Viewing A List Of Server Restrictions; Adding A Server Restriction - Siemens RUGGEDCOM ROX II User Manual

Chapter 5
Setup and Configuration
Section 5.12.14.1

Viewing a List of Server Restrictions

To view a list of NTP server restrictions, type:
show running-config services ntp restrict
If restrictions have been configured, a table or list similar to the following example appears:
ruggedcom# show running-config services ntp restrict | tab
NAME MASK
---------------------------
127.0.0.1 default
!
!
If no server restrictions have been configured, add restrictions as needed. For more information, refer to
Section 5.12.14.2, "Adding a Server
Section 5.12.14.2

Adding a Server Restriction

To add an NTP server restriction, do the following:
1. Make sure the CLI is in Configuration mode.
2. Add the restriction by typing:
services ntp restrict address mask
Where:
• address is the IP address to match. The address can be a host or network IP address, or a valid host
DNS name.
• mask is the mask used to match the address. A value of 255.255.255.255 indicates the address is treated
as the address of an individual host.
3. Configure the following parameter(s) as required:
CAUTION!
Security hazard – risk of unauthorized access and/or exploitation. It is recommended to restrict
queries via ntpdc and ntpq, unless the queries come from a localhost, or to disable this feature
entirely if not required. This prevents DDoS (Distributed Denial of Service) reflection/amplification
attacks. To set this restriction, configure the following flags: kod, nomodify, nopeer, noquery
and notrap.
Parameter
flags { flags }
228
FLAGS
-
Restriction".
Description
Synopsis: { ignore, kod, limited, lowpriotrap, nomodify, nopeer,
noquery, noserve, notrap, notrust, ntpport, version }
Flags restrict access to NTP services. An entry
with no flags allows free access to the NTP server.
<itemizedlist><listitem>Version: Denies packets that do not
match the current NTP version.</listitem> <listitem>ntpport:
Matches only if the source port in the packet is the standard
NTP UDP port (123).</listitem> <listitem>notrust: Denies service
unless the packet is cryptographically authenticated.</listitem>
<listitem>notrap: Declines to to provide mode 6 control message
Viewing a List of Server Restrictions
RUGGEDCOM ROX II
CLI User Guide