585683 - Give community network machines access to some NTP server

Status: VERIFIED WORKSFORME

(Infrastructure & Operations Graveyard :: NetOps, task)

Description

[Robert Kaiser]

It looks like some time ago, ports have been closed in a way that the SeaMonkey machines on the community network can't access any NTP servers any more.

That's particularly bad as our Parallels-hosted Linux machines, including the buildmaster, tend to get ahead of their time - roughly a minute per day in the last few days.

I had set it up earlier to sync with us.pool.ntp.org, but if we have an internal NTP server we can access, that's fine, as long as something can bring the master more in sync with the time tinderbox runs on...

Comment 1

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Macs by default try to use time.apple.com; I noticed this weekend that all Camino's machines were wildly out-of-sync with real time and that forcing a manual NTP sync didn't do anything. :(

It's one more thing to configure if we have to use an internal NTP server, certainly, but I'm happy with anything that gets us the correct time.

Comment 2

[matthew zeier [:mrz]]

Talked about this, we'll open ntp to the world.

Comment 3

[matthew zeier [:mrz]]

Outbound NTP should already be allowed.  

 ! allow ntp & dns back in
 permit udp any eq 53 any
 permit udp any eq 123 any

Comment 4

[Robert Kaiser]

verified on the time problems on our machines not popping up any more.