# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.

restrict default nomodify notrap noquery

# Permit all access over the loopback interface.  This could
# be tightened as well, but to do so would effect some of
# the administrative functions.
restrict 127.0.0.1 

# -- CLIENT NETWORK -------
# Permit systems on this network to synchronize with this
# time service.  Do not permit those systems to modify the
# configuration of this service.  Also, do not use those
# systems as peers for synchronization.
# restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap


# --- OUR TIMESERVERS ----- 
server 0.rhel.pool.ntp.org
server 1.rhel.pool.ntp.org
server 2.rhel.pool.ntp.org

# --- NTP MULTICASTCLIENT ---
#multicastclient			# listen on default 224.0.1.1
# restrict 224.0.1.1 mask 255.255.255.255 nomodify notrap
# restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap



# --- GENERAL CONFIGURATION ---
#
# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. The
# default stratum is usually 3, but in this case we elect to use stratum
# 0. Since the server line does not have the prefer keyword, this driver
# is never used for synchronization, unless no other other
# synchronization source is available. In case the local host is
# controlled by some external source, such as an external oscillator or
# another protocol, the prefer keyword would cause the local host to
# disregard all other synchronization sources, unless the kernel
# modifications are in use and declare an unsynchronized condition.
#
server	127.127.1.0	# local clock
fudge	127.127.1.0 stratum 10	

#
# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
#
driftfile /var/lib/ntp/drift
broadcastdelay	0.008

#
# Keys file.  If you want to diddle your server at run time, make a
# keys file (mode 600 for sure) and define the key number to be
# used for making requests.
#
# PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote
# systems might be able to reset your clock at will. Note also that
# ntpd is started with a -A flag, disabling authentication, that
# will have to be removed as well.
#
keys		/etc/ntp/keys

# Specify the key identifier to use with the ntpq utility.
#controlkey 8
restrict 0.rhel.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 1.rhel.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
restrict 2.rhel.pool.ntp.org mask 255.255.255.255 nomodify notrap noquery
server pool.ntp.org
restrict pool.ntp.org mask 255.255.255.255 nomodify notrap noquery

#!/bin/bash
#
# ntpd          This shell script takes care of starting and stopping
#               ntpd (NTPv4 daemon).
#
# chkconfig: - 58 74
# description: ntpd is the NTPv4 daemon. \
# The Network Time Protocol (NTP) is used to synchronize the time of \
# a computer client or server to another server or reference time source, \
# such as a radio or satellite receiver or modem.

# Source function library.
. /etc/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

if [ -f /etc/sysconfig/ntpd ];then
        . /etc/sysconfig/ntpd
fi

ntpconf=/etc/ntp.conf
ntpstep=/etc/ntp/step-tickers


RETVAL=0
prog="ntpd"

sync_hwclock() {
        ARC=0
        SRM=0
        UTC=0

        if [ -f /etc/sysconfig/clock ]; then
           . /etc/sysconfig/clock

           # convert old style clock config to new values
           if [ "${CLOCKMODE}" = "GMT" ]; then
              UTC=true
           elif [ "${CLOCKMODE}" = "ARC" ]; then
              ARC=true
           fi
        fi

        CLOCKFLAGS="$CLOCKFLAGS --systohc"

        case "$UTC" in
            yes|true)   CLOCKFLAGS="$CLOCKFLAGS --utc";;
            no|false)   CLOCKFLAGS="$CLOCKFLAGS --localtime";;
        esac
        case "$ARC" in
            yes|true)   CLOCKFLAGS="$CLOCKFLAGS --arc";;
        esac
        case "$SRM" in
            yes|true)   CLOCKFLAGS="$CLOCKFLAGS --srm";;
        esac

        action $"Syncing hardware clock to system time" /sbin/hwclock $CLOCKFLAGS
}

readconf() {
        dostep=''
        dropstr=''
        OPTIND=1
        while getopts ":46aAbc:dD:f:gi:k:l:LnN:p:P:qr:s:t:u:v:V:x" args $OPTIONS;
        do
          case "$args" in
            x) dostep=yes;;
            c) ntpconf="$OPTARG";;
            u) dropstr="-U $(echo $OPTARG | sed 's/:.*//')";;
          esac
        done

        [ -x /usr/sbin/ntpd -a -f $ntpconf ] || exit 0

        tickers=''
        if [ -s "$ntpstep" ]; then
            tickers=$(sed 's/#.*//' $ntpstep)
            echo "$tickers" | grep -qi '[a-z0-9]' && dostep=yes || tickers=''
        fi
        if [ -n "$dostep" -a -z "$tickers" ]; then
            # -x option is used, but step-tickers doesn't exist or contain
            # anything useful, use servers from ntp.conf instead
            tickers=$(awk '$1=="peer"||$1=="server"{print $2}' $ntpconf | \
                fgrep -v 127.127.1.0)
        fi
}

start() {
        # Check that networking is up.
        [ "$NETWORKING" = "no" ] && exit 1

        readconf;

        if [ -n "$dostep" ]; then
            echo -n $"$prog: Synchronizing with time server: "
            /usr/sbin/ntpdate $dropstr -s -b $NTPDATE_OPTIONS $tickers &>/dev/null
            RETVAL=$?
            [ $RETVAL -eq 0 ] && success || failure
            echo
            if [ $RETVAL -eq 0 ]; then
                [ "$SYNC_HWCLOCK" = "yes" ] && sync_hwclock
            else
                OPTIONS="$OPTIONS -g"
            fi
        else
            # -g can replace the grep for time servers
            # as it permits ntpd to violate its 1000s limit once.
            OPTIONS="$OPTIONS -g"
        fi
        # Start daemons.
        echo -n $"Starting $prog: "
        daemon ntpd $OPTIONS
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/ntpd
        return $RETVAL
}

stop() {
        echo -n $"Shutting down $prog: "
        killproc ntpd
        RETVAL=$?
        echo
        [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/ntpd
        return $RETVAL
}

# See how we were called.
case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  status)
        status ntpd
        RETVAL=$?
        ;;
  restart|reload)
        stop
        start
        RETVAL=$?
        ;;
  condrestart)
        if [ -f /var/lock/subsys/ntpd ]; then
            stop
            start
            RETVAL=$?
        fi
        ;;
  *)
        echo $"Usage: $0 {start|stop|restart|condrestart|status}"
        RETVAL=3
esac

exit $RETVAL

# Drop root to id 'ntp:ntp' by default.
OPTIONS="-u ntp:ntp -p /var/run/ntpd.pid"

# Set to 'yes' to sync hw clock after successful ntpdate
SYNC_HWCLOCK=no

# Additional options for ntpdate
NTPDATE_OPTIONS=""