Fix NTP configuration.

We've yet to get authenticated time, though.

3 files changed, 14 insertions, 10 deletions

diff --git a/roles/common/tasks/ntp.yml b/roles/common/tasks/ntp.yml
index 94d7696..f9a01c8 100644
--- a/roles/common/tasks/ntp.yml
+++ b/roles/common/tasks/ntp.yml
@@ -1,17 +1,15 @@
 - name: Install ntp
   apt: pkg=ntp
 
 - name: Configure ntp
   template: src=etc/ntp.conf.j2
             dest=/etc/ntp.conf
             owner=root group=root
             mode=0644
-  register: r
   notify:
     - Restart ntp
 
+- meta: flush_handlers
+
 - name: Start ntp
   service: name=ntp state=started
-  when: not r.changed
-
-- meta: flush_handlers
diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 3a470fa..db7edf1 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -1,31 +1,33 @@
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 #
 # direction              protocol     destination port            source port
 # (in|out|inout)[46]?    (tcp|udp|..) (port|port:port|port,port)  (port|port:port|port,port)
 
 out     tcp     80,443                                  # HTTP/HTTPS
 out     udp     53                                      # DNS
 out     udp     67                                      # DHCP
-
 {% if 'NTP-master' in group_names %}
+in      udp     123                                     # NTP
+out     udp     123                                     # NTP
+{% else %}
 out     udp     123      123                            # NTP
 {% endif %}
 
 in      tcp     {{ ansible_ssh_port|default('22') }}    # SSH
 {% if 'LDAP-provider' in group_names %}
 in      tcp     636                                     # LDAPS
 {% elif 'MX' in group_names or  'lists' in group_names %}
 out     tcp     636                                     # LDAPS
 {% endif %}
 {% if 'MX' in group_names %}
 in      tcp     25                                      # SMTP
 out     tcp     {{ postfix_instance.IMAP.port }}
 out     tcp     {{ postfix_instance.lists.port }}
 {% endif %}
 {% if 'out' in group_names %}
 in      tcp     {{ postfix_instance.out.port }}
 out     tcp     25                                      # SMTP
 {% else %}
 out     tcp     {{ postfix_instance.out.port }}
 {% endif %}
diff --git a/roles/common/templates/etc/ntp.conf.j2 b/roles/common/templates/etc/ntp.conf.j2
index 96cc16c..d46ba18 100644
--- a/roles/common/templates/etc/ntp.conf.j2
+++ b/roles/common/templates/etc/ntp.conf.j2
@@ -5,55 +5,59 @@ driftfile /var/lib/ntp/ntp.drift
 
 # Enable this if you want statistics to be logged.
 #statsdir /var/log/ntpstats/
 
 statistics loopstats peerstats clockstats
 filegen loopstats file loopstats type day enable
 filegen peerstats file peerstats type day enable
 filegen clockstats file clockstats type day enable
 
 
 # You do need to talk to an NTP server or two (or three).
 {% if 'NTP-master' in group_names %}
 # Use Stratum One Time Servers:
 # http://support.ntp.org/bin/view/Servers/StratumOneTimeServers
 server ntp1.sp.se         iburst
 server ntp2.sp.se         iburst
 server ntp2.gbg.netnod.se iburst
 server ntp1.sth.netnod.se iburst
 server ntp2.sth.netnod.se iburst
 {% else %}
-# Sychronize to our (stratum 2) NTP server through IPSec, to ensure our
-# network has a consistent time.
-server ntp.fripost.org iburst
+# Sychronize to our (stratum 2) NTP server, to ensure our network has a
+# consistent time.
+# TODO: use to pubkey authentication to unsure an attacker doesn't
+# impersonate our NTP server and gives us incorrect time.
+server ntp.fripost.org   iburst
+server 0.se.pool.ntp.org iburst
+server 1.se.pool.ntp.org iburst
 {% endif %}
 
 
 # Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
 # details.  The web page <http://support.ntp.org/bin/view/Support/AccessRestrictions>
 # might also be helpful.
 #
 # Note that "restrict" applies to both servers and clients, so a configuration
 # that might be intended to block requests from certain clients could also end
 # up blocking replies from your own upstream servers.
 
 # By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify nopeer noquery
-restrict -6 default kod notrap nomodify nopeer noquery
+restrict -4 default limited kod nomodify notrap nopeer noquery
+restrict -6 default limited kod nomodify notrap nopeer noquery
 
 # Local users may interrogate the ntp server more closely.
 restrict 127.0.0.1
 restrict ::1
 
 # Clients from this (example!) subnet have unlimited access, but only if
 # cryptographically authenticated.
 #restrict 192.168.123.0 mask 255.255.255.0 notrust
 
 
 # If you want to provide time to your local subnet, change the next line.
 # (Again, the address is an example only.)
 #broadcast 192.168.123.255
 
 # If you want to listen to time broadcasts on your local subnet, de-comment the
 # next lines.  Please do this only if you trust everybody on the network!
 #disable auth
 #broadcastclient