From 1951667f8bdf36441b6154efee3655bafe65717a Mon Sep 17 00:00:00 2001 From: reachableceo Date: Tue, 28 Jul 2026 06:03:21 -0500 Subject: [PATCH] fix(network): remove interface restriction that broke NTP client sync MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ntp.conf hardening used `interface ignore wildcard` + `interface listen 127.0.0.1`, which binds ntpd to loopback only. Outbound NTP queries to the upstream servers then carried a 127.0.0.1 source address that the servers cannot reply to, so the daemon's peers stayed stuck in .INIT. with reach 0 — even though the servers are reachable (verified: ntpdate -q succeeds, ntpd does not). Replace the interface-based restriction with restrict-based hardening: `restrict default ignore` blocks unsolicited queries from any host (so the box never serves time to others), while explicit allow rules for the two upstream servers and localhost let the client sync normally. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush --- ProjectCode/ConfigFiles/NTP/ntp.conf | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/ProjectCode/ConfigFiles/NTP/ntp.conf b/ProjectCode/ConfigFiles/NTP/ntp.conf index c53df06..717fcb1 100644 --- a/ProjectCode/ConfigFiles/NTP/ntp.conf +++ b/ProjectCode/ConfigFiles/NTP/ntp.conf @@ -8,7 +8,14 @@ leapfile /usr/share/zoneinfo/leap-seconds.list server 192.168.3.252 iburst server 192.168.3.253 iburst +# Hardened client: sync from the configured servers but never serve time to +# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it +# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source +# address that upstream servers cannot reply to (symptoms: peers stuck in +# .INIT. with reach 0). Use restrict rules to control access instead. +restrict default ignore restrict 127.0.0.1 restrict ::1 -interface ignore wildcard -interface listen 127.0.0.1 +restrict 192.168.3.252 nomodify notrap nopeer +restrict 192.168.3.253 nomodify notrap nopeer +