I see the warning "kod does nothing without limited" in my NTP logs.
It seems this seems to have been caused by this (https://github.com/opnsense/core/issues/5470) change. It seems "kod" should simply be replaced by "kod limited" in the ntpd.conf, but I am not enough an expert on ntp to understand if that wouldn't trigger the issue that the aforementioned change fixed again.
My "/var/etc/ntpd.conf":
root@opn:~ # cat /var/etc/ntpd.conf
#
# Autogenerated configuration file
#
tinker panic 0
# Orphan mode stratum
tos orphan 12
# Max number of associations
tos maxclock 10
# Upstream Servers
pool 3.pool.ntp.org maxpoll 9
pool de.pool.ntp.org maxpoll 9
statsdir /var/log/ntp
logconfig =syncall +clockall +peerall +sysall
driftfile /var/db/ntpd.drift
restrict source kod nomodify notrap
restrict default kod nomodify notrap nopeer
restrict -6 default kod nomodify notrap nopeer
restrict 127.0.0.1 kod nomodify notrap nopeer
restrict ::1 kod nomodify notrap nopeer
interface ignore all
interface ignore wildcard
interface listen 127.0.0.1
interface listen ::1
interface listen fe80::1%lo0
interface listen 192.168.10.1
interface listen <redacted-IPv6-GUA-subnet3>::1
interface listen fe80::f690:eaff:fe00:b349%vlan0.1010
interface listen 192.168.3.1
interface listen <redacted-IPv6-GUA-subnet2>::1
interface listen 192.168.1.1
interface listen <redacted-IPv6-GUA-subnet1>::1
interface listen fe80::f690:ebff:fe00:b349%vlan0.1001
interface listen 192.168.150.1
interface listen fe80::f690:ebff:fe00:b34a%igb3
interface listen <redacted-public-IPv4>
interface listen <redacted-public-IPv6>
interface listen fe80::f690:ebff:fe00:b347%igb0
interface listen fd00:2::1
interface listen fd00:1::1
interface listen fd00:150::1
Hence, question: is that really a bug, should I attempt to raise a PR for this?
When you set "Enable Rate limiting" in the NTP advanced settings under "Access restrictions", the "limited" keyword will be included. IDK if that should be the default, I had it set already.
It seems to be the default - I never looked at these settings and most of them are checked.