NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38.

ntp-4.2.8p15 was released on 23 June 2020. It addresses 1 medium-severity security issue in ntpd, and provides 13 non-security bugfixes over 4.2.8p13.

Please see the NTP Security Notice for vulnerability and mitigation details.

---

Are you using Autokey in production? If so, please contact Harlan - he's got some questions for you.

5.2. Choosing Reference Clocks

There are many choices for reference clocks.

In increasing levels of precision they are:

• modem refclocks
• radio refclocks
  • only regionally available (see http://www.cl.cam.ac.uk/~mgk25/lf-clocks.html for an overview)
  • examples: DCF77 (Germany/Central Europe), MSF (UK, Northern/Western Europe), JJY (Japan), WWVB (USA)
  • antennas mostly do not need a free view to the sky, but need to be placed outside or near a window
  • Get permission to point to the URL for the nice antenna
• CDMA & GSM refclocks
  • only regionally available
  • Note that they are almost always slaved to GPS, so if you're looking for independant sources of time then adding CDMA/GSM refclocks to a mix already including GPS won't help
  • antennas can receive the signal inside buildings
• GPS refclocks
  • can be used globally
  • antennas must have a clear view of the sky and therefore can only be mounted outside (on a roof, for example)
  • Not all GPS clocks are suitable for time precision. Check that they provide a PPS (Periodic Pulse Signal) which provide a sub-milisecond precision signal and some sort of message (eg: standard NMEA messages) that indicates the date of the PPS signal. These messages (eg: NMEA) must also be syncronized with the PPS signal. Some models like Garmin 35 HVS have an high jitter in the NMEA messages which doesn't allow it to syncronize with NTP. Ask your vendor first and choose carefully.
• "atomic" PPS refclocks

A number of refclocks with combined technology are available in order to add more security, for example combined DCF77- and GPS-refclocks.

Besides the "Do-it-yourself" interfacing of a Simple Radio Clock to a PC page, the National Institute of Standards and Technology (NIST) in the United States maintains a list of Manufacturers of Time and Frequency Receivers with links to their web sites.

Here a collection of vendors for reference clocks which are definitely known to work with NTP:

• Oscilloquartz SA (OSA) (visit www.oscilloquartz.com) : GPS, GLONASS, IRIG, NMEA standalone and modular NTP appliances
• Meinberg (visit www.meinberg.de) : GPS, DCF77, IRIG, standalone NTP server appliances
• Hopf (visit www.hopf.com) : GPS, DCF77
• Symmetricom (visit www.symmetricom.com) : GPS, IRIG, standalone NTP server appliances; they bought Datum and Truetime
• FEI Zyfer (visit www.fei-zyfer.com) : Standalone NTP server appliances
• Timetools (visit www.TimeTools.co.uk) : GPS, MSF, DCF-77, stand-alone NTP server appliances.
• Galleon Systems (visit www.galsys.co.uk or www.atomic-clock.galleon.eu.com) : GPS, MSF, standalone NTP server appliances.

-- HarlanStenn - 30 Jul 2003
-- HeikoGerstung - 16 Jun 2004
-- HeikoGerstung - 21 Jul 2004