openstack/ansible-hardening
Code Issues Proposed changes

Chrony: make ntp server options configurable

Browse Source 
Users may wish to remove the 'offline' option for increased
reliability, since ifup/ifdown scripts are typically not
required in (static) server environments. Futhermore it
enables users to adjust the polling timers to their needs.

Change-Id: Iafa31c03e98785a574f38bb2206b9bea9550743e
This commit is contained in:
Jakob Englisch 2019-01-08 22:06:30 +01:00
parent b792753b34
commit cca2800ea4
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
defaults/main.yml
View File

@ -270,6 +270,8 @@ security_ntp_servers:
- 1.pool.ntp.org - 1.pool.ntp.org
- 2.pool.ntp.org - 2.pool.ntp.org
- 3.pool.ntp.org - 3.pool.ntp.org
# NTP server options.
security_ntp_server_options: offline maxpoll 10 minpoll 8
# Chrony limits access to clients that are on certain subnets. Adjust the # Chrony limits access to clients that are on certain subnets. Adjust the
# following subnets here to limit client access to chrony servers. # following subnets here to limit client access to chrony servers.
security_allowed_ntp_subnets: security_allowed_ntp_subnets:

4
releasenotes/notes/chrony-ntp-server-options-f8f87225a5282e1a.yaml Normal file
View File

@ -0,0 +1,4 @@
---
features:
- It is now possible to modify the NTP server options in chrony using
``security_ntp_server_options``.

2
templates/chrony.conf.j2
View File

@ -20,7 +20,7 @@
# better to use IP numbers than host names. # better to use IP numbers than host names.
{% for ntp_server in security_ntp_servers %} {% for ntp_server in security_ntp_servers %}
server {{ ntp_server }} offline maxpoll 10 minpoll 8 server {{ ntp_server }} {{ security_ntp_server_options }}
{% endfor %} {% endfor %}
# Look here for the admin password needed for chronyc. The initial # Look here for the admin password needed for chronyc. The initial