|
|
1. Prerequisites
|
|
|
----------------
|
|
|
|
|
|
You will need an entropy (randomness) source. If your OS has arc4random or
|
|
|
getentropy then that is ideal. Otherwise, you can use the builtin arc4random
|
|
|
implementation or the one built into LibreSSL.
|
|
|
|
|
|
2. Building / Installation
|
|
|
--------------------------
|
|
|
|
|
|
If you have checked this source using Git, follow these initial steps to
|
|
|
prepare the source tree for building:
|
|
|
|
|
|
1. ensure you have the following packages installed:
|
|
|
automake, autoconf, git, libtool, bison
|
|
|
2. run './autogen.sh' to prepare the source tree for building
|
|
|
or run './dist.sh' to prepare a tarball.
|
|
|
|
|
|
To install OpenNTPD with default options:
|
|
|
|
|
|
./configure
|
|
|
make
|
|
|
make install
|
|
|
|
|
|
This will install the OpenNTPD binary in /usr/local/sbin, configuration
|
|
|
files in /usr/local/etc. To specify a different installation prefix,
|
|
|
use the --prefix option to configure:
|
|
|
|
|
|
./configure --prefix=/opt
|
|
|
make
|
|
|
make install
|
|
|
|
|
|
Will install OpenNTPD in /opt/{etc,sbin}. You can also override
|
|
|
specific paths, for example:
|
|
|
|
|
|
./configure --prefix=/opt --sysconfdir=/etc/ntp
|
|
|
make
|
|
|
make install
|
|
|
|
|
|
This will install the binaries in /opt/sbin, but will place the
|
|
|
configuration files in /etc/ntp.
|
|
|
|
|
|
OpenNTPD always uses Privilege Separation (ie the majority of the
|
|
|
processing is done as a chroot'ed, unprivileged user).
|
|
|
|
|
|
This requires that a user, group and directory to be created for it.
|
|
|
The user should not be permitted to log in, and its home directory
|
|
|
should be owned by root and be mode 755.
|
|
|
|
|
|
If you do "make install", the Makefile will create the directory with
|
|
|
the correct permissions and will prompt you for the rest if required.
|
|
|
If, however, you need to perform all of these tasks yourself (eg if you
|
|
|
are moving the built binaries to another system) then you will need to
|
|
|
do something like the following (although the exact commands required
|
|
|
for creating the user and group are system dependant):
|
|
|
|
|
|
On most Linux and BSD systems, something like should work:
|
|
|
|
|
|
groupadd _ntp
|
|
|
useradd -g _ntp -s /sbin/nologin -d /var/empty -c 'OpenNTP daemon' _ntp
|
|
|
mkdir -p /var/empty
|
|
|
chown 0 /var/empty
|
|
|
chgrp 0 /var/empty
|
|
|
chmod 0755 /var/empty
|
|
|
|
|
|
/var/empty here is a chroot directory used by ntpd for privilege separation of
|
|
|
the DNS and NTP processes. This directory should not contain any files, must be
|
|
|
owned by root, and must not be group or world-writable.
|
|
|
|
|
|
NOTE:
|
|
|
If you installed a previous OpenNTPD release and created a /var/empty/ntp
|
|
|
directory, please delete the /var/empty/ntp directory and adjust the _ntp
|
|
|
user's home directory to point to /var/empty instead.
|
|
|
|
|
|
This is important because, if you have any other daemons that also use
|
|
|
/var/empty as a home directory, they will all have an empty privilege
|
|
|
separation directory.
|
|
|
|
|
|
As of OS X 10.10, something like this should work similarly
|
|
|
(thanks to jasper@ for suggesting)
|
|
|
|
|
|
dscl . create /Users/_ntp
|
|
|
dscl . create /Users/_ntp UserShell /sbin/nologin
|
|
|
# Prevent user from showing up on the login screen
|
|
|
dscl . delete /Users/_ntp AuthenticationAuthority
|
|
|
# Arbitrarily chosen UID that was free
|
|
|
dscl . create /Users/_ntp UniqueID 400
|
|
|
dscl . create /Users/_ntp PrimaryGroupID 400
|
|
|
dscl . create /Users/_ntp RealName "OpenNTPD user"
|
|
|
dseditgroup -o create _ntp
|
|
|
dscl . append /Groups/_ntp GroupMembership _ntp
|
|
|
|
|
|
There are a few options to the configure script in addition to the ones
|
|
|
provided by autoconf itself:
|
|
|
|
|
|
--with-privsep-user=[user]
|
|
|
Specify unprivileged user used for privilege separation. The default
|
|
|
is "_ntp".
|
|
|
|
|
|
--with-privsep-path=path
|
|
|
ntpd will always use the home directory of the privsep user
|
|
|
to chroot to, but specifying this parameter will change the
|
|
|
post-installation checks and instructions to match the specified path.
|
|
|
|
|
|
--with-cacert=[path]
|
|
|
Specify the CA certificate location for HTTPS constraint validation.
|
|
|
Defaults to /etc/ssl/certs/ca-certificates.crt
|
|
|
|
|
|
If you need to pass special options to the compiler or linker, you
|
|
|
can specify these as environment variables before running ./configure.
|
|
|
For example:
|
|
|
|
|
|
CFLAGS="-O2 " LDFLAGS="-s" ./configure
|
|
|
|
|
|
|
|
|
3. Configuration
|
|
|
----------------
|
|
|
|
|
|
The runtime configuration files are installed by in ${prefix}/etc or
|
|
|
whatever you specified as your --sysconfdir (/usr/local/etc by default).
|
|
|
|
|
|
If no configuration file exists, the default one is used. The default
|
|
|
configuration file uses a selection of publicly accessible "pool" servers
|
|
|
(see http://support.ntp.org/bin/view/Servers/NTPPoolServers)
|
|
|
|
|
|
|
|
|
4. Problems?
|
|
|
------------
|
|
|
|
|
|
If you experience problems compiling, installing or running OpenNTPD,
|
|
|
please report the problem to the address in the README file.
|