Linux – Disable NTP server providing time sync to anonymous clients on the Internet

debianlinuxntp

Have set up a Linux server (Debian 8.7) and is wondering how I prohibit anonymous clients on the Internet to use my server for time sync?

Server has default ntp config – haven't touched anything yet.

Is it enough just to block port 123 udp incoming in the firewall?

Best Answer

You can just list the hosts which are allowed to use your ntp server. For example, if you want all devices from 192.168.0.0/24 network to get the time from your server, add the following line in your main ntp.conf cofnfiguration file (/etc/ntp.conf):

restrict 192.168.0.0 mask 255.255.255.0 [other options like nomodify noquery kod limit]

You can also implement a limit with iptables, or use it to block incoming connections to that port - whichever you like.