summaryrefslogtreecommitdiffstats
path: root/roles/common/templates
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common/templates')
-rw-r--r--roles/common/templates/etc/iptables/services.j24
-rw-r--r--roles/common/templates/etc/ntp.conf.j214
2 files changed, 12 insertions, 6 deletions
diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 3a470fa..db7edf1 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -7,8 +7,10 @@
out tcp 80,443 # HTTP/HTTPS
out udp 53 # DNS
out udp 67 # DHCP
-
{% if 'NTP-master' in group_names %}
+in udp 123 # NTP
+out udp 123 # NTP
+{% else %}
out udp 123 123 # NTP
{% endif %}
diff --git a/roles/common/templates/etc/ntp.conf.j2 b/roles/common/templates/etc/ntp.conf.j2
index 96cc16c..d46ba18 100644
--- a/roles/common/templates/etc/ntp.conf.j2
+++ b/roles/common/templates/etc/ntp.conf.j2
@@ -22,9 +22,13 @@ server ntp2.gbg.netnod.se iburst
server ntp1.sth.netnod.se iburst
server ntp2.sth.netnod.se iburst
{% else %}
-# Sychronize to our (stratum 2) NTP server through IPSec, to ensure our
-# network has a consistent time.
-server ntp.fripost.org iburst
+# Sychronize to our (stratum 2) NTP server, to ensure our network has a
+# consistent time.
+# TODO: use to pubkey authentication to unsure an attacker doesn't
+# impersonate our NTP server and gives us incorrect time.
+server ntp.fripost.org iburst
+server 0.se.pool.ntp.org iburst
+server 1.se.pool.ntp.org iburst
{% endif %}
@@ -37,8 +41,8 @@ server ntp.fripost.org iburst
# up blocking replies from your own upstream servers.
# By default, exchange time with everybody, but don't allow configuration.
-restrict -4 default kod notrap nomodify nopeer noquery
-restrict -6 default kod notrap nomodify nopeer noquery
+restrict -4 default limited kod nomodify notrap nopeer noquery
+restrict -6 default limited kod nomodify notrap nopeer noquery
# Local users may interrogate the ntp server more closely.
restrict 127.0.0.1