19c2daa00SOllivier Robert<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 29c2daa00SOllivier Robert<html> 39c2daa00SOllivier Robert<head> 4ea906c41SOllivier Robert<meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> 59c2daa00SOllivier Robert<meta name="generator" content="HTML Tidy, see www.w3.org"> 609100258SXin LI<title>Access Control Commands and Options</title> <!-- Changed by: Harlan 709100258SXin LI&, 13-Nov-2014 --> 89c2daa00SOllivier Robert<link href="scripts/style.css" type="text/css" rel="stylesheet"> 92b15cb3dSCy Schubert<style type="text/css"> 102b15cb3dSCy Schubert<!-- 112b15cb3dSCy Schubert<style1 { 1209100258SXin LIcolor: #FF0000; font-weight: bold; } --> 132b15cb3dSCy Schubert</style> 149c2daa00SOllivier Robert</head> 159c2daa00SOllivier Robert<body> 162b15cb3dSCy Schubert<h3>Access Control Commands and Options</h3> 1709100258SXin LI<img src="pic/pogo6.gif" alt="gif" 1809100258SXin LIalign="left"><a href="http://www.eecis.udel.edu/~mills/pictures.html">from <i>Pogo</i>, 1909100258SXin LIWalt Kelly</a> 209c2daa00SOllivier Robert<p>The skunk watches for intruders and sprays.</p> 2109100258SXin LI<p>Last update: <!-- #BeginDate format:En2m -->7-Jan-2018 23:56<!-- #EndDate 2209100258SXin LI --> UTC</p> 239c2daa00SOllivier Robert<br clear="left"> 249c2daa00SOllivier Robert<h4>Related Links</h4> 2509100258SXin LI<script type="text/javascript" language="javascript" 2609100258SXin LIsrc="scripts/command.txt"></script> 2709100258SXin LI<script type="text/javascript" language="javascript" 2809100258SXin LIsrc="scripts/accopt.txt"></script> 299c2daa00SOllivier Robert<hr> 302b15cb3dSCy Schubert<h4>Commands and Options</h4> 3109100258SXin LI<p>Unless noted otherwise, further information about these ccommands is on 3209100258SXin LIthe <a href="accopt.html">Access Control Support</a> page.</p> 339c2daa00SOllivier Robert<dl> 3409100258SXin LI <dt id="discard"><tt>discard [ average <i>avg</i> ][ minimum <i>min</i> ] 3509100258SXin LI [ monitor <i>prob</i> ]</tt></dt> 3609100258SXin LI <dd>Set the parameters of the rate control facility which protects the 3709100258SXin LI server from client abuse. If the <tt>limited</tt> flag is present in the 3809100258SXin LI ACL, packets that violate these limits are discarded. If, in addition, 3909100258SXin LI the <tt>kod</tt> flag is present, a kiss-o'-death packet is 4009100258SXin LI returned. See the <a href="rate.html">Rate Management</a> page for 4109100258SXin LI further information. The options are: 429c2daa00SOllivier Robert <dl> 432b15cb3dSCy Schubert <dt><tt>average <i>avg</i></tt></dt> 4409100258SXin LI <dd>Specify the minimum average interpacket spacing (minimum average 4509100258SXin LI headway time) in log<sub>2</sub> s with default 3.</dd> 462b15cb3dSCy Schubert <dt><tt>minimum <i>min</i></tt></dt> 4709100258SXin LI <dd>Specify the minimum interpacket spacing (guard time) in seconds 4809100258SXin LI with default 2.</dd> 492b15cb3dSCy Schubert <dt><tt>monitor</tt></dt> 5009100258SXin LI <dd>Specify the probability of being recorded for packets that 5109100258SXin LI overflow the MRU list size limit set by <tt>mru maxmem</tt> 5209100258SXin LI or <tt>mru maxdepth</tt>. This is a performance optimization for 5309100258SXin LI servers with aggregate arrivals of 1000 packets per second or 5409100258SXin LI more.</dd> 559c2daa00SOllivier Robert </dl> 562b15cb3dSCy Schubert </dd> 5709100258SXin LI <dt id="restrict"><tt>restrict [-4 | -6] default [ippeerlimit <i>num</i>] 58*2d4e511cSCy Schubert [<i>flag</i>][...]</tt></dt> 59*2d4e511cSCy Schubert <dt><tt>restrict source [ippeerlimit <i>num</i>] 60*2d4e511cSCy Schubert [<i>flag</i>][...]</tt></dt> 61*2d4e511cSCy Schubert <dt><tt>restrict <i>address</i> [mask <i>mask</i>] 6209100258SXin LI [ippeerlimit <i>num</i>] [<i>flag</i>][...]</tt></dt> 6309100258SXin LI <dd>The <tt><i>address</i></tt> argument expressed in IPv4 or IPv6 numeric 6409100258SXin LI address form is the address of a host or network. Alternatively, 6509100258SXin LI the <tt><i>address</i></tt> argument can be a valid host DNS 6609100258SXin LI name. The <tt><i>mask</i></tt> argument expressed in IPv4 or IPv6 6709100258SXin LI numeric address form defaults to all mask bits on, meaning that 6809100258SXin LI the <tt><i>address</i></tt> is treated as the address of an individual 6909100258SXin LI host. A default entry (address 0.0.0.0, mask 0.0.0.0 for IPv4 and 7009100258SXin LI address :: mask :: for IPv6) is always the first entry in the 7109100258SXin LI list. <tt>restrict default</tt>, with no mask option, modifies both IPv4 7209100258SXin LI and IPv6 default entries. <tt>restrict source</tt> configures a template 7309100258SXin LI restriction automatically added at runtime for each association, whether 7409100258SXin LI configured, ephemeral, or preemptible, and removed when the association 7509100258SXin LI is demobilized.</dd> 7609100258SXin LI <dd>The optional <tt>ippeerlimit</tt> takes a numeric argument that 7709100258SXin LI indicates how many incoming (at present) peer requests will be permitted 7809100258SXin LI for each IP, regardless of whether or not the request comes from an 7909100258SXin LI authenticated source. A value of -1 means "unlimited", which is the 8009100258SXin LI current default. A value of 0 means "none". Ordinarily one would 8109100258SXin LI expect at most 1 of these sessions to exist per IP, however if the 8209100258SXin LI remote side is operating thru a proxy there would be one association for 8309100258SXin LI each remote peer at that IP.</dd> 8409100258SXin LI <dd>Some flags have the effect to deny service, some have the effect to 8509100258SXin LI enable service and some are conditioned by other flags. The flags are 8609100258SXin LI not orthogonal, in that more restrictive flags will often make less 8709100258SXin LI restrictive ones redundant. The flags that deny service are classed in 8809100258SXin LI two categories, those that restrict time service and those that restrict 8909100258SXin LI informational queries and attempts to do run-time reconfiguration of the 9009100258SXin LI server. One or more of the following flags may be specified:</dd> 912b15cb3dSCy Schubert <dd> 922b15cb3dSCy Schubert <dl> 932b15cb3dSCy Schubert <dt><tt>flake</tt></dt> 9409100258SXin LI <dd>Discard received NTP packets with probability 0.1; that is, on 9509100258SXin LI average drop one packet in ten. This is for testing and 9609100258SXin LI amusement. The name comes from Bob Braden's <i>flakeway</i>, which 9709100258SXin LI once did a similar thing for early Internet testing.</dd> 982b15cb3dSCy Schubert <dt><tt>ignore</tt></dt> 9909100258SXin LI <dd>Deny packets of all kinds, including <tt>ntpq</tt> 10009100258SXin LI and <tt>ntpdc</tt> queries.</dd> 1012b15cb3dSCy Schubert <dt><tt>kod</tt></dt> 10209100258SXin LI <dd>Send a kiss-o'-death (KoD) packet if the <tt>limited</tt> flag is 10309100258SXin LI present and a packet violates the rate limits established by 10409100258SXin LI the <tt>discard</tt> command. KoD packets are themselves rate 10509100258SXin LI limited for each source address separately. If the <tt>kod</tt> flag 10609100258SXin LI is used in a restriction which does not have the <tt>limited</tt> 10709100258SXin LI flag, no KoD responses will result.</dd> 1082b15cb3dSCy Schubert <dt id="limited"><tt>limited</tt></dt> 10909100258SXin LI <dd>Deny time service if the packet violates the rate limits 11009100258SXin LI established by the <tt>discard</tt> command. This does not apply 11109100258SXin LI to <tt>ntpq</tt> and <tt>ntpdc</tt> queries.</dd> 1122b15cb3dSCy Schubert <dt><tt>lowpriotrap</tt></dt> 11309100258SXin LI <dd>Declare traps set by matching hosts to be low priority. The number 11409100258SXin LI of traps a server can maintain is limited (the current limit is 11509100258SXin LI 3). Traps are usually assigned on a first come, first served basis, 11609100258SXin LI with later trap requestors being denied service. This flag modifies 11709100258SXin LI the assignment algorithm by allowing low priority traps to be 11809100258SXin LI overridden by later requests for normal priority traps.</dd> 1192b15cb3dSCy Schubert <dt><tt>mssntp</tt></dt> 12009100258SXin LI <dd>Enable Microsoft Windows MS-SNTP authentication using Active 12109100258SXin LI Directory services. <span class="style1"><b>Note: Potential users 12209100258SXin LI should be aware that these services involve a TCP connection to 12309100258SXin LI another process that could potentially block, denying services to 12409100258SXin LI other users. Therefore, this flag should be used only for a 12509100258SXin LI dedicated server with no clients other than MS-SNTP.</b></span></dd> 12609100258SXin LI <dt><tt>noepeer</tt></dt> 12709100258SXin LI <dd>Deny packets that would mobilize an ephemeral peering association, 12809100258SXin LI even if authenticated.</dd> 1292b15cb3dSCy Schubert <dt><tt>nomodify</tt></dt> 13009100258SXin LI <dd>Deny <tt>ntpq</tt> and <tt>ntpdc</tt> queries which attempt to 13109100258SXin LI modify the state of the server (i.e., run time 13209100258SXin LI reconfiguration). Queries which return information are 13309100258SXin LI permitted.</dd> 1342b15cb3dSCy Schubert <dt><tt>noquery</tt></dt> 13509100258SXin LI <dd>Deny <tt>ntpq</tt> and <tt>ntpdc</tt> queries. Time service is not 13609100258SXin LI affected.</dd> 1372b15cb3dSCy Schubert <dt><tt>nopeer</tt></dt> 13809100258SXin LI <dd>Deny packets that might mobilize an association unless 13909100258SXin LI authenticated. This includes broadcast, symmetric-active and 14009100258SXin LI manycast server packets when a configured association does not 14109100258SXin LI exist. It also includes <tt>pool</tt> associations, so if you want 14209100258SXin LI to use servers from a <tt>pool</tt> directive and also want to 14309100258SXin LI use <tt>nopeer</tt> by default, you'll want a <tt>"restrict source 14409100258SXin LI ..."</tt> line as well that does <i>not</i> include 14509100258SXin LI the <tt>nopeer</tt> directive. Note that this flag does not apply 14609100258SXin LI to packets that do not attempt to mobilize an association. </dd> 1472b15cb3dSCy Schubert <dt><tt>noserve</tt></dt> 14809100258SXin LI <dd>Deny all packets except <tt>ntpq</tt> and <tt>ntpdc</tt> 14909100258SXin LI queries.</dd> 1502b15cb3dSCy Schubert <dt><tt>notrap</tt></dt> 15109100258SXin LI <dd>Decline to provide mode 6 control message trap service to matching 15209100258SXin LI hosts. The trap service is a subsystem of the <tt>ntpdc</tt> control 15309100258SXin LI message protocol which is intended for use by remote event logging 15409100258SXin LI programs.</dd> 1552b15cb3dSCy Schubert <dt><tt>notrust</tt></dt> 15609100258SXin LI <dd>Deny packets that are not cryptographically authenticated. Note 15709100258SXin LI carefully how this flag interacts with the <tt>auth</tt> option of 15809100258SXin LI the <tt>enable</tt> and <tt>disable</tt> commands. If <tt>auth</tt> 15909100258SXin LI is enabled, which is the default, authentication is required for all 16009100258SXin LI packets that might mobilize an association. If <tt>auth</tt> is 16109100258SXin LI disabled, but the <tt>notrust</tt> flag is not present, an 16209100258SXin LI association can be mobilized whether or not 16309100258SXin LI authenticated. If <tt>auth</tt> is disabled, but 16409100258SXin LI the <tt>notrust</tt> flag is present, authentication is required 16509100258SXin LI only for the specified address/mask range. </dd> 1662b15cb3dSCy Schubert <dt><tt>ntpport</tt></dt> 16709100258SXin LI <dd>This is actually a match algorithm modifier, rather than a 16809100258SXin LI restriction flag. Its presence causes the restriction entry to be 16909100258SXin LI matched only if the source port in the packet is the standard NTP 17009100258SXin LI UDP port (123). A restrict line containing <tt>ntpport</tt> is 17109100258SXin LI considered more specific than one with the same address and mask, 17209100258SXin LI but lacking <tt>ntpport</tt>.</dd> 173*2d4e511cSCy Schubert <dt><tt>serverresponse fuzz</tt></dt> 174*2d4e511cSCy Schubert <dd>When reponding to server requests, fuzz the low order bits of 175*2d4e511cSCy Schubert the <tt>reftime</tt>.</dd> 1762b15cb3dSCy Schubert <dt><tt>version</tt></dt> 1772b15cb3dSCy Schubert <dd>Deny packets that do not match the current NTP version.</dd> 1782b15cb3dSCy Schubert </dl> 1792b15cb3dSCy Schubert </dd> 18009100258SXin LI <dd>Default restriction list entries with the flags <tt>ignore, 18109100258SXin LI ntpport</tt>, for each of the local host's interface addresses are 18209100258SXin LI inserted into the table at startup to prevent the server from 18309100258SXin LI attempting to synchronize to its own time. A default entry is also 18409100258SXin LI always present, though if it is otherwise unconfigured; no flags are 18509100258SXin LI associated with the default entry (i.e., everything besides your own 18609100258SXin LI NTP server is unrestricted).</dd> 1879c2daa00SOllivier Robert</dl> 1889c2daa00SOllivier Robert<hr> 18909100258SXin LI<script type="text/javascript" language="javascript" 19009100258SXin LIsrc="scripts/footer.txt"></script> 1919c2daa00SOllivier Robert</body> 1929c2daa00SOllivier Robert</html> 193
