summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--roles/common/tasks/ntp.yml6
-rw-r--r--roles/common/templates/etc/iptables/services.j24
-rw-r--r--roles/common/templates/etc/ntp.conf.j214
3 files changed, 14 insertions, 10 deletions
diff --git a/roles/common/tasks/ntp.yml b/roles/common/tasks/ntp.yml
index 94d7696..f9a01c8 100644
--- a/roles/common/tasks/ntp.yml
+++ b/roles/common/tasks/ntp.yml
@@ -6,12 +6,10 @@
dest=/etc/ntp.conf
owner=root group=root
mode=0644
- register: r
notify:
- Restart ntp
+- meta: flush_handlers
+
- name: Start ntp
service: name=ntp state=started
- when: not r.changed
-
-- meta: flush_handlers
diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 3a470fa..db7edf1 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -7,8 +7,10 @@
out tcp 80,443 # HTTP/HTTPS
out udp 53 # DNS
out udp 67 # DHCP
-
{% if 'NTP-master' in group_names %}
+in udp 123 # NTP
+out udp 123 # NTP
+{% else %}
out udp 123 123 # NTP
{% endif %}
diff --git a/roles/common/templates/etc/ntp.conf.j2 b/roles/common/templates/etc/ntp.conf.j2
index 96cc16c..d46ba18 100644
--- a/roles/common/templates/etc/ntp.conf.j2
+++ b/roles/common/templates/etc/ntp.conf.j2
@@ -22,9 +22,13 @@ server ntp2.gbg.netnod.se iburst
server ntp1.sth.netnod.se iburst
server ntp2.sth.netnod.se iburst
{% else %}
-# Sychronize to our (stratum 2) NTP server through IPSec, to ensure our
-# network has a consistent time.
-server ntp.fripost.org iburst
+# Sychronize to our (stratum 2) NTP server, to ensure our network has a
+# consistent time.
+# TODO: use to pubkey authentication to unsure an attacker doesn't
+# impersonate our NTP server and gives us incorrect time.
+server ntp.fripost.org iburst
+server 0.se.pool.ntp.org iburst
+server 1.se.pool.ntp.org iburst
{% endif %}
@@ -37,8 +41,8 @@ server ntp.fripost.org iburst
# up blocking replies from your own upstream servers.
# By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify nopeer noquery
-restrict -6 default kod notrap nomodify nopeer noquery
+restrict -4 default limited kod nomodify notrap nopeer noquery
+restrict -6 default limited kod nomodify notrap nopeer noquery
# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1