NTP local query always times out

Question

I have a CentOS 6.4 server, it does not have any iptable rules, it runs NTP daemon as service using the following configuration:

  driftfile /var/lib/ntp/drift

  server 0.pool.ntp.org
  server 1.pool.ntp.org
  server 2.pool.ntp.org
  server 3.pool.ntp.org

  restrict default ignore
  restrict 127.0.0.1

When I run ntpq to query peers, the following response is received:

ntpq> peers
localhost.localdomain: timed out, nothing received

dig shows that:

localhost.localdomain.  86400   IN  A   127.0.0.1

Why doesn't ntp query work?

And ntp-daemon is actually running? Try `grep ntp /var/log*` to see if there are some notices which might help? — , Dec 02 '13 at 07:27
are you able to ping `0.pool.ntp.org` and others in the list ? — slayedbylucifer, Dec 02 '13 at 08:42
Do you have an entry for localhost or localhost.localdomain in /etc/hosts? The system will look here first, before checking DNS. — , Apr 08 '14 at 11:26

score 11 · Answer 1 · edited Oct 30 '17 at 15:54

On RHEL / CentOS 6 and 7, for whatever reason ntpq tries to query the IPv6 loopback at ::1 instead of the IPv4 loopback at 127.0.0.1. With this in mind, I added this line to my /etc/ntp.conf file:

restrict ::1

Saved the file then restarted ntpd

service ntpd restart

now the command:

ntpq -p

works as expected. (This is the same as running ntpq in command-line mode and then issuing the peers command.)

I prefer this solution since you do not have to enable communications with ntpd via a potentially public Ethernet interface, which may be a security concern.

Howard · Accepted Answer · 2013-12-02T10:45:46.730

2

I was expecting ntpq to query local server via 127.0.0.1, but it turns out to be querying local server via ethernet network interface.

Although I have no idea why a local ntp query would have to go through ethernet, but in configuration file I added

restrict <eht0 ip address>

And now NTP works fine.

edited Dec 02 '13 at 10:45

answered Dec 02 '13 at 10:39

Howard

303
2
4
11

Is this actually safe? Ie would that give public access somehow? – Tuinslak Dec 28 '16 at 07:32

score 0 · Answer 3 · answered Dec 18 '15 at 03:10

When read the second answer, I realize the reason of this issue which maybe on /etc/hosts. Then add localhost on /etc/hosts and retry, it works.

127.0.0.1       localhost

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Before:

ems@rack6-storage-2:~$ sudo service ntp stop ; sudo ntpdate 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org ; sudo service ntp start ; PATH=/usr/bin:/usr/sbin ntpdc -p
 * Stopping NTP server ntpd
   ...done.
18 Dec 08:18:31 ntpdate[35729]: adjust time server 202.156.0.34 offset -0.000467 sec
 * Starting NTP server ntpd
   ...done.
localhost.sdcorp.global.sandisk.com: timed out, nothing received
***Request timed out

After:

ems@rack6-storage-2:~$ sudo vim /etc/hosts
ems@rack6-storage-2:~$ sudo service ntp stop ; sudo ntpdate 0.debian.pool.ntp.org 1.debian.pool.ntp.org 2.debian.pool.ntp.org 3.debian.pool.ntp.org ; sudo service ntp start ; PATH=/usr/bin:/usr/sbin ntpdc -p
 * Stopping NTP server ntpd
   ...done.
18 Dec 08:27:09 ntpdate[36056]: adjust time server 202.156.0.34 offset 0.015872 sec
 * Starting NTP server ntpd
   ...done.
     remote           local      st poll reach  delay   offset    disp
=======================================================================
=golem.canonical 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=frontier.innola 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=sg01.7asecond.c 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=time2.maxonline 10.242.43.103   16   64    0 0.00000  0.000000 4.00000
=pontoon.latt.ne 10.242.43.103   16   64    0 0.00000  0.000000 4.00000

score 0 · Answer 4 · answered Jan 14 '19 at 07:38

0

Disable IPv6 if you do not use it, add the following in interface configuration file:

# cat /etc/sysconfig/network-scripts/ifcfg-eth0           
....
IPV6INIT="no"
....

Then apply via restarting network and ntpd services. This helped to me.

answered Jan 14 '19 at 07:38

Sasha Golikov

283
2
8

score -2 · Answer 5 · answered Apr 10 '17 at 13:41

-2

People should read more carefully given configs before they are suggesting "reinstall". The mistake is very obvious.

From what I see, you have configured an NTP SERVER but you are pointing that to a POOL

server 0.pool.ntp.org

Try

pool 0.pool.ntp.org

instead or use "server" with a dedicated server, not a pool.

answered Apr 10 '17 at 13:41

ronator

1

2

That just shouldn't matter, as the `pool` directive just resolves more IP addresses behind the *0.pool.ntp.org* alias, where as the `server` directive just resolves one address from DNS and sticks to it. – Thomas Apr 12 '17 at 08:52

NTP local query always times out

5 Answers5