KNEL/KNELServerBuild
2
0
Fork 0
Code Pull Requests Actions Packages Releases 1 Activity

fix(network): remove interface restriction that broke NTP client sync

Browse Source 
The ntp.conf hardening used `interface ignore wildcard` +
`interface listen 127.0.0.1`, which binds ntpd to loopback only. Outbound
NTP queries to the upstream servers then carried a 127.0.0.1 source
address that the servers cannot reply to, so the daemon's peers stayed
stuck in .INIT. with reach 0 — even though the servers are reachable
(verified: ntpdate -q succeeds, ntpd does not).

Replace the interface-based restriction with restrict-based hardening:
`restrict default ignore` blocks unsolicited queries from any host (so
the box never serves time to others), while explicit allow rules for the
two upstream servers and localhost let the client sync normally.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
This commit is contained in:
mrcharles
2026-07-28 06:03:21 -05:00
parent 9a4961d94b
commit 1951667f8b
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ProjectCode/ConfigFiles/NTP/ntp.conf
+9 -2
View File
@@ -8,7 +8,14 @@ leapfile /usr/share/zoneinfo/leap-seconds.list
server 192.168.3.252 iburst server 192.168.3.252 iburst
server 192.168.3.253 iburst server 192.168.3.253 iburst
# Hardened client: sync from the configured servers but never serve time to
# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
# address that upstream servers cannot reply to (symptoms: peers stuck in
# .INIT. with reach 0). Use restrict rules to control access instead.
restrict default ignore
restrict 127.0.0.1 restrict 127.0.0.1
restrict ::1 restrict ::1
interface ignore wildcard restrict 192.168.3.252 nomodify notrap nopeer
interface listen 127.0.0.1 restrict 192.168.3.253 nomodify notrap nopeer