chrony port open?

[Lucid1010]

You cannot view this attachment.

Code Select Expand

$ sockstat -4 -l | grep chrony
chronyd chronyd    69981   5 udp4  127.0.0.1:323         *:*
Is it a bug that port 323 is open even though I didn't set 'Allowed Networks'?

When 'Allowed Networks' is configured, it opens as `*:323`, but when it's not set, the port opens as `127.0.0.1:323`.

Code Select Expand

$ cat /usr/local/etc/chrony.conf

port 323
driftfile /var/db/chrony/drift
pidfile /var/run/chrony/chronyd.pid
makestep 1 3

ntsdumpdir /var/lib/chrony
ntstrustedcerts /usr/local/etc/ssl/cert.pem
nosystemcert


server time.cloudflare.com iburst nts
It would be great to have an option to set the port to 0 or disable it completely.

[Patrick M. Hausen]

127.0.0.1 is the loopback interface. It is not reachable from anywhere but the firewall itself.

[Lucid1010]

127.0.0.1 is the loopback interface. It is not reachable from anywhere but the firewall itself.

Yes. I'd just like to disable the local port as well.

[patient0]

Yes. I'd just like to disable the local port as well

Port 323 is the control port, which is used to make changes by non-root users while chrony runs. E.g. with 'chronyc' from the command line. It can't be disabled.

But as mentioned since it is only accessable from the machine itself, it's no issue.