ntp

Table of Contents

1. Module Description - What the module does and why it is useful
2. Setup - The basics of getting started with ntp
3. Usage - Configuration options and additional functionality
4. Reference - An under-the-hood peek at what the module is doing and how
5. Limitations - OS compatibility, etc.
6. Development - Guide for contributing to the module

Module description

The ntp module installs, configures, and manages the NTP service across a range of operating systems and distributions.

Setup

Beginning with ntp

include ntp is enough to get you up and running. To pass in parameters specifying which servers to use:

class { 'ntp':
  servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
}

Usage

All parameters for the ntp module are contained within the main ntp class, so for any function of the module, set the options you want. See the common usages below for examples.

Install and enable NTP

include ntp

Change NTP servers

class { 'ntp':
  servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
}

Restrict who can connect

class { 'ntp':
  servers  => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
  restrict => ['127.0.0.1'],
}

Install a client that can't be queried

class { 'ntp':
  servers   => ['ntp1.corp.com', 'ntp2.corp.com'],
  restrict  => [
    'default ignore',
    '-6 default ignore',
    '127.0.0.1',
    '-6 ::1',
    'ntp1.corp.com nomodify notrap nopeer noquery',
    'ntp2.corp.com nomodify notrap nopeer noquery'
  ],
}

Listen on specific interfaces

Restricting NTP to a specific interface is especially useful on Openstack node, which may have numerous virtual interfaces.

class { 'ntp':
  servers  => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
  interfaces => ['127.0.0.1', '1.2.3.4']
}

Opt out of Puppet controlling the service

class { 'ntp':
  servers        => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
  restrict       => ['127.0.0.1'],
  service_manage => false,
}

Configure and run ntp without installing

class { 'ntp':
  package_manage => false,
}

Pass in a custom template

class { 'ntp':
  servers         => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
  restrict        => ['127.0.0.1'],
  service_manage  => false,
  config_epp      => 'different/module/custom.template.epp',
}

Reference

Classes

Public classes

• ntp: Main class, includes all other classes.

Private classes

• ntp::install: Handles the packages.
• ntp::config: Handles the configuration file.
• ntp::service: Handles the service.

Parameters

The following parameters are available in the ntp class:

authprov

Optional.

Data type: String.

Enables compatibility with W32Time in some versions of NTPd, such as Novell DSfW. Default value: undef.

broadcastclient

Data type: Boolean.

Enables reception of broadcast server messages to any local interface.

Default value: false.

config

Data type: Stdlib::Absolutepath.

Specifies a file for NTP's configuration info.

Default value: '/etc/ntp.conf' (Solaris: '/etc/inet/ntp.conf').

config_dir

Optional.

Data type: Stdlib::Absolutepath.

Specifies a directory for the NTP configuration files.

Default value: undef.

config_epp

Optional.

Data type: String.

Specifies an absolute or relative file path to an EPP template for the config file. Example value: 'ntp/ntp.conf.epp'. A validation error is thrown if both this and the config_template parameter are specified.

config_file_mode

Data type: String.

Specifies a file mode for the ntp configuration file.

Default value: '0664'.

config_template

Optional.

Data type: String.

Specifies an absolute or relative file path to an ERB template for the config file. Example value: 'ntp/ntp.conf.erb'. A validation error is thrown if both this and the config_epp parameter are specified.

disable_auth

Data type: Boolean.

Disables cryptographic authentication for broadcast client, multicast client, and symmetric passive associations.

disable_dhclient

Data type: Boolean.

Disables ntp-servers in dhclient.conf to prevent Dhclient from managing the NTP configuration.

disable_kernel

Data type: Boolean.

Disables kernel time discipline.

disable_monitor

Data type: Boolean.

Disables the monitoring facility in NTP.

Default value: true.

driftfile

Data type: Stdlib::Absolutepath.

Specifies the location of the NTP driftfile.

Default value: '/var/lib/ntp/drift' (AIX: 'ntp::driftfile:', Solaris: '/var/ntp/ntp.drift').

enable_mode7

Data type: Boolean.

Enables processing of NTP mode 7 implementation-specific requests which are used by the deprecated ntpdc program.

Default value: false.

fudge

Optional.

Data type: Array[String].

Provides additional information for individual clock drivers.

Default value: [ ].

iburst_enable

Data type: Boolean.

Specifies whether to enable the iburst option for every NTP peer.

Default value: false (AIX, Debian: true).

interfaces

Data type: Array[String].

Specifies one or more network interfaces for NTP to listen on.

Default value: [ ].

interfaces_ignore

Data type: Array[String].

Specifies one or more ignore pattern for the NTP listener configuration (for example: all, wildcard, ipv6).

Default value: [ ].

keys

Data type: Array[String].

Distributes keys to keys file.

Default value: [ ].

keys_controlkey

Optional.

Data type: Ntp::Key_id.

Specifies the key identifier to use with the ntpq utility. Value in the range of 1 to 65,534 inclusive.

Default value: ' '.

keys_enable

Data type: Boolean.

Whether to enable key-based authentication.

Default value: false.

keys_file

Stdlib::Absolutepath.

Specifies the complete path and location of the MD5 key file containing the keys and key identifiers used by ntpd, ntpq and ntpdc when operating with symmetric key cryptography.

Default value: '/etc/ntp.keys' (RedHat, Amazon: /etc/ntp/keys).

keys_requestkey

Optional.

Data type: Ntp::Key_id.

Specifies the key identifier to use with the ntpdc utility program. Value in the range of 1 to 65,534 inclusive.

Default value: ' '.

keys_trusted

Optional.

Data type: Array[Ntp::Key_id].

Provides one or more keys to be trusted by NTP.

Default value: [ ].

leapfile

Optional.

Data type: Stdlib::Absolutepath.

Specifies a leap second file for NTP to use.

Default value: ' '.

logfile

Optional.

Data type: Stdlib::Absolutepath.

Specifies a log file for NTP to use instead of syslog.

Default value: ' '.

minpoll

Optional.

Data type: Ntp::Poll_interval.

Sets Puppet to non-standard minimal poll interval of upstream servers. Values: 4 to 17. Default: undef.

maxpoll

Optional.

Data type: Ntp::Poll_interval.

Sets use non-standard maximal poll interval of upstream servers. Values: 4 to 17. Default option: undef(FreeBSD: 9).

ntpsigndsocket

Optional.

Data type: Stdlib::Absolutepath.

Sets NTP to sign packets using the socket in the ntpsigndsocket path. Requires NTP to be configured to sign sockets. Value: Path to the socket directory; for example, for Samba: usr/local/samba/var/lib/ntp_signd/.

Default value: undef.

package_ensure

Data type: String.

Whether to install the NTP package, and what version to install. Values: 'present', 'latest', or a specific version number.

Default value: 'present'.

package_manage

Data type: Boolean.

Whether to manage the NTP package.

Default value: true.

package_name

Data type: Array[String].

Specifies the NTP package to manage.

Default value: ['ntp'] (AIX: 'bos.net.tcp.client', Solaris: [ 'SUNWntp4r', 'SUNWntp4u' ]).

panic

Optional. Data type: Integer[0].

Whether NTP should panic and exit in the event of a very large clock skew. Applies only if tinker option set to true or if your environment is in a virtual machine.

Default value: undef (virtual environments: 0).

pool

Optional.

Data type: Array[String].

List of NTP server pools with which to synchronise the local clock.

Default value: [ ].

peers

Data type: Array[String].

List of NTP servers with which to synchronise the local clock.

preferred_servers

Data type: Array[String].

Specifies one or more preferred peers. Puppet appends 'prefer' to each matching item in the servers array.

Default value: [ ].

noselect_servers

Array[String] Specifies one or more peers to not sync with. Puppet appends 'noselect' to each matching item in the servers array. Default value: [ ].

restrict

Data type: Array[String].

Specifies one or more restrict options for the NTP configuration. Puppet prefixes each item with 'restrict', so you need to list only the content of the restriction.

Default value for most operating systems:

[
  'default kod nomodify notrap nopeer noquery',
  '-6 default kod nomodify notrap nopeer noquery',
  '127.0.0.1',
  '-6 ::1',
]

Default value for AIX systems:

[
  'default nomodify notrap nopeer noquery',
  '127.0.0.1',
]

servers

Data type: Array[String].

Specifies one or more servers to be used as NTP peers.

Default value: varies by operating system.

service_enable

Data type: Boolean.

Whether to enable the NTP service at boot.

Default value: true.

service_ensure

Data type: Enum['running', 'stopped'].

Whether the NTP service should be running.

Default value: 'running'.

service_manage

Data type: Boolean.

Whether to manage the NTP service.

Default value: true.

service_name

Data type: String.

The NTP service to manage.

Default value: varies by operating system.

service_provider

Data type: String.

Which service provider to use for NTP.

Default value: undef.

statistics

Data type: Array.

List of statistics to gather if ntp monitoring is enabled.

Default value: [].

statsdir

Data type: Stdlib::Absolutepath.

Location to store NTP statistics if ntp monitoring is enabled.

Default value: '/var/log/ntpstats'.

step_tickers_file

Optional.

Data type: Stdlib::Absolutepath.

Location of the step tickers file on the managed system.

Default value: varies by operating system.

step_tickers_epp

Optional.

Data type: String.

Location of the step tickers EPP template file. Validation error is thrown if both this and the step_tickers_template parameters are specified.

Default value: varies by operating system.

step_tickers_template

Optional.

Data type: String.

Location of the step tickers ERB template file. Validation error is thrown if both this and the step_tickers_epp parameter are specified.

Default value: varies by operating system.

stepout

Optional.

Data type: Integer[0, 65535].

Value for stepout if tinker value is true. Valid options: unsigned shortint digit.

Default value: undef.

tos

Data type: Boolean.

Whether to enable tos options.

Default value: false.

tos_maxclock

Optional.

Data type: Integer[1].

Specifies the maxclock tos option.

Default value: 6.

tos_minclock

Optional.

Data type: Integer[1].

Specifies the minclock tos option.

Default value: 3.

tos_minsane

Optional.

Data type: Integer[1].

Specifies the minsane tos option.

Default value: 1.

tos_floor

Optional.

Data type: Integer[1].

Specifies the floor tos option.

Default value: 1.

tos_ceiling

Optional.

Data type: Integer[1].

Specifies the ceiling tos option.

Default value: 15.

tos_cohort

Data type: Variant. Boolean, Integer[0,1].

Specifies the cohort tos option. Valid options: 0 or 1.

Default value: 0.

tinker

Data type: Boolean.

Whether to enable tinker options.

Default value: false.

udlc

Data type: Boolean.

Specifies whether to configure NTP to use the undisciplined local clock as a time source. Default value: false.

udlc_stratum

Optional. Data type: Integer[1,15].

Specifies the stratum the server should operate at when using the undisciplined local clock as the time source. This value should be set to no less than 10 if ntpd might be accessible outside your immediate, controlled network.

Default value: 10.

Limitations

This module has been tested on all PE-supported platforms. Additionally, it is tested (but not supported) on Solaris 10 and Fedora 20-22.

Development

Puppet modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. Please follow our guidelines when contributing changes.

For more information, see our module contribution guide.

Contributors

To see who's already involved, see the list of contributors.

Change log

All notable changes to this project will be documented in this file. The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Supported Release 7.0.0

Summary

Hiera 5 only works with Puppet 4.9.4 and above, we have bumped the Puppet requirement for the module accordingly.

Changed

• Update YAML to version 5 (PR 428)
• Updates the lower puppet version boundary to 4.9.4.

Supported Release 6.4.1

Summary

This release reverts a PR that implements Hiera 5. Issues have been seen due to compatibility issues. The issues that have been seen are (MODULES-5775) and (MODULES-5780).

Changed

• Reverts (PR 394)

Supported Release 6.4.0

Summary

This release is to both update the modules code so that it matches the set standards and make it so that all future prs are checked by Rubocop before release.

Added

• Rubocop is now enabled.

Changed

• All ruby code within module has been altered to match standards.

Supported Release 6.3.0

Summary

This is a feature release with some bugfixes and updated Japanese translations, too.

Added

• enable_mode7 parameter (defaults to false)
• disable monitor availability while setting stat properties

Changed

• Lower bound of Puppet requirement from 4.5.0 to 4.7.0
• hiera.yaml to Hiera version 5 format

Removed

• Ubuntu 10.04 and 12.04, Debian 6, SLES 10 SP4, and Fedora 20-23 support from metadata.json (existing compatibility remains)

Fixed

• Path to driftfile on Suse (MODULES-4941)
• Whitespace issue in ntp.conf.epp with tos
• Permissions on keys file

Supported Release 6.2.0

Summary

This is a small minor release that adds the pool parameter and revises some Japanese translations.

Added

• The pool parameter

Fixed

• Japanese translations for the README

Supported Release 6.1.0

Summary

This release adds support for internationalization of the module. It also contains Japanese translations for the README, summary and description of the metadata.json and major cleanups in the README. Additional folders have been introduced called locales and readmes where translation files can be found. A number of features and bug fixes are also included in this release.

Features

• Addition of POT file for metadata translation for i18n.
• Multiple Gemfile updates for Ruby and Gems support.
• (MODULES-4225) Addition of Puppet strings to the ntp module.
• Implements beaker module install helper and cleanup spec helper acceptance.rb.
• (MODULES-4414) Allow NTP statistics if requested.
• (MODULES-4278) Addition of noselect feature.
• Addition of 'pool' parameter.
• Addition of Ubuntu Xenial Support.

Bugfixes

• Huge readme updates for adding tags to private classes, edits for localization and general cleanups.
• (MODULES-3397) Fix of the default Solaris settings.
• Changed 'service_ensure' data type to Enum.
• (MODULES-3396) remove superfluous empty lines in ntp.conf.
• (MODULES-4528) Replace Puppet.version.to_f version comparison from spec helper.
• Solaris data that was the wrong way round now fixed.

Supported Releases 5.0.0 and 6.0.0

Summary

This double release adds new Puppet 4 features: data in modules, EPP templates, the $facts hash, and data types. The 5.0.0 release is fully backwards compatible to existing Puppet 4 configurations and provides you with deprecation warnings for every argument that will not work as expected with the final 6.0.0 release. See the stdlib docs for an in-depth discussion of this.

If you want to learn more about the new features used, have a look at the NTP: A Puppet 4 language update blog post.

If you're still running Puppet 3, remain on the latest puppetlabs-ntp 4.x release for now, and see the documentation to upgrade to Puppet 4.

Changes

• Data in modules: Moves all distribution and OS-dependent defaults into YAML files in data/, alleviating the need for a params class. Note that while this feature is currently still classed as experimental, the final implementation will support the changes here.
• EPP templating: Uses the Puppet language as a base for templates to create simpler and safer templates. No need for Ruby anymore! You can pass in EPP templates for the ntp.conf and step-tickers files using the new config_epp and step_tickers_epp parameters.
• The $facts hash: Makes facts visibly distinct from other variables for more readable and maintainable code. This helps eliminate confusion if you use a local variable whose name happens to match that of a common fact.
• Data types for validation: Helps you find and replace deprecated code in existing validate_* functions with stricter, more readable data type notation. First upgrade to the 5.0.0 release of this module, and address all deprecation warnings before upgrading to the final 6.0.0 release. Please see the stdlib docs for an in-depth discussion of this process.

Supported Release 4.2.0

Summary

A large release with many new features. Multiple additions to parameters and work contributed to OS compatibility. Also includes several bug fixes, including clean ups of code.

Features

• Updated spec helper for more consistency
• Addition of config_dir variable
• Addition of puppet TOS options
• Added support for disabling kernel time discipline in ntp.conf
• Update Solaris support for newer Facter, and Amazon for < 1.7.0 facter
• Added disable_dhclient parameter
• Added OpenSUSE 13.2 compatibility
• Parameterize file mode of config file
• Enhanced the default configuration
• Debian 8 compatibility
• Enabled usage of the $ntpsigndsocket parameter
• Added parameter for interfaces to ignore
• Added support for the authprov parameter
• Additional work done for SLES 12 compatibility
• Addition of key template options/ key distribution

Bugfixes

• Fix for strict variables and tests
• Fixed test with preferred server and iburst enabled
• Added logfile parameter test
• Cleaned out unused cleanup code and utilities from spec_helper
• Deprecated ntp_dirname function
• No longer manages the keys_file parent when it would be inappropriate to do so
• Converted license string to SPDX format
• Removed ruby 1.8.7 and puppet 2.7 from travis-ci jobs

Supported Release 4.1.2

###Summary

Small release for support of newer PE versions. This increments the version of PE in the metadata.json file.

Supported Release 4.1.1

Summary

This is a bugfix release to address security vulnerability CVE-2013-5211.

Bugfixes

• Changes the default behavior to disable monitoring as part of the solution for CVE-2013-5211.

2015-07-21 - Supported Release 4.1.0

Summary

This release updates metadata to support new version of puppet enterprise, as well as new features, bugfixes, and test improvements.

Features

• Adds Solaris 10 support
• Adds Fedora 20, 21, 22 compatibility

Bugfixes

• Fix default configuration for Debian (MODULES-2087)
• Fix to ensure log file is created before service starts
• Fixes SLES params for SLES 10, 11, 12

2015-05-26 - Supported Release 4.0.0

Summary

This release drops puppet 2.7 support and older stdlib support. It also includes the addition of 12 new properties, as well as numerous bug fixes and other improvements.

Backwards-incompatible changes

• UDLC (Undisciplined local clock) is now no longer enabled by default on anything (previous was enabled on non-virtual).
• Puppet 2.7 no longer supported
• puppetlabs-stdlib less than 4.5.0 no longer supported

Features

• Readme, Metadata, and Contribution documentation improvements
• Acceptance test improvements
• Added the broadcastclient property
• Added the disable_auth property
• Added broadcastclient property
• Added disable_auth property
• Added fudge property
• Added peers property
• Added udlc_stratum property
• Added tinker property
• Added minpoll property
• Added maxpoll property
• Added stepout property
• Added leapfile property

Bugfixes

• Removing equal sign as delimiter in ntp.conf for the logfile parameter.
• Add package_manage parameter, which is set to false by default on FreeBSD
• Fixed an issue with the is_virtual property
• Fixed debian wheezy issue
• Fix for Redhat to disable ntp restart due to dhcp ntp server updates

##2014-11-04 - Supported Release 3.3.0 ###Summary

This release adds support for SLES 12.

####Features

• Added support for SLES 12

##2014-10-02 - Supported Release 3.2.1 ###Summary

This is a bug-fix release addressing the security concerns of setting /etc/ntp to mode 0755 recursively.

####Bugfixes

• Do not recursively set ownership/mode of /etc/ntp

##2014-09-10 - Supported Release 3.2.0 ###Summary

This is primarily a feature release. It adds a few new parameters to class ntp and adds support for Solaris 11.

####Features

• Add the $interfaces parameter to ntp
• Add support for Solaris 10 and 11
• Synchronized files with modulesync
• Test updates
• Add the $iburst_enable parameter to ntp

####Bugfixes

• Fixes for strict variables
• Remove dependency on stdlib4

##2014-06-06 - Release 3.1.2 ###Summary

This is a supported release. This release fixes a manifest typo.

##2014-06-06 - Release 3.1.1 ###Summary

This is a bugfix release to get around dependency issues in PMT 3.6. This version has a dependency on puppetlabs-stdlib >= 4 so PE3.2.x is no longer supported.

####Bugfixes

• Remove deprecated Modulefile as it was causing duplicate dependencies with PMT.

##2014-05-14 - Release 3.1.0 ###Summary

This release adds disable_monitor so you can disable the monitor functionality of NTP, which was recently used in NTP amplification attacks. It also adds support for RHEL7 and Ubuntu 14.04.

####Features

• Add disable_monitor

####Bugfixes

#####Known Bugs

• No known bugs

##2014-04-09 - Supported Release 3.0.4 ###Summary This is a supported release.

The only functional change in this release is to split up the restrict defaults to be per operating system so that we can provide safer defaults for AIX, to resolve cases where IPv6 are disabled.

####Features

• Rework restrict defaults.

####Bugfixes

• Fix up a comment.
• Fix a test to work better on PE.

#####Known Bugs

• No known bugs

##2014-03-04 - Supported Release 3.0.3 ###Summary This is a supported release. Correct stdlib compatibility

####Bugfixes

• Remove dirname() call for correct stdlib compatibility.
• Improved tests

####Known Bugs

• No known bugs

2014-02-13 - Release 3.0.2

###Summary

No functional changes: Update the README and allow custom gem sources.

2013-12-17 - Release 3.0.1

Summary

Work around a packaging bug with symlinks, no other functional changes.

2013-12-13 - Release 3.0.0

Summary

Final release of 3.0, enjoy!

2013-10-14 - Version 3.0.0-rc1

###Summary

This release changes the behavior of restrict and adds AIX osfamily support.

####Backwards-incompatible Changes:

restrict no longer requires you to pass in parameters as:

restrict => [ 'restrict x', 'restrict y' ]

but just as:

restrict => [ 'x', 'y' ]

As the template now prefixes each line with restrict.

####Features

• Change the behavior of restrict so you no longer need the restrict keyword.
• Add udlc parameter to enable undisciplined local clock regardless of the machines status as a virtual machine.
• Add AIX support.

####Fixes

• Use class{} instead of including and then anchoring. (style)
• Extend Gentoo coverage to Facter 1.7.

##2013-09-05 - Version 2.0.1

###Summary

Correct the LICENSE file.

####Bugfixes

• Add in the appropriate year and name in LICENSE.

##2013-07-31 - Version 2.0.0

###Summary

The 2.0 release focuses on merging all the distro specific templates into a single reusable template across all platforms.

To aid in that goal we now allow you to change the driftfile, ntp keys, and perferred_servers.

####Backwards-incompatible changes

As all the distro specific templates have been removed and a unified one created you may be missing functionality you previously relied on. Please test carefully before rolling out globally.

Configuration directives that might possibly be affected:

• filegen
• fudge (for virtual machines)
• keys
• logfile
• restrict
• restrictkey
• statistics
• trustedkey

####Features:

• All templates merged into a single template.
• NTP Keys support added.
• Add preferred servers support.
• Parameters in ntp class:
  • driftfile: path for the ntp driftfile.
  • keys_enable: Enable NTP keys feature.
  • keys_file: Path for the NTP keys file.
  • keys_trusted: Which keys to trust.
  • keys_controlkey: Which key to use for the control key.
  • keys_requestkey: Which key to use for the request key.
  • preferred_servers: Array of servers to prefer.
  • restrict: Array of restriction options to apply.

###2013-07-15 - Version 1.0.1 ####Bugfixes

• Fix deprecated warning in autoupdate parameter.
• Correctly quote is_virtual fact.

##2013-07-08 - Version 1.0.0 ####Features

• Completely refactored to split across several classes.
• rspec-puppet tests rewritten to cover more options.
• rspec-system tests added.
• ArchLinux handled via osfamily instead of special casing.
• parameters in ntp class:
  • autoupdate: deprecated in favor of directly setting package_ensure.
  • panic: set to false if you wish to allow large clock skews.

##2011-11-10 Dan Bode dan@puppetlabs.com - 0.0.4

• Add Amazon Linux as a supported platform
• Add unit tests

##2011-06-16 Jeff McCune jeff@puppetlabs.com - 0.0.3

• Initial release under puppetlabs