mrcharles
1951667f8b
The ntp.conf hardening used `interface ignore wildcard` + `interface listen 127.0.0.1`, which binds ntpd to loopback only. Outbound NTP queries to the upstream servers then carried a 127.0.0.1 source address that the servers cannot reply to, so the daemon's peers stayed stuck in .INIT. with reach 0 — even though the servers are reachable (verified: ntpdate -q succeeds, ntpd does not). Replace the interface-based restriction with restrict-based hardening: `restrict default ignore` blocks unsolicited queries from any host (so the box never serves time to others), while explicit allow rules for the two upstream servers and localhost let the client sync normally. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
KNEL FetchApply
Repo Issues
https://projects.knownelement.com/project/reachableceo-vptechnicaloperations/timeline
Repo Discussion
https://community.turnsys.com/c/chieftechnologyandproductofficer/26
Repo discription
Known Element Enterprises (the entity serving as the TSYS Group management company) (through it’s executive leader, the COO) provides core IT/back office systems/services/support on a hands off/fully delegated authortity basis to the CCO and the orgs/members.
One of those functions is the provisoning of Linux servers. This repository is the Infrastructure As Code (IAC) repository for TSYS.
In the future it will be used via FetchApply https://github.com/P5vc/fetch-apply
Usage
git clone this repo cd FetchApply/ProjectCode bash SetupNewSystem.sh