330567Sgordon(frequency file) will be written, with a default value of 1e\-7 (0.1 PPM). 2903330567SgordonThe frequency file is inspected each hour. 2904330567SgordonIf the difference between the current frequency and the last value written 2905330567Sgordonexceeds the threshold, the file is written and the 2906330567Sgordon.Cm threshold 2907330567Sgordonbecomes the new threshold value. 2908330567SgordonIf the threshold is not exceeeded, it is reduced by half. 2909330567SgordonThis is intended to reduce the number of file writes 2910330567Sgordonfor embedded systems with nonvolatile memory. 2911330567Sgordon.It Ic phone Ar dial ... 2912330567SgordonThis command is used in conjunction with 2913330567Sgordonthe ACTS modem driver (type 18) 2914330567Sgordonor the JJY driver (type 40, mode 100 \- 180). 2915330567SgordonFor the ACTS modem driver (type 18), the arguments consist of 2916330567Sgordona maximum of 10 telephone numbers used to dial USNO, NIST, or European 2917330567Sgordontime service. 2918330567SgordonFor the JJY driver (type 40 mode 100 \- 180), the argument is 2919330567Sgordonone telephone number used to dial the telephone JJY service. 2920330567SgordonThe Hayes command ATDT is normally prepended to the number. 2921330567SgordonThe number can contain other modem control codes as well. 2922330567Sgordon.It Xo Ic reset 2923330567Sgordon.Oo 2924330567Sgordon.Ic allpeers 2925330567Sgordon.Oc 2926330567Sgordon.Oo 2927330567Sgordon.Ic auth 2928330567Sgordon.Oc 2929330567Sgordon.Oo 2930330567Sgordon.Ic ctl 2931330567Sgordon.Oc 2932330567Sgordon.Oo 2933330567Sgordon.Ic io 2934330567Sgordon.Oc 2935330567Sgordon.Oo 2936330567Sgordon.Ic mem 2937330567Sgordon.Oc 2938330567Sgordon.Oo 2939330567Sgordon.Ic sys 2940330567Sgordon.Oc 2941330567Sgordon.Oo 2942330567Sgordon.Ic timer 2943330567Sgordon.Oc 2944330567Sgordon.Xc 2945330567SgordonReset one or more groups of counters maintained by 2946330567Sgordon.Cm ntpd 2947330567Sgordonand exposed by 2948330567Sgordon.Cm ntpq 2949330567Sgordonand 2950330567Sgordon.Cm ntpdc . 2951330567Sgordon.It Xo Ic rlimit 2952330567Sgordon.Oo 2953330567Sgordon.Cm memlock Ar Nmegabytes | 2954330567Sgordon.Cm stacksize Ar N4kPages 2955330567Sgordon.Cm filenum Ar Nfiledescriptors 2956330567Sgordon.Oc 2957330567Sgordon.Xc 2958330567Sgordon.Bl -tag -width indent 2959330567Sgordon.It Cm memlock Ar Nmegabytes 2960330567SgordonSpecify the number of megabytes of memory that should be 2961330567Sgordonallocated and locked. 2962330567SgordonProbably only available under Linux, this option may be useful 2963330567Sgordonwhen dropping root (the 2964330567Sgordon.Fl i 2965330567Sgordonoption). 2966330567SgordonThe default is 32 megabytes on non\-Linux machines, and \-1 under Linux. 2967330567Sgordon-1 means "do not lock the process into memory". 2968330567Sgordon0 means "lock whatever memory the process wants into memory". 2969330567Sgordon.It Cm stacksize Ar N4kPages 2970330567SgordonSpecifies the maximum size of the process stack on systems with the 2971330567Sgordon.Fn mlockall 2972330567Sgordonfunction. 2973330567SgordonDefaults to 50 4k pages (200 4k pages in OpenBSD). 2974330567Sgordon.It Cm filenum Ar Nfiledescriptors 2975330567SgordonSpecifies the maximum number of file descriptors ntpd may have open at once. 2976330567SgordonDefaults to the system default. 2977330567Sgordon.El 2978330567Sgordon.It Ic saveconfigdir Ar directory_path 2979330567SgordonSpecify the directory in which to write configuration snapshots 2980330567Sgordonrequested with 2981330567Sgordon.Cm ntpq 's 2982330567Sgordon.Cm saveconfig 2983330567Sgordoncommand. 2984330567SgordonIf 2985330567Sgordon.Cm saveconfigdir 2986330567Sgordondoes not appear in the configuration file, 2987330567Sgordon.Cm saveconfig 2988330567Sgordonrequests are rejected by 2989330567Sgordon.Cm ntpd . 2990330567Sgordon.It Ic saveconfig Ar filename 2991330567SgordonWrite the current configuration, including any runtime 2992330567Sgordonmodifications given with 2993330567Sgordon.Cm :config 2994330567Sgordonor 2995330567Sgordon.Cm config\-from\-file 2996330567Sgordonto the 2997330567Sgordon.Cm ntpd 2998330567Sgordonhost's 2999330567Sgordon.Ar filename 3000330567Sgordonin the 3001330567Sgordon.Cm saveconfigdir . 3002330567SgordonThis command will be rejected unless the 3003330567Sgordon.Cm saveconfigdir 3004330567Sgordondirective appears in 3005330567Sgordon.Cm ntpd 's 3006330567Sgordonconfiguration file. 3007330567Sgordon.Ar filename 3008330567Sgordoncan use 3009330567Sgordon.Xr strftime 3 3010330567Sgordonformat directives to substitute the current date and time, 3011330567Sgordonfor example, 3012330567Sgordon.Cm saveconfig\ ntp\-%Y%m%d\-%H%M%S.conf . 3013330567SgordonThe filename used is stored in the system variable 3014330567Sgordon.Cm savedconfig . 3015330567SgordonAuthentication is required. 3016275970Scy.It Ic setvar Ar variable Op Cm default 3017275970ScyThis command adds an additional system variable. 3018275970ScyThese 3019275970Scyvariables can be used to distribute additional information such as 3020275970Scythe access policy. 3021275970ScyIf the variable of the form 3022275970Scy.Sm off 3023275970Scy.Va name = Ar value 3024275970Scy.Sm on 3025275970Scyis followed by the 3026275970Scy.Cm default 3027275970Scykeyword, the 3028275970Scyvariable will be listed as part of the default system variables 3029275970Scy.Po 3030275970Scy.Xr ntpq @NTPQ_MS@ 3031275970Scy.Ic rv 3032275970Scycommand 3033275970Scy.Pc ) . 3034275970ScyThese additional variables serve 3035275970Scyinformational purposes only. 3036275970ScyThey are not related to the protocol 3037275970Scyother that they can be listed. 3038275970ScyThe known protocol variables will 3039275970Scyalways override any variables defined via the 3040275970Scy.Ic setvar 3041275970Scymechanism. 3042275970ScyThere are three special variables that contain the names 3043275970Scyof all variable of the same group. 3044275970ScyThe 3045275970Scy.Va sys_var_list 3046275970Scyholds 3047275970Scythe names of all system variables. 3048275970ScyThe 3049275970Scy.Va peer_var_list 3050275970Scyholds 3051275970Scythe names of all peer variables and the 3052275970Scy.Va clock_var_list 3053275970Scyholds the names of the reference clock variables. 3054330567Sgordon.It Cm sysinfo 3055330567SgordonDisplay operational summary. 3056330567Sgordon.It Cm sysstats 3057330567SgordonShow statistics counters maintained in the protocol module. 3058275970Scy.It Xo Ic tinker 3059275970Scy.Oo 3060275970Scy.Cm allan Ar allan | 3061275970Scy.Cm dispersion Ar dispersion | 3062275970Scy.Cm freq Ar freq | 3063275970Scy.Cm huffpuff Ar huffpuff | 3064275970Scy.Cm panic Ar panic | 3065285612Sdelphij.Cm step Ar step | 3066285612Sdelphij.Cm stepback Ar stepback | 3067285612Sdelphij.Cm stepfwd Ar stepfwd | 3068275970Scy.Cm stepout Ar stepout 3069275970Scy.Oc 3070275970Scy.Xc 3071275970ScyThis command can be used to alter several system variables in 3072275970Scyvery exceptional circumstances. 3073275970ScyIt should occur in the 3074275970Scyconfiguration file before any other configuration options. 3075275970ScyThe 3076275970Scydefault values of these variables have been carefully optimized for 3077275970Scya wide range of network speeds and reliability expectations. 3078275970ScyIn 3079275970Scygeneral, they interact in intricate ways that are hard to predict 3080275970Scyand some combinations can result in some very nasty behavior. 3081275970ScyVery 3082275970Scyrarely is it necessary to change the default values; but, some 3083275970Scyfolks cannot resist twisting the knobs anyway and this command is 3084275970Scyfor them. 3085275970ScyEmphasis added: twisters are on their own and can expect 3086275970Scyno help from the support group. 3087275970Scy.Pp 3088275970ScyThe variables operate as follows: 3089275970Scy.Bl -tag -width indent 3090275970Scy.It Cm allan Ar allan 3091275970ScyThe argument becomes the new value for the minimum Allan 3092275970Scyintercept, which is a parameter of the PLL/FLL clock discipline 3093275970Scyalgorithm. 3094275970ScyThe value in log2 seconds defaults to 7 (1024 s), which is also the lower 3095275970Scylimit. 3096275970Scy.It Cm dispersion Ar dispersion 3097275970ScyThe argument becomes the new value for the dispersion increase rate, 3098275970Scynormally .000015 s/s. 3099275970Scy.It Cm freq Ar freq 3100275970ScyThe argument becomes the initial value of the frequency offset in 3101275970Scyparts\-per\-million. 3102275970ScyThis overrides the value in the frequency file, if 3103275970Scypresent, and avoids the initial training state if it is not. 3104275970Scy.It Cm huffpuff Ar huffpuff 3105275970ScyThe argument becomes the new value for the experimental 3106275970Scyhuff\-n'\-puff filter span, which determines the most recent interval 3107275970Scythe algorithm will search for a minimum delay. 3108275970ScyThe lower limit is 3109275970Scy900 s (15 m), but a more reasonable value is 7200 (2 hours). 3110275970ScyThere 3111275970Scyis no default, since the filter is not enabled unless this command 3112275970Scyis given. 3113275970Scy.It Cm panic Ar panic 3114275970ScyThe argument is the panic threshold, normally 1000 s. 3115275970ScyIf set to zero, 3116275970Scythe panic sanity check is disabled and a clock offset of any value will 3117275970Scybe accepted. 3118275970Scy.It Cm step Ar step 3119275970ScyThe argument is the step threshold, which by default is 0.128 s. 3120275970ScyIt can 3121275970Scybe set to any positive number in seconds. 3122275970ScyIf set to zero, step 3123275970Scyadjustments will never occur. 3124275970ScyNote: The kernel time discipline is 3125275970Scydisabled if the step threshold is set to zero or greater than the 3126275970Scydefault. 3127285612Sdelphij.It Cm stepback Ar stepback 3128285612SdelphijThe argument is the step threshold for the backward direction, 3129285612Sdelphijwhich by default is 0.128 s. 3130285612SdelphijIt can 3131285612Sdelphijbe set to any positive number in seconds. 3132285612SdelphijIf both the forward and backward step thresholds are set to zero, step 3133285612Sdelphijadjustments will never occur. 3134285612SdelphijNote: The kernel time discipline is 3135285612Sdelphijdisabled if 3136285612Sdelphijeach direction of step threshold are either 3137285612Sdelphijset to zero or greater than .5 second. 3138285612Sdelphij.It Cm stepfwd Ar stepfwd 3139285612SdelphijAs for stepback, but for the forward direction. 3140275970Scy.It Cm stepout Ar stepout 3141275970ScyThe argument is the stepout timeout, which by default is 900 s. 3142275970ScyIt can 3143275970Scybe set to any positive number in seconds. 3144275970ScyIf set to zero, the stepout 3145275970Scypulses will not be suppressed. 3146275970Scy.El 3147330567Sgordon.It Cm writevar Ar assocID\ name = value [,...] 3148330567SgordonWrite (create or update) the specified variables. 3149330567SgordonIf the 3150330567Sgordon.Cm assocID 3151330567Sgordonis zero, the variablea re from the 3152330567Sgordonsystem variables 3153330567Sgordonname space, otherwise they are from the 3154330567Sgordonpeer variables 3155330567Sgordonname space. 3156330567SgordonThe 3157330567Sgordon.Cm assocID 3158330567Sgordonis required, as the same name can occur in both name spaces. 3159275970Scy.It Xo Ic trap Ar host_address 3160275970Scy.Op Cm port Ar port_number 3161275970Scy.Op Cm interface Ar interface_address 3162275970Scy.Xc 3163275970ScyThis command configures a trap receiver at the given host 3164275970Scyaddress and port number for sending messages with the specified 3165275970Scylocal interface address. 3166275970ScyIf the port number is unspecified, a value 3167275970Scyof 18447 is used. 3168275970ScyIf the interface address is not specified, the 3169275970Scymessage is sent with a source address of the local interface the 3170275970Scymessage is sent through. 3171275970ScyNote that on a multihomed host the 3172275970Scyinterface used may vary from time to time with routing changes. 3173330567Sgordon.It Cm ttl Ar hop ... 3174330567SgordonThis command specifies a list of TTL values in increasing order. 3175330567SgordonUp to 8 values can be specified. 3176330567SgordonIn 3177330567Sgordon.Cm manycast 3178330567Sgordonmode these values are used in\-turn in an expanding\-ring search. 3179330567SgordonThe default is eight multiples of 32 starting at 31. 3180275970Scy.Pp 3181275970ScyThe trap receiver will generally log event messages and other 3182275970Scyinformation from the server in a log file. 3183275970ScyWhile such monitor 3184275970Scyprograms may also request their own trap dynamically, configuring a 3185275970Scytrap receiver will ensure that no messages are lost when the server 3186275970Scyis started. 3187275970Scy.It Cm hop Ar ... 3188275970ScyThis command specifies a list of TTL values in increasing order, up to 8 3189275970Scyvalues can be specified. 3190275970ScyIn manycast mode these values are used in turn in 3191275970Scyan expanding\-ring search. 3192275970ScyThe default is eight multiples of 32 starting at 3193275970Scy31. 3194275970Scy.El 3195275970Scy.Sh "OPTIONS" 3196275970Scy.Bl -tag 3197275970Scy.It Fl \-help 3198275970ScyDisplay usage information and exit. 3199275970Scy.It Fl \-more\-help 3200275970ScyPass the extended usage information through a pager. 3201275970Scy.It Fl \-version Op Brq Ar v|c|n 3202275970ScyOutput version of program and exit. The default mode is `v', a simple 3203275970Scyversion. The `c' mode will print copyright information and `n' will 3204275970Scyprint the full copyright notice. 3205275970Scy.El 3206275970Scy.Sh "OPTION PRESETS" 3207275970ScyAny option that is not marked as \fInot presettable\fP may be preset 3208275970Scyby loading values from environment variables named: 3209275970Scy.nf 3210275970Scy \fBNTP_CONF_<option\-name>\fP or \fBNTP_CONF\fP 3211275970Scy.fi 3212275970Scy.ad 3213275970Scy.Sh "ENVIRONMENT" 3214275970ScySee \fBOPTION PRESETS\fP for configuration environment variables. 3215275970Scy.Sh FILES 3216275970Scy.Bl -tag -width /etc/ntp.drift -compact 3217275970Scy.It Pa /etc/ntp.conf 3218275970Scythe default name of the configuration file 3219275970Scy.It Pa ntp.keys 3220275970Scyprivate MD5 keys 3221275970Scy.It Pa ntpkey 3222275970ScyRSA private key 3223275970Scy.It Pa ntpkey_ Ns Ar host 3224275970ScyRSA public key 3225275970Scy.It Pa ntp_dh 3226275970ScyDiffie\-Hellman agreement parameters 3227275970Scy.El 3228275970Scy.Sh "EXIT STATUS" 3229275970ScyOne of the following exit values will be returned: 3230275970Scy.Bl -tag 3231275970Scy.It 0 " (EXIT_SUCCESS)" 3232275970ScySuccessful program execution. 3233275970Scy.It 1 " (EXIT_FAILURE)" 3234275970ScyThe operation failed or the command syntax was not valid. 3235275970Scy.It 70 " (EX_SOFTWARE)" 3236275970Scylibopts had an internal operational error. Please report 3237275970Scyit to autogen\-users@lists.sourceforge.net. Thank you. 3238275970Scy.El 3239275970Scy.Sh "SEE ALSO" 3240275970Scy.Xr ntpd @NTPD_MS@ , 3241275970Scy.Xr ntpdc @NTPDC_MS@ , 3242275970Scy.Xr ntpq @NTPQ_MS@ 3243275970Scy.Pp 3244275970ScyIn addition to the manual pages provided, 3245275970Scycomprehensive documentation is available on the world wide web 3246275970Scyat 3247275970Scy.Li http://www.ntp.org/ . 3248275970ScyA snapshot of this documentation is available in HTML format in 3249275970Scy.Pa /usr/share/doc/ntp . 3250275970Scy.Rs 3251275970Scy.%A David L. Mills 3252275970Scy.%T Network Time Protocol (Version 4) 3253275970Scy.%O RFC5905 3254275970Scy.Re 3255275970Scy.Sh "AUTHORS" 3256280849ScyThe University of Delaware and Network Time Foundation 3257275970Scy.Sh "COPYRIGHT" 3258316722SdelphijCopyright (C) 1992\-2017 The University of Delaware and Network Time Foundation all rights reserved. 3259275970ScyThis program is released under the terms of the NTP license, <http://ntp.org/license>. 3260275970Scy.Sh BUGS 3261275970ScyThe syntax checking is not picky; some combinations of 3262275970Scyridiculous and even hilarious options and modes may not be 3263275970Scydetected. 3264275970Scy.Pp 3265275970ScyThe 3266275970Scy.Pa ntpkey_ Ns Ar host 3267275970Scyfiles are really digital 3268275970Scycertificates. 3269275970ScyThese should be obtained via secure directory 3270275970Scyservices when they become universally available. 3271275970Scy.Pp 3272275970ScyPlease send bug reports to: http://bugs.ntp.org, bugs@ntp.org 3273275970Scy.Sh NOTES 3274275970ScyThis document was derived from FreeBSD. 3275275970Scy.Pp 3276275970ScyThis manual page was \fIAutoGen\fP\-erated from the \fBntp.conf\fP 3277275970Scyoption definitions. 3278