b5e14a1344
Reviewed by: roberto Security: VUXML: 4033d826-87dd-11e4-9079-3c970e169bc2 Security: http://www.kb.cert.org/vuls/id/852879 Security: CVE-2014-9293 Security CVE-2014-9294 Security CVE-2014-9295 Security CVE-2014-9296
177 lines
14 KiB
HTML
177 lines
14 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
|
|
<meta name="generator" content="HTML Tidy, see www.w3.org">
|
|
<title>ntpd - Network Time Protocol (NTP) daemon</title>
|
|
<!-- Changed by: Harlan &, 10-Feb-2014 -->
|
|
<link href="scripts/style.css" type="text/css" rel="stylesheet">
|
|
</head>
|
|
<body>
|
|
<h3><tt>ntpd</tt> - Network Time Protocol (NTP) Daemon</h3>
|
|
<img src="pic/wingdorothy.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/~mills/pictures.html">from <i>The Wizard of Oz</i>, L. Frank Baum</a>
|
|
<p>You need help from the monkeys.</p>
|
|
<p>Last update:
|
|
<!-- #BeginDate format:En2m -->10-Mar-2014 05:14<!-- #EndDate -->
|
|
UTC</p>
|
|
<br clear="left">
|
|
<h4>Related Links</h4>
|
|
<script type="text/javascript" language="javascript" src="scripts/command.txt"></script>
|
|
<h4>Table of Contents</h4>
|
|
<ul>
|
|
<li class="inline"><a href="#synop">Synopsis</a></li>
|
|
<li class="inline"><a href="#descr">Description</a></li>
|
|
<li class="inline"><a href="#cmd">Command Line Options</a></li>
|
|
<li class="inline"><a href="#cfg">The Configuration File</a></li>
|
|
<li class="inline"><a href="#files">Files</a></li>
|
|
</ul>
|
|
<hr>
|
|
<h4 id="synop">Synopsis</h4>
|
|
<tt>ntpd [ -46aAbdDgLmnNqx ] [ -c <i>conffile</i> ] [ -f <i>driftfile</i> ] [ -i <i>jaildir</i> ] [ -I <i>InterfaceOrAddress</i> ] [ -k <i>keyfile</i> ] [ -l <i>logfile</i> ] [ -p <i>pidfile</i> ] [ -P <i>priority</i> ] [ -r <i>broadcastdelay</i> ] [ -s <i>statsdir</i> ] [ -t <i>key</i> ] [ -u <i>user</i>[:<i>group</i>] ] [ -U <i>interface_update_interval</i> ] [ -v <i>variable</i> ] [ -V <i>variable</i> ]</tt>
|
|
<h4 id="descr">Description</h4>
|
|
<p>The <tt>ntpd</tt> program is an operating system daemon that synchronizes the system clock to remote NTP time servers or local reference clocks. It is a complete implementation of NTP version 4 defined by RFC-5905, but also retains compatible with version 3 defined by RFC-1305 and versions 1 and 2, defined by RFC-1059 and RFC-1119, respectively. The program can operate in any of several modes, including client/server, symmetric and broadcast modes, and with both symmetric-key and public key-cryptography</p>
|
|
<p>The <tt>ntpd</tt> program ordinarily requires a configuration file described on this page. It contains configuration commands described on the pages listed above. However a client can discover remote servers and configure them automatically. This makes it possible to deploy a fleet of workstations without specifying configuration details specific to the local environment. Further details are on the </p>
|
|
<p>The <tt>ntpd</tt> program normally operates continuously while adjusting the system time and frequency, but in some cases this might not be practical. With the <tt>-q</tt> option <tt>ntpd</tt> operates as in continuous mode, but exits just after setting the clock for the first time. Most applications will probably want to specify the <tt>iburst</tt> option with the <tt>server</tt> command. With this option a volley of messages is exchanged to groom the data and set the clock in about ten seconds. If nothing is heard after a few minutes, the daemon times out and exits without setting the clock.</p>
|
|
<h4 id="cmd">Command Line Options</h4>
|
|
<dl>
|
|
<dt><tt>-4</tt>
|
|
<dd>Force DNS resolution of host names to the IPv4 namespace.
|
|
<dt><tt>-6</tt>
|
|
<dd>Force DNS resolution of host names to the IPv6 namespace.
|
|
<dt><tt>-a</tt></dt>
|
|
<dd>Require cryptographic authentication for broadcast client, multicast client and symmetric passive associations. This is the same operation as the <tt>enable auth</tt> command and is the default.</dd>
|
|
<dt><tt>-A</tt></dt>
|
|
<dd>Do not require cryptographic authentication for broadcast client, multicast client and symmetric passive associations. This is the same operation as the <tt>disable auth</tt> command and almost never a good idea.</dd>
|
|
<dt><tt>-b</tt></dt>
|
|
<dd>Enable the client to synchronize to broadcast servers.</dd>
|
|
<dt><tt>-c <i>conffile</i></tt></dt>
|
|
<dd>Specify the name and path of the configuration file. Without the option the default is <tt>/etc/ntp.conf</tt>.</dd>
|
|
<dt><tt>-d</tt></dt>
|
|
<dd> Disable switching into daemon mode, so <tt>ntpd</tt> stays attached to the starting terminal which will get all the debugging printout. Also, ^C will kill it. This option may occur more than once, with each occurrence indicating greater detail of display.</dd>
|
|
<dt><tt>-D <i>level</i></tt></dt>
|
|
<dd>Specify debugging level directly, with <tt>level</tt> corresponding to the numbe of <tt>-d</tt> options..</dd>
|
|
<dt><tt>-f <i>driftfile</i></tt></dt>
|
|
<dd>Specify the name and path of the frequency file. This is the same operation as the <tt>driftfile <i>driftfile</i></tt> configuration command.
|
|
<dt><tt>-g</tt></dt>
|
|
<dd>Normally, <tt>ntpd</tt> exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, <tt>ntpd</tt> will exit with a message to the system log. This option can be used with the <tt>-q</tt> and <tt>-x</tt> options. See the <tt>tinker</tt> command for other options.</dd>
|
|
<dt><tt>-i <i>jaildir</i></tt></dt>
|
|
<dd>Chroot the server to the directory <i><tt>jaildir</tt></i>. This option also implies that the server attempts to drop root privileges at startup (otherwise, chroot gives very little additional security), and it is only available if the OS supports to run the server without full root privileges. You may need to also specify a <tt>-u</tt> option.</dd>
|
|
<dt id="--interface"><tt>-I [<i>address</i> | <i>interface name</i>]</tt></dt>
|
|
<dd>Open the network address given, or all the addresses associated with the given interface name. This option may appear multiple times. This option also implies not opening other addresses, except wildcard and localhost. This option is deprecated. Please consider using the configuration file <a href="miscopt.html#interface">interface</a> command, which is more versatile.</dd>
|
|
<dt><tt>-k <i>keyfile</i></tt></dt>
|
|
<dd>Specify the name and path of the symmetric key file. This is the same operation as the <tt>keys <i>keyfile</i></tt> command.</dd>
|
|
<dt><tt>-l <i>logfile</i></tt></dt>
|
|
<dd>Specify the name and path of the log file. The default is the system log file. This is the same operation as the <tt>logfile <i>logfile</i></tt> command.</dd>
|
|
<dt id="--mdns"><tt>-m</tt></dt>
|
|
<dd>Once the system clock is synchronized, register with mDNS as an available server.</dd>
|
|
<dt id="--novirtualips"><tt>-L</tt></dt>
|
|
<dd>Do not listen to virtual interfaces, defined as those with names containing a colon. This option is deprecated. Please consider using the configuration file <a href="miscopt.html#interface">interface</a> command, which is more versatile.</dd>
|
|
<dt><tt>-M</tt></dt>
|
|
<dd>Raise scheduler precision to its maximum (1 ms) using timeBeginPeriod. (Windows only)</dd>
|
|
<dt><tt>-n</tt></dt>
|
|
<dd>Don't fork.</dd>
|
|
<dt><tt>-N</tt></dt>
|
|
<dd>To the extent permitted by the operating system, run the <tt>ntpd</tt> at the highest priority.</dd>
|
|
<dt><tt>-p <i>pidfile</i></tt></dt>
|
|
<dd>Specify the name and path of the file used to record the <tt>ntpd</tt> process ID. This is the same operation as the <tt>pidfile <i>pidfile</i></tt> command.</dd>
|
|
<dt><tt>-P <i>priority</i></tt></dt>
|
|
<dd>To the extent permitted by the operating system, run the <tt>ntpd</tt> at the specified priority.</dd>
|
|
<dt><tt>-q</tt></dt>
|
|
<dd>Exit the <tt>ntpd</tt> just after the first time the clock is set. This behavior mimics that of the <tt>ntpdate</tt> program, which is to be retired. The <tt>-g</tt> and <tt>-x</tt> options can be used with this option. Note: The kernel time discipline is disabled with this option.</dd>
|
|
<dt><tt>-r <i>broadcastdelay</i></tt></dt>
|
|
<dd>Specify the default propagation delay from the broadcast/multicast server to this client. This is necessary only if the delay cannot be computed automatically by the protocol.</dd>
|
|
<dt><tt>-s <i>statsdir</i></tt></dt>
|
|
<dd>Specify the directory path for files created by the statistics facility. This is the same operation as the <tt>statsdir <i>statsdir</i></tt> command.</dd>
|
|
<dt><tt>-t <i>key</i></tt></dt>
|
|
<dd>Add a key number to the trusted key list. This option can occur more than once. This is the same operation as the <tt>trustedkey <i>key</i></tt> command.</dd>
|
|
<dt><tt>-u <i>user[:group]</i> </tt></dt>
|
|
<dd>Specify a user, and optionally a group, to switch to. This option is only available if the OS supports running the server without full root privileges. Currently, this option is supported under NetBSD (configure with <tt>--enable-clockctl</tt>) and Linux (configure with --<tt>enable-linuxcaps</tt>).</dd>
|
|
<dt><tt>-U <i>interface update interval</i></tt></dt>
|
|
<dd>Number of seconds to wait between interface list scans to pick up old and delete network interface. Set to 0 to disable dynamic interface list updating. The default is to scan every 5 minutes.</dd>
|
|
<dt><tt>-v <i>variable</i></tt><br>
|
|
<tt>-V <i>variable</i></tt></dt>
|
|
<dd>Add a system variable listed by default.</dd>
|
|
<dt><tt>-x</tt></dt>
|
|
<dd>Normally, the time is slewed if the offset is less than the step threshold, which is 128 ms by default, and stepped if above the threshold. This option sets the threshold to 600 s, which is well within the accuracy window to set the clock manually. Note: Since the slew rate of typical Unix kernels is limited to 0.5 ms/s, each second of adjustment requires an amortization interval of 2000 s. Thus, an adjustment as much as 600 s will take almost 14 days to complete. This option can be used with the <tt>-g</tt> and <tt>-q</tt> options. See the <tt>tinker</tt> command for other options. Note: The kernel time discipline is disabled with this option.</dd>
|
|
<dt><tt>--pccfreq <i>frequency</i></tt></dt>
|
|
<dd>Substitute processor cycle counter for QueryPerformanceCounter unconditionally
|
|
using the given frequency (in Hz). <tt>--pccfreq</tt> can be used on systems
|
|
which do not use the PCC to implement QueryPerformanceCounter
|
|
and have a fixed PCC frequency. The frequency specified must
|
|
be accurate within 0.5 percent. <tt>--usepcc</tt> is equivalent on many systems and should
|
|
be tried first, as it does not require determining the frequency
|
|
of the processor cycle counter. For x86-compatible processors, the PCC is
|
|
also referred to as <tt>RDTSC</tt>, which is the assembly-language instruction to retrieve
|
|
the current value. (Windows only)</dd>
|
|
<dt><tt>--usepcc</tt></dt>
|
|
<dd>Substitute processor cycle counter for QueryPerformanceCounter if they
|
|
appear equivalent. This option should be used only if the PCC
|
|
frequency is fixed. Power-saving functionality on many laptops varies the
|
|
PCC frequency. (Windows only)</dd>
|
|
</dl>
|
|
<h4 id="cfg">The Configuration File</h4>
|
|
<p>Ordinarily, <tt>ntpd</tt> reads the <tt>ntp.conf</tt> configuration file at startup in order to determine the synchronization sources and operating modes. It is also possible to specify a working, although limited, configuration entirely on the command line, obviating the need for a configuration file. This may be particularly useful when the local host is to be configured as a broadcast client, with servers determined by listening to broadcasts at run time.</p>
|
|
<p>Usually, the configuration file is installed as<tt>/etc/ntp.conf</tt>, but could be installed elsewhere (see the <tt>-c <i>conffile</i></tt> command line option). The file format is similar to other Unix configuration files - comments begin with a <tt>#</tt> character and extend to the end of the line; blank lines are ignored.</p>
|
|
<p>Configuration commands consist of an initial command keyword followed by a list of option keywords separated by whitespace. Commands may not be continued over multiple lines. Options may be host names, host addresses written in numeric, dotted-quad form, integers, floating point numbers (when specifying times in seconds) and text strings. Optional arguments are delimited by <tt>[ ]</tt> in the options pages, while alternatives are separated by <tt>|</tt>. The notation <tt>[ ... ]</tt> means an optional, indefinite repetition of the last item before the <tt>[ ... ]</tt>.</p>
|
|
<h4 id="files">Files</h4>
|
|
<table width="100%" border="1">
|
|
<tr>
|
|
<td width="30%">File</td>
|
|
<td width="30%">Default</td>
|
|
<td width="20%">Option</td>
|
|
<td width="20%">Option</td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">configuration file</td>
|
|
<td width="30%"><tt>/etc/ntp.conf</tt></td>
|
|
<td width="20%"><tt>-c</tt></td>
|
|
<td width="20%"><tt>conffile</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">frequency file</td>
|
|
<td width="30%">none</td>
|
|
<td width="20%"><tt>-f</tt></td>
|
|
<td width="20%"><tt>driftfile</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">leapseconds file</td>
|
|
<td width="30%">none</td>
|
|
<td width="20%"></td>
|
|
<td width="20%"><tt>leapfile</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">process ID file</td>
|
|
<td width="30%">none</td>
|
|
<td width="20%"><tt>-p</tt></td>
|
|
<td width="20%"><tt>pidfile</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">log file</td>
|
|
<td width="30%">system log</td>
|
|
<td width="20%"><tt>-l</tt></td>
|
|
<td width="20%"><tt>logfile</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">include file</td>
|
|
<td width="30%">none</td>
|
|
<td width="20%">none</td>
|
|
<td width="20%"><tt>includefile</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">statistics path</td>
|
|
<td width="30%"><tt>/var/NTP</tt></td>
|
|
<td width="20%"><tt>-s</tt></td>
|
|
<td width="20%"><tt>statsdir</tt></td>
|
|
</tr>
|
|
<tr>
|
|
<td width="30%">keys path</td>
|
|
<td width="30%"><tt>/usr/local/etc</tt></td>
|
|
<td width="20%">none</td>
|
|
<td width="20%"><tt>keysdir</tt></td>
|
|
</tr>
|
|
</table>
|
|
<hr>
|
|
<script type="text/javascript" language="javascript" src="scripts/footer.txt"></script>
|
|
</body>
|
|
</html>
|