Security group for AWS NTP Server

user_3890424 0
Viewed 6357

I just try to synchronize time with NTP-Server on EC2 instances:

server 0.amazon.pool.ntp.org iburst
server 1.amazon.pool.ntp.org iburst
server 2.amazon.pool.ntp.org iburst
server 3.amazon.pool.ntp.org iburst

Unfortunately, I couldn't sync with NTP-Server. My question is:

  1. Should we have to open ports in security group to allow NTP-Server connect to EC2 instances ?
  2. If yes, then how can we know which IP is amazon.pool.ntp.org (it's changing over time) and we cannot open All Traffics

Thanks in advance,
Toan Dao

aws-security-group amazon-web-services amazon-ec2 ntp
4 Answers

For anyone visiting more recently, AWS have their own time servers now: https://aws.amazon.com/blogs/aws/keeping-time-with-amazon-time-sync-service/ (and also just to re-iterate: you do need time sync on AWS VMs, otherwise they'll drift a noticeable amount after a couple of months).

To use them, you need to configure your NTP server (ntpd or chronyd) to use server 169.254.169.123. This magic IP is within AWS, so doesn't go out of the VPC or onto the Internet. As per @Rolo787's comment, no Security Group changes are needed as it's "link local" (see https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html).

Just to note, it's usual to include multiple servers and let your client work out the time from all of them. In the AWS case, even though it's only a single IP, you're talking to multiple servers and as such don't specifically need to use multiple IPs. If you're allowed to use Internet NTP servers as well as the AWS one, then there's no harm in configuring multiple, perhaps with a prefer option on the AWS one.

user_9174440
Related