From owner-freebsd-questions Fri Dec 6 8:31:24 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4004137B404 for ; Fri, 6 Dec 2002 08:31:22 -0800 (PST) Received: from smtp.infracaninophile.co.uk (happy-idiot-talk.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id F3C6043EBE for ; Fri, 6 Dec 2002 08:31:15 -0800 (PST) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1]) by smtp.infracaninophile.co.uk (8.12.6/8.12.6) with ESMTP id gB6GUgOR002026 for ; Fri, 6 Dec 2002 16:30:42 GMT (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost) by happy-idiot-talk.infracaninophile.co.uk (8.12.6/8.12.6/Submit) id gB6GUbpE002021 for freebsd-questions@FreeBSD.ORG; Fri, 6 Dec 2002 16:30:37 GMT Date: Fri, 6 Dec 2002 16:30:37 +0000 From: Matthew Seaman To: freebsd-questions@FreeBSD.ORG Subject: Re: Xntpd running on a host with jails Message-ID: <20021206163037.GA1630@happy-idiot-talk.infracaninophi> Mail-Followup-To: Matthew Seaman , freebsd-questions@FreeBSD.ORG References: <000001c29d37$7eb97280$952b6e94@lucifer> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <000001c29d37$7eb97280$952b6e94@lucifer> User-Agent: Mutt/1.5.1i X-Spam-Status: No, hits=-3.0 required=5.0 tests=IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,SPAM_PHRASE_00_01, USER_AGENT,USER_AGENT_MUTT version=2.43 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Fri, Dec 06, 2002 at 03:55:19PM +0100, Didier Wiroth wrote: > I'm running xntpd on a host which has jails! I saw that ntpd listens on > all ip addresses even the jails ip addresses! How can I force xntp to > listen only at a specific ip address? Errr... To the best of my knowledge, you can't. There's no documented capability in the ntp.conf file to tell ntpd to bind to a particular interface, and as far as I can tell from reading the source, there's just no way to do that. However, think about it. You couldn't run several copies of ntpd simultaneously on one physical machine --- makes no sense, even if the ntpd's are running in separate jails. The machine's clock can only be set to one time. As ntpd is going to be the only serious contender to use UDP port 123, it really doesn't matter if the ntpd on the host system blocks port 123 on the jails. If you're worried about security, use the built in mechanisms provided by ntpd --- the best strategy is to use the 'restrict' mechanism to set a default policy to ignore everything, and then open up the minimum amount of access required to make the service work. Eg. restrict default ignore # Everyone can go away ... restrict 127.0.0.1 # except me ... restrict 192.168.0.0 mask 255.255.255.0 # or the local net. server 123.45.67.89 # A remote NTP server restrict 123.45.67.89 nomodify # Can send us a timestamp, # but can't modify our # configuration. If you are using your machine to provide NTP service to a network of clients or peering several machines together for resilience, create an ntp.keys(5) file and copy it to each of your machines --- the M type key format is probably the best, but you may need to use the A type to support older servers. Prefer the clients and local servers to use the key-based auth mechanism to operate --- if you want to broadcast or multicast a time signal to a whole network, this will be required. Use IPFW or IPF to restrict access to the local port 123. A useful feature of NTP is that it uses port 123 at *both* ends of the connection, although if your client is behind a NAT gateway it may appear to use a random high numbered port on the client end. Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message