accopt.html revision 1.1
1 1.1 kardel <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 2 1.1 kardel 3 1.1 kardel <html> 4 1.1 kardel <head> 5 1.1 kardel <meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> 6 1.1 kardel <meta name="generator" content="HTML Tidy, see www.w3.org"> 7 1.1 kardel <title>Access Control Options</title> 8 1.1 kardel <link href="scripts/style.css" type="text/css" rel="stylesheet"> 9 1.1 kardel <style type="text/css"> 10 1.1 kardel <!-- 11 1.1 kardel .style1 { 12 1.1 kardel color: #FF0000; 13 1.1 kardel font-weight: bold; 14 1.1 kardel } 15 1.1 kardel --> 16 1.1 kardel </style> 17 1.1 kardel </head> 18 1.1 kardel 19 1.1 kardel <body> 20 1.1 kardel 21 1.1 kardel <h3>Access Control Options</h3> 22 1.1 kardel 23 1.1 kardel <img src="pic/pogo6.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/~mills/pictures.html">from <i>Pogo</i>, Walt Kelly</a> 24 1.1 kardel 25 1.1 kardel <p>The skunk watches for intruders and sprays.</p> 26 1.1 kardel <p>Last update: 27 1.1 kardel <!-- #BeginDate format:En2m -->30-Sep-2009 17:16<!-- #EndDate --> 28 1.1 kardel UTC</p> 29 1.1 kardel <br clear="left"> 30 1.1 kardel 31 1.1 kardel <h4>Related Links</h4> 32 1.1 kardel 33 1.1 kardel <script type="text/javascript" language="javascript" src="scripts/command.txt"></script> 34 1.1 kardel <script type="text/javascript" language="javascript" src="scripts/accopt.txt"></script> 35 1.1 kardel 36 1.1 kardel <h4>Table of Contents</h4> 37 1.1 kardel 38 1.1 kardel <ul> 39 1.1 kardel <li class="inline"><a href="#acx">Access Control Support</a></li> 40 1.1 kardel <li class="inline"><a href="#cmd">Access Control Commands</a></li> 41 1.1 kardel </ul> 42 1.1 kardel 43 1.1 kardel <hr> 44 1.1 kardel 45 1.1 kardel <h4 id="acx">Access Control Support</h4> 46 1.1 kardel 47 1.1 kardel <p>The <tt>ntpd</tt> daemon implements a general purpose access control list 48 1.1 kardel (ACL) containing address/match entries sorted first by increasing address 49 1.1 kardel values and then by increasing mask values. A match occurs when the bitwise 50 1.1 kardel AND of the mask and the packet source address is equal to the bitwise AND of 51 1.1 kardel the mask and address in the list. The list is searched in order with the last 52 1.1 kardel match found defining the restriction flags associated with the entry.</p> 53 1.1 kardel 54 1.1 kardel <p>An example may clarify how it works. Our campus has two class-B networks, 55 1.1 kardel 128.4 for the ECE and CIS departments and 128.175 for the rest of campus. 56 1.1 kardel Let's assume (not true!) that subnet 128.4.1 homes critical services like class 57 1.1 kardel rosters and spread sheets. A suitable ACL might be</p> 58 1.1 kardel <pre> 59 1.1 kardel restrict default nopeer # deny new associations 60 1.1 kardel restrict 128.175.0.0 mask 255.255.0.0 # allow campus access 61 1.1 kardel restrict 128.4.0.0 mask 255.255.0.0 none # allow ECE and CIS access 62 1.1 kardel restrict 128.4.1.0 mask 255.255.255.0 notrust # require authentication on subnet 1 63 1.1 kardel restrict time.nist.gov # allow access 64 1.1 kardel </pre> 65 1.1 kardel 66 1.1 kardel <p>While this facility may be useful for keeping unwanted, broken or malicious clients from congesting innocent servers, it should not be considered an alternative to the NTP authentication facilities. Source address based restrictions are easily circumvented by a determined cracker.</p> 67 1.1 kardel 68 1.1 kardel <h4 id="cmd">Access Control Commands</h4> 69 1.1 kardel 70 1.1 kardel <dl> 71 1.1 kardel 72 1.1 kardel <dt id="discard"><tt>discard [ average <i>avg</i> ][ minimum <i>min</i> ] [ monitor <i>prob</i> ]</tt></dt> 73 1.1 kardel <dd>Set the parameters of the rate control facility which protects the server 74 1.1 kardel from client abuse. If the <tt>limited</tt> flag is present in the ACL, packets 75 1.1 kardel that violate these limits are discarded. If in addition the <tt>kod</tt> restriction 76 1.1 kardel is present, a kiss-o'-death packet is returned.</dd> 77 1.1 kardel 78 1.1 kardel <dd><dl> 79 1.1 kardel 80 1.1 kardel <dt><tt>average <i>avg</i></tt></dt> 81 1.1 kardel <dd>Specify the minimum average interpacket spacing (minimum average headway 82 1.1 kardel time) in log<sub>2</sub> s with default 3.</dd> 83 1.1 kardel 84 1.1 kardel <dt><tt>minimum <i>min</i></tt></dt> 85 1.1 kardel <dd>Specify the minimum interpacket spacing (guard time) in log<sub>2</sub> s 86 1.1 kardel with default 1.</dd> 87 1.1 kardel 88 1.1 kardel <dt><tt>monitor</tt></dt> 89 1.1 kardel <dd>Specify the probability of discard for packets that overflow the rate-control 90 1.1 kardel window. This is a performance optimization for servers with aggregate arrivals 91 1.1 kardel of 1000 packets per second or more.</dd> 92 1.1 kardel 93 1.1 kardel </dl></dd> 94 1.1 kardel 95 1.1 kardel <dt id="restrict"><tt>restrict <i>address</i> [mask <i>mask</i>] [<i>flag</i>][...]</tt></dt> 96 1.1 kardel <dd>The <tt><i>address</i></tt> argument expressed in dotted-quad form is the 97 1.1 kardel address of a host or network. Alternatively, the <tt><i>address</i></tt> argument 98 1.1 kardel can be a valid host DNS name. The <tt><i>mask</i></tt> argument expressed in 99 1.1 kardel dotted-quad form defaults to 255.255.255.255, meaning that the <tt><i>address</i></tt> is 100 1.1 kardel treated as the address of an individual host. A default entry (address 0.0.0.0, 101 1.1 kardel mask 0.0.0.0) is always included and is always the first entry in the list. 102 1.1 kardel Note that the text string <tt>default</tt>, with no mask option, may be used 103 1.1 kardel to indicate the default entry.</dd> 104 1.1 kardel 105 1.1 kardel <dd>Some flags have the effect to deny service, some have the effect to 106 1.1 kardel enable service and some are conditioned by other flags. The flags. are 107 1.1 kardel not orthogonal, in that more restrictive flags will often make less restrictive 108 1.1 kardel ones redundant. The flags that deny service are classed in two categories, 109 1.1 kardel those that restrict time service and those that restrict informational queries 110 1.1 kardel and attempts to do run-time reconfiguration of the server. One or more of the 111 1.1 kardel following flags may be specified:</dd> 112 1.1 kardel <dd><dl> 113 1.1 kardel 114 1.1 kardel <dt><tt>flake</tt></dt> 115 1.1 kardel <dd>Discard received NTP packets with probability 0.1; that is, on average drop 116 1.1 kardel one packet in ten. This is for testing and amusement. The name comes from Bob 117 1.1 kardel Braden's <i>flakeway</i>, which once did a similar thing for early Internet 118 1.1 kardel testing.</dd> 119 1.1 kardel 120 1.1 kardel <dt><tt>ignore</tt></dt> 121 1.1 kardel <dd>Deny packets of all kinds, including <tt>ntpq</tt> and <tt>ntpdc</tt> queries.</dd> 122 1.1 kardel 123 1.1 kardel <dt><tt>kod</tt></dt> 124 1.1 kardel <dd>Send a kiss-o'-death (KoD) packet if the <tt>limited</tt> flag is present 125 1.1 kardel and a packet violates the rate limits established by the <tt>discard</tt> command. 126 1.1 kardel KoD packets are themselves rate limited for each source address separately. 127 1.1 kardel If this flag is not present, packets that violate the rate limits are discarded.</dd> 128 1.1 kardel 129 1.1 kardel <dt><tt>limited</tt></dt> 130 1.1 kardel <dd>Deny time service if the packet violates the rate limits established by the <tt>discard</tt> command. 131 1.1 kardel This does not apply to <tt>ntpq</tt> and <tt>ntpdc</tt> queries.</dd> 132 1.1 kardel 133 1.1 kardel <dt><tt>lowpriotrap</tt></dt> 134 1.1 kardel <dd>Declare traps set by matching hosts to be low priority. The number of traps 135 1.1 kardel a server can maintain is limited (the current limit is 3). Traps are usually 136 1.1 kardel assigned on a first come, first served basis, with later trap requestors being 137 1.1 kardel denied service. This flag modifies the assignment algorithm by allowing low 138 1.1 kardel priority traps to be overridden by later requests for normal priority traps.</dd> 139 1.1 kardel <dt><tt>mssntp</tt></dt> 140 1.1 kardel <dd>Enable Microsoft Windows MS-SNTP authentication using Active Directory services. 141 1.1 kardel <span class="style1">Note: Potential users should be aware that these services 142 1.1 kardel involve a TCP connection to another process that could potentially block, 143 1.1 kardel denying services to other users. Therefore, this flag should be used only 144 1.1 kardel for a dedicated server with no clients other than MS-SNTP.</span></dd> 145 1.1 kardel <dt><tt>nomodify</tt></dt> 146 1.1 kardel <dd>Deny <tt>ntpq</tt> and <tt>ntpdc</tt> queries which attempt to modify the 147 1.1 kardel state of the server (i.e., run time reconfiguration). Queries which return information 148 1.1 kardel are permitted.</dd> 149 1.1 kardel 150 1.1 kardel <dt><tt>noquery</tt></dt> 151 1.1 kardel <dd>Deny <tt>ntpq</tt> and <tt>ntpdc</tt> queries. Time service is not affected.</dd> 152 1.1 kardel 153 1.1 kardel <dt><tt>nopeer</tt></dt> 154 1.1 kardel <dd>Deny packets that might mobilize an association unless authenticated. This 155 1.1 kardel includes broadcast, symmetric-active and manycast server packets when a configured 156 1.1 kardel association does not exist. Note that this flag does not apply to packets 157 1.1 kardel that do not attempt to mobilize an association. </dd> 158 1.1 kardel 159 1.1 kardel <dt><tt>noserve</tt></dt> 160 1.1 kardel <dd>Deny all packets except <tt>ntpq</tt> and <tt>ntpdc</tt> queries.</dd> 161 1.1 kardel 162 1.1 kardel <dt><tt>notrap</tt></dt> 163 1.1 kardel <dd>Decline to provide mode 6 control message trap service to matching hosts. 164 1.1 kardel The trap service is a subsystem of the <tt>ntpdc</tt> control message protocol 165 1.1 kardel which is intended for use by remote event logging programs.</dd> 166 1.1 kardel 167 1.1 kardel <dt><tt>notrust</tt></dt> 168 1.1 kardel <dd>Deny packets that are not cryptographically authenticated. Note carefully 169 1.1 kardel how this flag interacts with the <tt>auth</tt> option of the <tt>enable</tt> and <tt>disable</tt> commands. 170 1.1 kardel If <tt>auth</tt> is enabled, which is the default, authentication is required 171 1.1 kardel for all packets that might mobilize an association. 172 1.1 kardel If <tt>auth</tt> is 173 1.1 kardel disabled, but the <tt>notrust</tt> flag is not present, an association can be 174 1.1 kardel mobilized whether or not authenticated. If <tt>auth</tt> is disabled, but the <tt>notrust</tt> flag 175 1.1 kardel is present, authentication is required only for the specified address/mask 176 1.1 kardel range. </dd> 177 1.1 kardel 178 1.1 kardel <dt><tt>ntpport</tt></dt> 179 1.1 kardel <dt><tt>non-ntpport</tt></dt> 180 1.1 kardel <dd>This is actually a match algorithm modifier, rather than a restriction 181 1.1 kardel flag. Its presence causes the restriction entry to be matched only if the 182 1.1 kardel source port in the packet is the standard NTP UDP port (123). Both <tt>ntpport</tt> and <tt>non-ntpport</tt> may 183 1.1 kardel be specified. The <tt>ntpport</tt> is considered more specific and is sorted 184 1.1 kardel later in the list.</dd> 185 1.1 kardel <dt><tt>version</tt></dt> 186 1.1 kardel <dd>Deny packets that do not match the current NTP version.</dd> 187 1.1 kardel </dl> 188 1.1 kardel </dd> 189 1.1 kardel <dd>Default restriction list entries with the flags <tt>ignore, ntpport</tt>, 190 1.1 kardel for each of the local host's interface addresses are inserted into the table 191 1.1 kardel at startup to prevent the server from attempting to synchronize to its own time. 192 1.1 kardel A default entry is also always present, though if it is otherwise unconfigured; 193 1.1 kardel no flags are associated with the default entry (i.e., everything besides your 194 1.1 kardel own NTP server is unrestricted).</dd> 195 1.1 kardel </dl> 196 1.1 kardel 197 1.1 kardel <hr> 198 1.1 kardel <script type="text/javascript" language="javascript" src="scripts/footer.txt"></script> 199 1.1 kardel 200 1.1 kardel </body> 201 1.1 kardel 202 1.1 kardel </html>
Indexes created Wed Apr 22 00:22:44 UTC 2026