NTPリフレクション対策

実はもとから対策されている…!!

# vi /etc/ntp.conf


# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default kod nomodify notrap nopeer noquery ←確認 ※ipv4、ipv6共に全てのアクセスを拒否
restrict -6 default kod nomodify notrap nopeer noquery ←確認


# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.centos.pool.ntp.org iburst
server 1.centos.pool.ntp.org iburst
server 2.centos.pool.ntp.org iburst
server 3.centos.pool.ntp.org iburst


↓変更



# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
#server 0.centos.pool.ntp.org iburst
#server 1.centos.pool.ntp.org iburst
#server 2.centos.pool.ntp.org iburst
#server 3.centos.pool.ntp.org iburst
server -4 ntp.nict.jp iburst
server -4 ntp.nict.jp iburst
server -4 ntp.nict.jp iburst




※最終行に追加

# NTP Dos攻撃対策※ リモートからmonilistをされないようにする。
disable monitor

# service ntpd restart

# ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
*ntp-b3.nict.go. .NICT.           1 u   15   64    1    2.545   -0.366   0.072
+ntp-a3.nict.go. .NICT.           1 u   14   64    1    2.160   -0.336   0.087