Trying to get ntpd to stop creating listening sockets is a royal pain in the ass. Sure, I can set a firewall rule that blocks access to the port on undesired interfaces, but it's more work to make that happen, and it's just not as clean. Here's what I finally ended up doing to stop creating default (0.0.0.0:123 for IPv4 and :::123 for IPv6) listeners and just set a listening socket on one address on my internal interface. Hopefully it helps someone else out. # Add to ntp.conf, in order interface ignore all interface ignore ipv4 interface ignore ipv6 interface listen 192.168.0.1
While there’s not a gaping security window with NTP, I just feel a little safer not having anything listening at all.
thank you!!! “interface ignore all” doesn’t stop listening on all sockets and this doesn’t make sense… We need to ignore also ipv4 and ipv6, as you said… this is a royal pain in the ass…
Comment by giulio — November 10, 2012 @ 8:56 am
My sentiments exactly! Glad I could help.
Comment by Landis — November 10, 2012 @ 10:46 am