Friday, December 16, 2016

How to safely kill your NTP server

NTP is that service that typically quietly runs in the background on almost every single computer in the world. When a computer boots up for the first time, NTP gets configured and is almost never considered again. Why? Because for most people, it just works. Until the end of this century (Y2K + 100) or the next leap year second, most system administrators will happily not need to think about the wonders that NTP gives us.  There are, of course, always security considerations to make, but again, once those are addressed, NTP again fades to the back of your mind. 

If you are running your servers in Amazon, it's possible that your VPC doesn't permit access to external NTP peers. In this case, you may follow directions to set up your own NTP server. These were the exact directions my sys admin predecessor followed for the VPC I inherited at my current job. 

As it turns out, every one of the servers in our VPC needs external internet access and we configure that to route through a NAT. So, other than the security considerations of allowing traffic over port 123, there was no good reason to not rely on the public NTP peers. Great! So, that meant we could kill our internal NTP and save time and money by not hosting it.

So, how do you safely stop and shutdown your NTP server?

First up, the basics:
  1. Run a loop across all your servers and `grep 'server' /etc/ntp.conf | grep <ip|name>`. I just used a bash for-loop. 
    1. If you have any matches. Use a similar bash loop to replace the conf file and `sudo service ntpd stop; sudo service ntpd stop`. 
    2. Then run `ntpq -p` to confirm connections could be established with upstream peers.
  2. Check your image and the scripts that build them. If necessary, rebuild those.

Now you can feel pretty confident that everything you know about is configured properly. ...but what about what you don't know about?? Here's what I did:

  1. ssh ntp-server
  2. sudo service ntpd stop
  3. screen
  4. sudo nc -vulk -w 1 123
This sets up a dumb netcat UDP listener on NTP port 123. It will log all connections to the console. The `-w 1` is the only way I could contrive prevent the first connection from commandeering the process. It will time out the connection after 1 second; then combined with `-k`, it will keep listening for new connections. The screen is simply for the safety of knowing that this will keep running when I close my laptop, a.k.a. screen daemon. 

Let this run for a day and if you see any traffic in there, you'll know the IP address of the server trying to get at you for NTP info.

36 comments:

  1. Replies
    1. IEEE Final Year projects Project Centers in Chennai are consistently sought after. Final Year Students Projects take a shot at them to improve their aptitudes. IEEE Final Year project centers ground for all fragments of CSE & IT engineers hoping to assemble.Final Year Projects for CSE

      Spring Framework has already made serious inroads as an integrated technology stack for building user-facing applications. Spring Framework Corporate TRaining .

      Specifically, Spring Framework provides various tasks are geared around preparing data for further analysis and visualization. Spring Training in Chennai

      The Angular Training covers a wide range of topics including Angular Directives, Angular Services, and Angular programmability.Angular Training

      Delete
  2. The author has so wonderfully enthralled the consideration of group of onlookers by this radiant blog.
    Resumeyard

    ReplyDelete
  3. myTectra Placement Portal is a Web based portal brings Potentials Employers and myTectra Candidates on a common platform for placement assistance

    ReplyDelete

  4. Nice blog..! I really loved reading through this article. Thanks for sharing such a
    amazing post with us and keep blogging... iot training in chennai | iot training in chennai quora | iot training and placement in chennai | iot training center in chennai | best iot training centre in chennai

    ReplyDelete

  5. The post good and really helpful for more stuff click on the link below.

    shriram earth

    ReplyDelete
  6. Very nice post here thanks for it .I always like and such a super contents of these post.Excellent and very cool idea and great content of different kinds of the valuable information's.

    Check out : Machine learning training in chennai
    machine learning with python course in chennai
    machine learning course in chennai
    best training insitute for machine learning

    ReplyDelete
  7. Nice blog..! I really loved reading through this article. Thanks for sharing such a
    amazing post with us and keep blogging... best angularjs training institute in chennai | angularjs training in omr | angular 4 training in chennai | angularjs training in omr

    ReplyDelete
  8. Having read this I thought it was really informative. I appreciate you spending some time and effort to put this content together. I once again find myself personally spending a lot of time both reading and commenting. But so what, it was still worth it!
    Advanced Java Institute In Marathahalli
    Best Core Java Training in Bangalore
    Best Selenium Training Institute in Bangalore

    ReplyDelete

  9. Get the most advanced Hadoop Course by Professional expert. Just attend a FREE Demo session.
    call us @ 9884412301 | 9600112302
    Hadoop training in chennai | Hadoop training in velachery

    ReplyDelete
  10. For security reasons, all possible measures must be taken in order to ensure the full operation of all the necessary parameters.

    ReplyDelete
  11. When using the right method, you will be able to follow all rules correctly. Thanks for the algoritm. We are waiting for the next piece.

    ReplyDelete
  12. Nice post I have been searching for a useful post like this on salesforce course details, it is highly helpful for me and I have a great experience with this
    Salesforce Training Chennai

    ReplyDelete
  13. Hey, thanks for this great article I really like this post and I love your blog and also Check machine learning course in hyderabad at 360DIGITMG.
    360Digitmg machine learning course in hyderabad

    ReplyDelete
  14. Your blog is quite helpful to me and i am sure to others too. I appreciate your post, it is usually nice and contains useful information
    Home elevators
    Home lifts

    ReplyDelete
  15. Seen your gamer friends discussing dedicated game servers? Most serious games have considered investing in game servers at point or another. ark server hosting

    ReplyDelete
  16. Many homework on the continual hunt along with offstage on the road to winning. Definitely not attached, simple to-fall as a result of wayside; And not investigation, afterward into a path travel toward the black. https://serverbrowse.com/

    ReplyDelete
  17. You've completed in excellent work. t suggest to my frtends ind personilly wtll certitnly dtgtt. t'm conftdent they'll be gitned from thts webstte. https://serverbrowse.com/

    ReplyDelete
  18. I have read your blog it is very helpful for us. I couldn't find any knowledge on this matter prior to. I would like to thanks for sharing this article here. please Do keep sharing more blogs like this.

    IELTS Coaching in chennai

    German Classes in Chennai

    GRE Coaching Classes in Chennai

    TOEFL Coaching in Chennai

    spoken english classes in chennai | Communication training


    ReplyDelete
  19. Thanks for sharing an informative blog keep rocking bring more details.I like the helpful info you provide in your articles. I’ll bookmark your weblog and check again here regularly. I am quite sure I will learn much new stuff right here! Good luck for the next!
    Artificial Intelligence Training in Chennai

    Ai Training in Chennai

    Artificial Intelligence training in Bangalore

    Ai Training in Bangalore

    Artificial Intelligence Training in Hyderabad | Certification | ai training in hyderabad

    Artificial Intelligence Online Training

    Ai Online Training

    Blue Prism Training in Chennai

    ReplyDelete
  20. This is a wonderful article, Given so much info in it, Thanks for sharing. acte offers courses in new technologies and makes sure students understand the flow of work from each and every perspective in a Real-Time environment.PHP Training in Chennai

    PHP Online Training in Chennai

    Machine Learning Training in Chennai

    iOT Training in Chennai

    Blockchain Training in Chennai

    Open Stack Training in Chennai

    ReplyDelete
  21. Thanks for one marvelous posting! I enjoyed reading it; you are a great author. I will make sure to bookmark your blog and may come back someday. I want to encourage that you continue your great posts.
    oracle training in chennai

    oracle training institute in chennai

    oracle training in bangalore

    oracle training in hyderabad

    oracle training

    oracle online training

    hadoop training in chennai

    hadoop training in bangalore

    ReplyDelete
  22. Nice post I have been searching for a useful post like this on salesforce course details, it is highly helpful for me and I have a great experience with this.
    acte reviews

    acte velachery reviews

    acte tambaram reviews

    acte anna nagar reviews

    acte porur reviews

    acte omr reviews

    acte chennai reviews

    acte student reviews

    ReplyDelete
  23. its totaly depends upon you. if have good knowledge of OOPs then you can easily learn java and but if you you want to learn complete java course in 1 month and give only one hour to it then its littile bit diffcult. you should learn java from good sources.
    Java Training in Chennai

    Java Training in Bangalore

    Java Training in Hyderabad

    Java Training in Coimbatore

    Java Training
    [url=https://www.acte.in/java-training-in-chennai]Java Training in Chennai[\url]

    ReplyDelete
  24. Airlines are using it to predict weather condition and possible delays and to keep the passengers informed accordingly, while logistics companies like FedEx can discover best routes and best modes of transport to increase cost efficiency. data science course syllabus

    ReplyDelete