d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make EC2 instances use Amazon's NTP service for time synchronization.

Browse Source 
Since Amazon provides NTP servers within their network, this should
be far superior to using the default NTP pools; and since the service
is provided by Amazon there's very little risk in enabling it by
default.  (If someone is able to compromise Amazon's NTP servers and
exploit them to attack EC2 instances, they would almost certainly be
able to compromise EC2 instances even without ntpd running...)

MFC after:	1 week
Relnotes:	EC2 instances now keep their clocks synchronized using
		the Amazon Time Sync Service (aka. NTP).
This commit is contained in:
Colin Percival 2017-12-05 09:22:14 +00:00
parent 4ba35bc4db
commit 4a93691064
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
release/tools/ec2.conf
View File

@ -9,7 +9,7 @@
export VM_EXTRA_PACKAGES="ec2-scripts firstboot-freebsd-update firstboot-pkgs dual-dhclient amazon-ssm-agent"
# Set to a list of third-party software to enable in rc.conf(5).
export VM_RC_LIST="ec2_configinit ec2_fetchkey ec2_ephemeralswap ec2_loghostkey firstboot_freebsd_update firstboot_pkgs"
export VM_RC_LIST="ec2_configinit ec2_fetchkey ec2_ephemeralswap ec2_loghostkey firstboot_freebsd_update firstboot_pkgs ntpd"
# Build with a 3 GB UFS partition; the growfs rc.d script will expand
# the partition to fill the root disk after the EC2 instance is launched.
@ -87,6 +87,11 @@ vm_extra_pre_umount() {
's/^#ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/' \
${DESTDIR}/etc/ssh/sshd_config
# Use the NTP service provided by Amazon
sed -i '' -e 's/^pool/#pool/' \
-e 's/^#server.*/server 169.254.169.123 iburst/' \
${DESTDIR}/etc/ntp.conf
# The first time the AMI boots, the installed "first boot" scripts
# should be allowed to run:
# * ec2_configinit (download and process EC2 user-data)