# Ntpd and chroot

**URL:** <https://community.ntppool.org/t/ntpd-and-chroot/678>\
**Category:** Client Configuration and Development\
**Created:** [October 11, 2017, 2:18pm UTC](https://community.ntppool.org/t/ntpd-and-chroot/678 "2017-10-11T14:18:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![john\_lelos](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@john\_lelos](https://community.ntppool.org/u/john_lelos)\
**Post date:** [October 11, 2017, 2:18pm UTC](https://community.ntppool.org/t/ntpd-and-chroot/678/1 "2017-10-11T14:18:21Z")

</div>

Hello all

I apologise if this has been answered previously, but searching turned up nothing for me.

I am trying to get ntpd to start inside a chroot directory.  
I have solved a few issues I had until now but I have stuck with authentication.

I get the following error:

ntpd[22401]: Command line: /usr/sbin/ntpd -p /var/chroot/ntp/var/run/ntpd.pid -i /var/chroot/ntp -4 -u ntp:ntp  
systemd[1]: Started LSB: Start NTP daemon.  
ntp[22392]: Starting NTP server: ntpd.  
ntpd[22403]: proto: precision = 0.303 usec (-22)  
**ntpd[22403]: line 52 column 17 syntax error, unexpected T\_Key, expecting T\_EOC**  
**ntpd[22403]: syntax error in /etc/ntp.conf line 52, column 17**

and this relates to ntp.conf:

> 48: enable auth  
> 49: keys /etc/ntp/ntpkeys  
> 50: trustedkey 1 2 3 4 5 6 7 8 9
> 
> 52: restrict 10.2.2.10 key 8

Any idea why authentication fails?

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/mnordhoff/32/1470_2.png) [@mnordhoff](https://community.ntppool.org/u/mnordhoff)\
**Post date:** [October 12, 2017, 10:20pm UTC](https://community.ntppool.org/t/ntpd-and-chroot/678/2 "2017-10-12T22:20:06Z")

</div>

“`restrict`” doesn’t have a “`key`” flag, does it?

[https://www.eecis.udel.edu/~mills/ntp/html/accopt.html#restrict](https://www.eecis.udel.edu/~mills/ntp/html/accopt.html#restrict)

---

<div class="post-metadata">

**Author:** ![john\_lelos](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@john\_lelos](https://community.ntppool.org/u/john_lelos)\
**Post date:** [October 13, 2017, 8:21pm UTC](https://community.ntppool.org/t/ntpd-and-chroot/678/3 "2017-10-13T20:21:16Z")

</div>

[http://www.ntp.org/ntpfaq/NTP-s-trbl-general.htm#FTN.AEN5299](http://www.ntp.org/ntpfaq/NTP-s-trbl-general.htm#FTN.AEN5299)  
Note 1: Also note that ntpd fails to find the keys when running in a chroot environment.

Does this apply until today?

---

<div class="post-metadata">

**Author:** ![john\_lelos](https://avatars.discourse-cdn.com/v4/letter/j/9e8a1a/32.png) [@john\_lelos](https://community.ntppool.org/u/john_lelos)\
**Post date:** [October 19, 2017, 8:18am UTC](https://community.ntppool.org/t/ntpd-and-chroot/678/4 "2017-10-19T08:18:42Z")

</div>

Yes, you are absolutely correct.

I am a bit confused with my setup.  
I have a local range with clients allowing unauthenticated access.  
Everything fine up to here.

I have a second ntp server, which should synchronize to the first one using authentication.  
The first server should not get time from second one; stratum are configured as 4 and 5.  
But I am not sure that this is enough.

ntpd servers configuration:

**1st ntpd**

```
restrict 10.50.18.11
peer 10.50.18.11 iburst key 8 prefer

```

Is peer a valid association?  
But I don’t want this server to be updated from the second ntp!

**2nd ntpd**

`server 192.168.3.10 iburst key 8 prefer`

Which is the correct relationship ?  
Should it be “server”, shouldn’t?