Page MenuHomeVyOS Platform
Create Task
Maniphest T1280

allow-clients on NTP configuration
Closed, ResolvedPublic
Actions

Description

After configure ntp like

set system ntp allow-clients address <x.x.x.x/x>

ntpd allow all ip`s for synchronization time. For strong rules need add to /etc/ntp.conf string consist noquery notrust

restrict default nomodify notrap nopeer noquery notrust

but this require add restrict rules for servers which vyos syncing

# Server configuration for: 1.pool.ntp.org
server 217.196.145.42 iburst
...
restrict 217.196.145.42 mask 255.255.255.255 nomodify notrap

Restricts rules don`t allow domain. Any ideas about ntp allow-clients?

Details

Version
-

Related Objects

Event Timeline

Unknown Object (User) created this task.Mar 4 2019, 9:06 PM
Unknown Object (User) triaged this task as Low priority.
Unknown Object (User) created this object in space S1 VyOS Public.
syncer assigned this task to hagbard.Mar 4 2019, 9:07 PM
syncer subscribed.

can you look into this please

hagbard changed the task status from Open to In progress.Mar 4 2019, 10:37 PM
hagbard mentioned this in rVYOSONEX334995522c31: T1280 - allow-clients on NTP configuration.Mar 4 2019, 11:17 PM
hagbard mentioned this in rVYOSONEX91338d2fcfc6: bump version T1280.
hagbard added a comment.Mar 4 2019, 11:22 PM

Not too sure what I'm supposed to do here, I added noquery notrust, but everything else looks pretty good.

vyos@vyos# set system ntp allow-clients address 10.1.1.0/24
vyos@vyos# commit
vyos@vyos# sudo cat /etc/ntp.conf
[...]

Client configuration for network: 10.1.1.0/24

restrict 10.1.1.0 mask 255.255.255.0 nomodify notrap nopeer

@Dmitry Can you please test: http://dev.packages.vyos.net/repositories/current/vyos/pool/main/v/vyos-1x/vyos-1x_1.3.0-4_all.deb

hagbard changed the task status from In progress to Needs testing.Mar 5 2019, 5:53 PM
Unknown Object (User) added a comment.EditedMar 7 2019, 6:33 AM

I`l try this package, but have problem with sync time on this vyos machine, because absent allow restriction for ntp server. State always INIT

root@vyos-rtr:~# ntpq -p -n
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 178.252.19.225  .INIT.          16 u    -   64    0    0.000    0.000   0.000

if I add to /etc/ntp.conf ip`s ntp server

restrict 178.252.19.225 mask 255.255.255.255 nomodify notrap

and restart ntpd, ntp was sync

root@vyos-rtr:~# ntpq -p -n
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*178.252.19.225  150.254.190.51   2 u   30   64    1   73.906    2.677   0.037
hagbard added a comment.Mar 7 2019, 4:13 PM

@Dmitry Oh ok, I didn't see the trees in the woods. Yeah, that needs to be fixed, I see that I can squeeze it in today.

hagbard changed the task status from Needs testing to In progress.Mar 7 2019, 6:00 PM
hagbard mentioned this in rVYOSONEX853a68aae4bf: [ntp] T1280 - allow-clients on NTP configuration.Mar 7 2019, 6:37 PM
hagbard mentioned this in rVYOSONEX77e642832e85: [ntp] minor version increment for T1280.
hagbard mentioned this in rVYOSONEX02edc9bfc1ed: Revert "[ntp] minor version increment for T1280".Mar 7 2019, 7:31 PM
hagbard mentioned this in rVYOSONEX5f7ff72ea44f: Revert "[ntp] T1280 - allow-clients on NTP configuration".
hagbard mentioned this in rVYOSONEXaaaacbed3912: [ntp] minor version bump for T1280.Mar 7 2019, 8:17 PM
hagbard mentioned this in rVYOSONEXad22cbd46f80: [ntp] T1280 - restrict option for servers, so they can query upstream.
hagbard added a comment.Mar 7 2019, 8:25 PM

@Dmitry here you go: http://dev.packages.vyos.net/repositories/current/vyos/pool/main/v/vyos-1x/vyos-1x_1.3.0-10_all.deb, or the rolling release created tonight.

hagbard changed the task status from In progress to Needs testing.Mar 7 2019, 8:25 PM
Unknown Object (User) added a comment.EditedMar 8 2019, 12:27 PM

I think restrick option in ntp.conf not support domain name. After install new package

dimka@vyos-rtr# show
 allow-clients {
     address 192.168.5.0/24
 }
 listen-address 192.168.0.30
 server 1.pool.ntp.org {
 }
[edit system ntp]

ntp.conf consist next

dimka@vyos-rtr# cat /etc/ntp.conf 

### Autogenerated by ntp.py ###

#
# Non-configurable defaults
#
driftfile /var/lib/ntp/ntp.drift
# By default, only allow ntpd to query time sources, ignore any incoming requests
restrict default noquery nopeer notrap nomodify noquery notrust
# Local users have unrestricted access, allowing reconfiguration via ntpdc
restrict 127.0.0.1
restrict -6 ::1

#
# Configurable section
#

# Server configuration for: 1.pool.ntp.org
server 1.pool.ntp.org iburst 
# allow server sync
restrict 1.pool.ntp.org nomodify notrap



# Client configuration for network: 192.168.5.0/24
restrict 192.168.5.0 mask 255.255.255.0 nomodify notrap nopeer



# NTP should listen on configured addresses only
interface ignore wildcard
interface listen 192.168.0.30

one domain name resolve more than 1 ip

dimka@vyos-rtr# nslookup 1.pool.ntp.org
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	1.pool.ntp.org
Address: 46.175.224.7
Name:	1.pool.ntp.org
Address: 54.37.233.160
Name:	1.pool.ntp.org
Address: 91.233.70.230
Name:	1.pool.ntp.org
Address: 149.156.70.75

[edit system ntp]

Run ntpq -p and nspd INIT state and not sync

dimka@vyos-rtr# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 ntp2.aas.ru     .INIT.          16 u    -   64    0    0.000    0.000   0.000
[edit system ntp]
hagbard added a comment.Mar 8 2019, 3:37 PM

Interesting, it did work during my tests and my implementation was based on the offical ntp documentation.

http://doc.ntp.org/4.2.4/accopt.html#cmd:

restrict address [mask mask] [flag][...]
    [...]
    Alternatively, the address argument can be a valid host DNS name.

Are you sure you are blocking it not somewhere else?

Unknown Object (User) added a comment.EditedMar 8 2019, 5:30 PM

I don`t block. Problem exist if use pool of ntp servers like 3.pool.ntp.org. If use domain name with one A record, all work.

...
set system ntp allow-clients address '192.168.5.0/24'
set system ntp listen-address '192.168.0.30'
set system ntp server 3.pool.ntp.org
set system ntp server ntp-d.0x5e.se
...

dimka@vyos-rtr# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 main.krajany.vn .INIT.          16 u    -   64    0    0.000    0.000   0.000
*ntp-d.0x5e.se   232.6.188.111    2 u   39   64   37   48.633   -2.958   0.980
hagbard changed the task status from Needs testing to In progress.Mar 8 2019, 8:00 PM
hagbard added a comment.Mar 8 2019, 8:57 PM

Ok, I resolve the IP during config time and wite it into the file, please note that it will be only 1 of the pool IPs, so it should work for you.
Please test: https://github.com/hagbard-01/vyos-1x/releases/download/v1.0/vyos-1x_1.3.0-11_all.deb and let me know if that works for you.

hagbard changed the task status from In progress to Needs testing.Mar 8 2019, 8:57 PM
Unknown Object (User) added a comment.Mar 8 2019, 9:35 PM

Not work, ntp queries another ip from pool.

dimka@vyos-rtr# show
 allow-clients {
     address 192.168.5.0/24
 }
 listen-address 192.168.0.30
 server 3.pool.ntp.org {
 }
[edit system ntp]
dimka@vyos-rtr# ntpq -pn
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 212.110.158.28  .INIT.          16 u    -   64    0    0.000    0.000   0.000
[edit system ntp]
dimka@vyos-rtr# cat /etc/ntp.conf 

### Autogenerated by ntp.py ###

#
# Non-configurable defaults
#
driftfile /var/lib/ntp/ntp.drift
# By default, only allow ntpd to query time sources, ignore any incoming requests
restrict default noquery nopeer notrap nomodify noquery notrust
# Local users have unrestricted access, allowing reconfiguration via ntpdc
restrict 127.0.0.1
restrict -6 ::1

#
# Configurable section
#

# Server configuration for: 3.pool.ntp.org
server 3.pool.ntp.org iburst 
# allow upstream sync
#restrict 3.pool.ntp.org nomodify notrap
restrict 85.21.78.23 mask 255.255.255.255 nomodify notrap




# Client configuration for network: 192.168.5.0/24
restrict 192.168.5.0 mask 255.255.255.0 nomodify notrap nopeer



# NTP should listen on configured addresses only
interface ignore wildcard
interface listen 192.168.0.30

[edit system ntp]
pasik subscribed.Mar 8 2019, 10:18 PM
hagbard added a comment.Mar 8 2019, 10:30 PM

That's what I thought. Thanks for testing it.

hagbard added a comment.Mar 8 2019, 10:33 PM

I'm going to revert the for default restrict

hagbard mentioned this in rVYOSONEXb3c393e587b3: [ntp] increment version for revert of T1280.Mar 8 2019, 11:21 PM
hagbard mentioned this in rVYOSONEX290cf96209ed: [ntp] T1280 - reverting added options from that task.
hagbard closed this task as Resolved.Mar 8 2019, 11:25 PM

Revert to the original config, since the tighter default restrictions make trouble with pooled addresses.
http://dev.packages.vyos.net/repositories/current/vyos/pool/main/v/vyos-1x/vyos-1x_1.3.0-12_all.deb

syncer added a comment.Mar 14 2019, 9:07 PM

@hagbard we should remove that function if it can't work as intended or we need explicitly state this
alternatively, we can do special chain to control that

hagbard added a comment.Mar 14 2019, 10:27 PM

@syncer The requested feature wasn't working as it should, already removed it. The current implementation is and was working as expected.

Viacheslav mentioned this in T4184: NTP allow-clients address doesn't work it allows to use ntp server for all addresses.Jan 14 2022, 2:25 PM