Home | History | Annotate | Line # | Download | only in html
accopt.html revision 1.1.1.3.14.1 
      1           1.1    kardel <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
      2           1.1    kardel <html>
      3           1.1    kardel <head>
      4           1.1    kardel <meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
      5           1.1    kardel <meta name="generator" content="HTML Tidy, see www.w3.org">
      6  1.1.1.3.14.1   msaitoh <title>Access Control Commands and Options</title> <!-- Changed by: Harlan
      7  1.1.1.3.14.1   msaitoh &, 13-Nov-2014 -->
      8           1.1    kardel <link href="scripts/style.css" type="text/css" rel="stylesheet">
      9           1.1    kardel <style type="text/css">
     10           1.1    kardel <!--
     11       1.1.1.2  christos <style1 {
     12  1.1.1.3.14.1   msaitoh color: #FF0000; font-weight: bold; } -->
     13           1.1    kardel </style>
     14           1.1    kardel </head>
     15           1.1    kardel <body>
     16       1.1.1.2  christos <h3>Access Control Commands and Options</h3>
     17  1.1.1.3.14.1   msaitoh <img src="pic/pogo6.gif" alt="gif"
     18  1.1.1.3.14.1   msaitoh align="left"><a href="http://www.eecis.udel.edu/~mills/pictures.html">from <i>Pogo</i>,
     19  1.1.1.3.14.1   msaitoh Walt Kelly</a>
     20           1.1    kardel <p>The skunk watches for intruders and sprays.</p>
     21  1.1.1.3.14.1   msaitoh <p>Last update: <!-- #BeginDate format:En2m -->7-Jan-2018 23:56<!-- #EndDate
     22  1.1.1.3.14.1   msaitoh   --> UTC</p>
     23           1.1    kardel <br clear="left">
     24           1.1    kardel <h4>Related Links</h4>
     25  1.1.1.3.14.1   msaitoh <script type="text/javascript" language="javascript"
     26  1.1.1.3.14.1   msaitoh src="scripts/command.txt"></script>
     27  1.1.1.3.14.1   msaitoh <script type="text/javascript" language="javascript"
     28  1.1.1.3.14.1   msaitoh src="scripts/accopt.txt"></script>
     29           1.1    kardel <hr>
     30       1.1.1.2  christos <h4>Commands and Options</h4>
     31  1.1.1.3.14.1   msaitoh <p>Unless noted otherwise, further information about these ccommands is on
     32  1.1.1.3.14.1   msaitoh the <a href="accopt.html">Access Control Support</a> page.</p>
     33           1.1    kardel <dl>
     34  1.1.1.3.14.1   msaitoh   <dt id="discard"><tt>discard [ average <i>avg</i> ][ minimum <i>min</i> ]
     35  1.1.1.3.14.1   msaitoh       [ monitor <i>prob</i> ]</tt></dt>
     36  1.1.1.3.14.1   msaitoh   <dd>Set the parameters of the rate control facility which protects the
     37  1.1.1.3.14.1   msaitoh     server from client abuse. If the <tt>limited</tt> flag is present in the
     38  1.1.1.3.14.1   msaitoh     ACL, packets that violate these limits are discarded. If, in addition,
     39  1.1.1.3.14.1   msaitoh     the <tt>kod</tt> flag is present, a kiss-o'-death packet is
     40  1.1.1.3.14.1   msaitoh     returned. See the <a href="rate.html">Rate Management</a> page for
     41  1.1.1.3.14.1   msaitoh     further information. The options are:
     42       1.1.1.2  christos     <dl>
     43       1.1.1.2  christos       <dt><tt>average <i>avg</i></tt></dt>
     44  1.1.1.3.14.1   msaitoh       <dd>Specify the minimum average interpacket spacing (minimum average
     45  1.1.1.3.14.1   msaitoh         headway time) in log<sub>2</sub> s with default 3.</dd>
     46       1.1.1.2  christos       <dt><tt>minimum <i>min</i></tt></dt>
     47  1.1.1.3.14.1   msaitoh       <dd>Specify the minimum interpacket spacing (guard time) in seconds
     48  1.1.1.3.14.1   msaitoh 	with default 2.</dd>
     49       1.1.1.2  christos       <dt><tt>monitor</tt></dt>
     50  1.1.1.3.14.1   msaitoh       <dd>Specify the probability of being recorded for packets that
     51  1.1.1.3.14.1   msaitoh 	overflow the MRU list size limit set by <tt>mru maxmem</tt>
     52  1.1.1.3.14.1   msaitoh 	or <tt>mru maxdepth</tt>. This is a performance optimization for
     53  1.1.1.3.14.1   msaitoh 	servers with aggregate arrivals of 1000 packets per second or
     54  1.1.1.3.14.1   msaitoh 	more.</dd>
     55       1.1.1.2  christos     </dl>
     56       1.1.1.2  christos   </dd>
     57  1.1.1.3.14.1   msaitoh   <dt id="restrict"><tt>restrict [-4 | -6] default [ippeerlimit <i>num</i>]
     58  1.1.1.3.14.1   msaitoh       [<i>flag</i>][...]<br>  restrict source [ippeerlimit <i>num</i>]
     59  1.1.1.3.14.1   msaitoh       [<i>flag</i>][...]<br>  restrict <i>address</i> [mask <i>mask</i>]
     60  1.1.1.3.14.1   msaitoh       [ippeerlimit <i>num</i>] [<i>flag</i>][...]</tt></dt>
     61  1.1.1.3.14.1   msaitoh   <dd>The <tt><i>address</i></tt> argument expressed in IPv4 or IPv6 numeric
     62  1.1.1.3.14.1   msaitoh     address form is the address of a host or network. Alternatively,
     63  1.1.1.3.14.1   msaitoh     the <tt><i>address</i></tt> argument can be a valid host DNS
     64  1.1.1.3.14.1   msaitoh     name. The <tt><i>mask</i></tt> argument expressed in IPv4 or IPv6
     65  1.1.1.3.14.1   msaitoh     numeric address form defaults to all mask bits on, meaning that
     66  1.1.1.3.14.1   msaitoh     the <tt><i>address</i></tt> is treated as the address of an individual
     67  1.1.1.3.14.1   msaitoh     host. A default entry (address 0.0.0.0, mask 0.0.0.0 for IPv4 and
     68  1.1.1.3.14.1   msaitoh     address :: mask :: for IPv6) is always the first entry in the
     69  1.1.1.3.14.1   msaitoh     list. <tt>restrict default</tt>, with no mask option, modifies both IPv4
     70  1.1.1.3.14.1   msaitoh     and IPv6 default entries. <tt>restrict source</tt> configures a template
     71  1.1.1.3.14.1   msaitoh     restriction automatically added at runtime for each association, whether
     72  1.1.1.3.14.1   msaitoh     configured, ephemeral, or preemptible, and removed when the association
     73  1.1.1.3.14.1   msaitoh     is demobilized.</dd>
     74  1.1.1.3.14.1   msaitoh   <dd>The optional <tt>ippeerlimit</tt> takes a numeric argument that
     75  1.1.1.3.14.1   msaitoh     indicates how many incoming (at present) peer requests will be permitted
     76  1.1.1.3.14.1   msaitoh     for each IP, regardless of whether or not the request comes from an
     77  1.1.1.3.14.1   msaitoh     authenticated source.  A value of -1 means "unlimited", which is the
     78  1.1.1.3.14.1   msaitoh     current default.  A value of 0 means "none".  Ordinarily one would
     79  1.1.1.3.14.1   msaitoh     expect at most 1 of these sessions to exist per IP, however if the
     80  1.1.1.3.14.1   msaitoh     remote side is operating thru a proxy there would be one association for
     81  1.1.1.3.14.1   msaitoh     each remote peer at that IP.</dd>
     82  1.1.1.3.14.1   msaitoh   <dd>Some flags have the effect to deny service, some have the effect to
     83  1.1.1.3.14.1   msaitoh     enable service and some are conditioned by other flags. The flags are
     84  1.1.1.3.14.1   msaitoh     not orthogonal, in that more restrictive flags will often make less
     85  1.1.1.3.14.1   msaitoh     restrictive ones redundant. The flags that deny service are classed in
     86  1.1.1.3.14.1   msaitoh     two categories, those that restrict time service and those that restrict
     87  1.1.1.3.14.1   msaitoh     informational queries and attempts to do run-time reconfiguration of the
     88  1.1.1.3.14.1   msaitoh     server. One or more of the following flags may be specified:</dd>
     89       1.1.1.2  christos   <dd>
     90       1.1.1.2  christos     <dl>
     91       1.1.1.2  christos       <dt><tt>flake</tt></dt>
     92  1.1.1.3.14.1   msaitoh       <dd>Discard received NTP packets with probability 0.1; that is, on
     93  1.1.1.3.14.1   msaitoh 	average drop one packet in ten. This is for testing and
     94  1.1.1.3.14.1   msaitoh 	amusement. The name comes from Bob Braden's <i>flakeway</i>, which
     95  1.1.1.3.14.1   msaitoh 	once did a similar thing for early Internet testing.</dd>
     96       1.1.1.2  christos       <dt><tt>ignore</tt></dt>
     97  1.1.1.3.14.1   msaitoh       <dd>Deny packets of all kinds, including <tt>ntpq</tt>
     98  1.1.1.3.14.1   msaitoh 	and <tt>ntpdc</tt> queries.</dd>
     99       1.1.1.2  christos       <dt><tt>kod</tt></dt>
    100  1.1.1.3.14.1   msaitoh       <dd>Send a kiss-o'-death (KoD) packet if the <tt>limited</tt> flag is
    101  1.1.1.3.14.1   msaitoh 	present and a packet violates the rate limits established by
    102  1.1.1.3.14.1   msaitoh 	the <tt>discard</tt> command. KoD packets are themselves rate
    103  1.1.1.3.14.1   msaitoh 	limited for each source address separately. If the <tt>kod</tt> flag
    104  1.1.1.3.14.1   msaitoh 	is used in a restriction which does not have the <tt>limited</tt>
    105  1.1.1.3.14.1   msaitoh 	flag, no KoD responses will result.</dd>
    106       1.1.1.2  christos       <dt id="limited"><tt>limited</tt></dt>
    107  1.1.1.3.14.1   msaitoh       <dd>Deny time service if the packet violates the rate limits
    108  1.1.1.3.14.1   msaitoh 	established by the <tt>discard</tt> command. This does not apply
    109  1.1.1.3.14.1   msaitoh 	to <tt>ntpq</tt> and <tt>ntpdc</tt> queries.</dd>
    110       1.1.1.2  christos       <dt><tt>lowpriotrap</tt></dt>
    111  1.1.1.3.14.1   msaitoh       <dd>Declare traps set by matching hosts to be low priority. The number
    112  1.1.1.3.14.1   msaitoh 	of traps a server can maintain is limited (the current limit is
    113  1.1.1.3.14.1   msaitoh 	3). Traps are usually assigned on a first come, first served basis,
    114  1.1.1.3.14.1   msaitoh 	with later trap requestors being denied service. This flag modifies
    115  1.1.1.3.14.1   msaitoh 	the assignment algorithm by allowing low priority traps to be
    116  1.1.1.3.14.1   msaitoh 	overridden by later requests for normal priority traps.</dd>
    117       1.1.1.2  christos       <dt><tt>mssntp</tt></dt>
    118  1.1.1.3.14.1   msaitoh       <dd>Enable Microsoft Windows MS-SNTP authentication using Active
    119  1.1.1.3.14.1   msaitoh 	Directory services. <span class="style1"><b>Note: Potential users
    120  1.1.1.3.14.1   msaitoh 	should be aware that these services involve a TCP connection to
    121  1.1.1.3.14.1   msaitoh 	another process that could potentially block, denying services to
    122  1.1.1.3.14.1   msaitoh 	other users. Therefore, this flag should be used only for a
    123  1.1.1.3.14.1   msaitoh 	dedicated server with no clients other than MS-SNTP.</b></span></dd>
    124  1.1.1.3.14.1   msaitoh       <dt><tt>noepeer</tt></dt>
    125  1.1.1.3.14.1   msaitoh       <dd>Deny packets that would mobilize an ephemeral peering association,
    126  1.1.1.3.14.1   msaitoh 	even if authenticated.</dd>
    127       1.1.1.2  christos       <dt><tt>nomodify</tt></dt>
    128  1.1.1.3.14.1   msaitoh       <dd>Deny <tt>ntpq</tt> and <tt>ntpdc</tt> queries which attempt to
    129  1.1.1.3.14.1   msaitoh 	modify the state of the server (i.e., run time
    130  1.1.1.3.14.1   msaitoh 	reconfiguration). Queries which return information are
    131  1.1.1.3.14.1   msaitoh 	permitted.</dd>
    132       1.1.1.2  christos       <dt><tt>noquery</tt></dt>
    133  1.1.1.3.14.1   msaitoh       <dd>Deny <tt>ntpq</tt> and <tt>ntpdc</tt> queries. Time service is not
    134  1.1.1.3.14.1   msaitoh 	affected.</dd>
    135       1.1.1.2  christos       <dt><tt>nopeer</tt></dt>
    136  1.1.1.3.14.1   msaitoh       <dd>Deny packets that might mobilize an association unless
    137  1.1.1.3.14.1   msaitoh 	authenticated. This includes broadcast, symmetric-active and
    138  1.1.1.3.14.1   msaitoh 	manycast server packets when a configured association does not
    139  1.1.1.3.14.1   msaitoh 	exist. It also includes <tt>pool</tt> associations, so if you want
    140  1.1.1.3.14.1   msaitoh 	to use servers from a <tt>pool</tt> directive and also want to
    141  1.1.1.3.14.1   msaitoh 	use <tt>nopeer</tt> by default, you'll want a <tt>"restrict source
    142  1.1.1.3.14.1   msaitoh 	..."</tt> line as well that does <i>not</i> include
    143  1.1.1.3.14.1   msaitoh 	the <tt>nopeer</tt> directive.  Note that this flag does not apply
    144  1.1.1.3.14.1   msaitoh 	to packets that do not attempt to mobilize an association. </dd>
    145       1.1.1.2  christos       <dt><tt>noserve</tt></dt>
    146  1.1.1.3.14.1   msaitoh       <dd>Deny all packets except <tt>ntpq</tt> and <tt>ntpdc</tt>
    147  1.1.1.3.14.1   msaitoh 	queries.</dd>
    148       1.1.1.2  christos       <dt><tt>notrap</tt></dt>
    149  1.1.1.3.14.1   msaitoh       <dd>Decline to provide mode 6 control message trap service to matching
    150  1.1.1.3.14.1   msaitoh 	hosts. The trap service is a subsystem of the <tt>ntpdc</tt> control
    151  1.1.1.3.14.1   msaitoh 	message protocol which is intended for use by remote event logging
    152  1.1.1.3.14.1   msaitoh 	programs.</dd>
    153       1.1.1.2  christos       <dt><tt>notrust</tt></dt>
    154  1.1.1.3.14.1   msaitoh       <dd>Deny packets that are not cryptographically authenticated. Note
    155  1.1.1.3.14.1   msaitoh 	carefully how this flag interacts with the <tt>auth</tt> option of
    156  1.1.1.3.14.1   msaitoh 	the <tt>enable</tt> and <tt>disable</tt> commands. If <tt>auth</tt>
    157  1.1.1.3.14.1   msaitoh 	is enabled, which is the default, authentication is required for all
    158  1.1.1.3.14.1   msaitoh 	packets that might mobilize an association. If <tt>auth</tt> is
    159  1.1.1.3.14.1   msaitoh 	disabled, but the <tt>notrust</tt> flag is not present, an
    160  1.1.1.3.14.1   msaitoh 	association can be mobilized whether or not
    161  1.1.1.3.14.1   msaitoh 	authenticated. If <tt>auth</tt> is disabled, but
    162  1.1.1.3.14.1   msaitoh 	the <tt>notrust</tt> flag is present, authentication is required
    163  1.1.1.3.14.1   msaitoh 	only for the specified address/mask range. </dd>
    164       1.1.1.2  christos       <dt><tt>ntpport</tt></dt>
    165  1.1.1.3.14.1   msaitoh       <dd>This is actually a match algorithm modifier, rather than a
    166  1.1.1.3.14.1   msaitoh         restriction flag. Its presence causes the restriction entry to be
    167  1.1.1.3.14.1   msaitoh         matched only if the source port in the packet is the standard NTP
    168  1.1.1.3.14.1   msaitoh         UDP port (123). A restrict line containing <tt>ntpport</tt> is
    169  1.1.1.3.14.1   msaitoh         considered more specific than one with the same address and mask,
    170  1.1.1.3.14.1   msaitoh         but lacking <tt>ntpport</tt>.</dd>
    171       1.1.1.2  christos       <dt><tt>version</tt></dt>
    172       1.1.1.2  christos       <dd>Deny packets that do not match the current NTP version.</dd>
    173       1.1.1.2  christos     </dl>
    174       1.1.1.2  christos   </dd>
    175  1.1.1.3.14.1   msaitoh   <dd>Default restriction list entries with the flags <tt>ignore,
    176  1.1.1.3.14.1   msaitoh       ntpport</tt>, for each of the local host's interface addresses are
    177  1.1.1.3.14.1   msaitoh       inserted into the table at startup to prevent the server from
    178  1.1.1.3.14.1   msaitoh       attempting to synchronize to its own time. A default entry is also
    179  1.1.1.3.14.1   msaitoh       always present, though if it is otherwise unconfigured; no flags are
    180  1.1.1.3.14.1   msaitoh       associated with the default entry (i.e., everything besides your own
    181  1.1.1.3.14.1   msaitoh       NTP server is unrestricted).</dd>
    182           1.1    kardel </dl>
    183           1.1    kardel <hr>
    184  1.1.1.3.14.1   msaitoh <script type="text/javascript" language="javascript"
    185  1.1.1.3.14.1   msaitoh src="scripts/footer.txt"></script>
    186           1.1    kardel </body>
    187       1.1.1.2  christos </html>
    188