From 929fc8ceb78e804900f1afc24d71f197c053a505 Mon Sep 17 00:00:00 2001 From: Andrea Dell'Amico Date: Thu, 3 May 2018 12:46:32 +0200 Subject: [PATCH] ntp: install a configuration that makes the nagios check work. --- ubuntu-deb-general/handlers/main.yml | 4 ++ ubuntu-deb-general/tasks/ntp.yml | 5 ++ ubuntu-deb-general/templates/ntp.conf.j2 | 69 ++++++++++++++++++++++++ 3 files changed, 78 insertions(+) create mode 100644 ubuntu-deb-general/templates/ntp.conf.j2 diff --git a/ubuntu-deb-general/handlers/main.yml b/ubuntu-deb-general/handlers/main.yml index fb906757..2c98ccf0 100644 --- a/ubuntu-deb-general/handlers/main.yml +++ b/ubuntu-deb-general/handlers/main.yml @@ -22,3 +22,7 @@ shell: update-ca-certificates tags: ca +- name: Restart ntp server + service: name=ntp state=restarted + + diff --git a/ubuntu-deb-general/tasks/ntp.yml b/ubuntu-deb-general/tasks/ntp.yml index 46a6692c..49217479 100644 --- a/ubuntu-deb-general/tasks/ntp.yml +++ b/ubuntu-deb-general/tasks/ntp.yml @@ -3,6 +3,11 @@ apt: pkg=ntp state={{ pkg_state }} tags: [ 'packages', 'ntp' ] +- name: Install the ntp configuration. Needed on Ubuntu Xenial to allow the nagios check + template: src=ntp.conf.j2 dest=/etc/ntp.conf owner=root group=root mode=0644 + notify: Restart ntp server + tags: [ 'packages', 'ntp' ] + - name: Ensure that the ntp server is running service: name=ntp state=started enabled=yes tags: [ 'packages', 'ntp' ] diff --git a/ubuntu-deb-general/templates/ntp.conf.j2 b/ubuntu-deb-general/templates/ntp.conf.j2 new file mode 100644 index 00000000..b4670dd6 --- /dev/null +++ b/ubuntu-deb-general/templates/ntp.conf.j2 @@ -0,0 +1,69 @@ +# /etc/ntp.conf, configuration for ntpd; see ntp.conf(5) for help + +driftfile /var/lib/ntp/ntp.drift + +# Enable this if you want statistics to be logged. +#statsdir /var/log/ntpstats/ + +statistics loopstats peerstats clockstats +filegen loopstats file loopstats type day enable +filegen peerstats file peerstats type day enable +filegen clockstats file clockstats type day enable + +# Specify one or more NTP servers. + +# Use servers from the NTP Pool Project. Approved by Ubuntu Technical Board +# on 2011-02-08 (LP: #104525). See http://www.pool.ntp.org/join.html for +# more information. +pool 0.ubuntu.pool.ntp.org iburst +pool 1.ubuntu.pool.ntp.org iburst +pool 2.ubuntu.pool.ntp.org iburst +pool 3.ubuntu.pool.ntp.org iburst + +# Use Ubuntu's ntp server as a fallback. +pool ntp.ubuntu.com + +# Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for +# details. The web page +# might also be helpful. +# +# Note that "restrict" applies to both servers and clients, so a configuration +# that might be intended to block requests from certain clients could also end +# up blocking replies from your own upstream servers. + +# By default, exchange time with everybody, but don't allow configuration. +restrict -4 default kod notrap nomodify nopeer noquery limited +restrict -6 default kod notrap nomodify nopeer noquery limited + +# Local users may interrogate the ntp server more closely. +restrict 127.0.0.1 +restrict ::1 + +# Needed for adding pool entries +restrict source notrap nomodify noquery + +# Clients from this (example!) subnet have unlimited access, but only if +# cryptographically authenticated. +{% if nagios_monitoring_server_ip is defined %} +{% for ip in nagios_monitoring_server_ip %} +restrict {{ ip }} mask 255.255.255.255 +{% endfor %} +{% endif %} + +# If you want to provide time to your local subnet, change the next line. +# (Again, the address is an example only.) +#broadcast 192.168.123.255 + +# If you want to listen to time broadcasts on your local subnet, de-comment the +# next lines. Please do this only if you trust everybody on the network! +#disable auth +#broadcastclient + +#Changes recquired to use pps synchonisation as explained in documentation: +#http://www.ntp.org/ntpfaq/NTP-s-config-adv.htm#AEN3918 + +#server 127.127.8.1 mode 135 prefer # Meinberg GPS167 with PPS +#fudge 127.127.8.1 time1 0.0042 # relative to PPS for my hardware + +#server 127.127.22.1 # ATOM(PPS) +#fudge 127.127.22.1 flag3 1 # enable PPS API