[gentoo-commits] gentoo-x86 commit in net-misc/ntp/files: ntp.conf

[Robin H. Johnson (robbat2)]

robbat2     14/01/01 23:59:55

  Modified:             ntp.conf
  Log:
  Secure default configuration (approved by NTP upstream per IRC): by default deny all non-time queries so that monlist-based NTP reflection attacks are blocked; Rate-limit queries and issue KoD for limit-exceeded; Ensure IPv6 localhost is allowed as it is used by default.
  
  (Portage version: 2.2.7/cvs/Linux x86_64, unsigned Manifest commit)

Revision  Changes    Path
1.20                 net-misc/ntp/files/ntp.conf

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/ntp/files/ntp.conf?rev=1.20&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/ntp/files/ntp.conf?rev=1.20&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-misc/ntp/files/ntp.conf?r1=1.19&r2=1.20

Index: ntp.conf
===================================================================
RCS file: /var/cvsroot/gentoo-x86/net-misc/ntp/files/ntp.conf,v
retrieving revision 1.19
retrieving revision 1.20
diff -p -w -b -B -u -u -r1.19 -r1.20
--- ntp.conf	20 Jun 2009 12:05:58 -0000	1.19
+++ ntp.conf	1 Jan 2014 23:59:55 -0000	1.20
@@ -38,10 +38,12 @@ driftfile	/var/lib/ntp/ntp.drift
 #restrict default ignore
 
 
-# To deny other machines from changing the
-# configuration but allow localhost:
-restrict default nomodify nopeer
+# Default configuration:
+# - Allow only time queries, at a limited rate, sending KoD when in excess.
+# - Allow all local queries (IPv4, IPv6)
+restrict default nomodify nopeer noquery limited kod
 restrict 127.0.0.1
+restrict [::1]
 
 
 # To allow machines within your network to synchronize