#
# Undisciplined Local Clock. This is a fake driver intended for backup
# and when no outside source of synchronized time is available. The
# default stratum is usually 3, but in this case we elect to use stratum
# 0. Since the server line does not have the prefer keyword, this driver
# is never used for synchronization, unless no other other
# synchronization source is available. In case the local host is
# controlled by some external source, such as an external oscillator or
# another protocol, the prefer keyword would cause the local host to
# disregard all other synchronization sources, unless the kernel
# modifications are in use and declare an unsynchronized condition.
#
server	127.127.1.0		# local clock

#
# RF sertified time servers
# http://vniiftri.ru/index.php/ru/services/22-ntp
#
#server ntp2.vniiftri.ru
#server ntp4.vniiftri.ru
#server ntp1.niiftri.irkutsk.ru
#server ntp2.niiftri.irkutsk.ru
#server vniiftri.khv.ru
#server vniiftri2.khv.ru

#
#http://www.pool.ntp.org/zone/europe
#
# ru.pool.ntp.org:
server 0.ru.pool.ntp.org iburst prefer
server 1.ru.pool.ntp.org iburst prefer
server 2.ru.pool.ntp.org iburst prefer
server 3.ru.pool.ntp.org iburst prefer
#
# ua.pool.ntp.org:
#server 0.ua.pool.ntp.org
#server 1.ua.pool.ntp.org
#server 2.ua.pool.ntp.org
#server 3.ua.pool.ntp.org

# You can also request your provider about regional time server name.
#server time.example.com

#
# fallback
#
fudge 127.127.1.0 stratum 10

#
# Drift file.  Put this in a directory which the daemon can write to.
# No symbolic links allowed, either, since the daemon updates the file
# by creating a temporary in the same directory and then rename()'ing
# it to the file.
#
driftfile /etc/ntp/drift
#multicastclient		# listen on default 224.0.1.1
broadcastdelay		0.008

#
# Do not forget to add "mssntp" to restrictions if you needed ntp_signd
#
ntpsigndsocket /var/lib/samba/ntp_signd/

#
# RESTRICTIONS
# ============
#

# By default, don't trust and don't allow modifications. Ignore in fact.
#restrict -4 default ignore notrust nomodify		# IPv4
#restrict -6 default ignore notrust nomodify		# IPv6

# Allow anything from the local host.
restrict 127.0.0.1
restrict ::1
restrict default mssntp

# Allow others in our subnet to check us out...
#restrict 10.0.0.0    mask 255.0.0.0   nomodify		# RFC1918 Private-Use
#restrict 192.168.0.0 mask 255.255.0.0 nomodify		# RFC1918 Private-Use
#restrict 172.16.0.0  mask 255.240.0.0 nomodify		# RFC1918 Private-Use
#restrict 100.64.0.0  mask 255.192.0.0 nomodify		# RFC6598 Shared Address Space
restrict 0.ru.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 1.ru.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 2.ru.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery
restrict 3.ru.pool.ntp.org mask 255.255.255.255 nomodify notrap nopeer noquery

# Allow synchronization source from NTP servers
#restrict source

# Keys file.  If you want to diddle your server at run time, make a
# keys file (mode 600 for sure) and define the key number to be
# used for making requests.
#
# PLEASE DO NOT USE THE DEFAULT VALUES HERE. Pick your own, or remote
# systems might be able to reset your clock at will. Note also that
# ntpd is started with a -A flag, disabling authentication, that
# will have to be removed as well.
#
# You can use for example
# echo "1 SHA1 $(tr -dc '[:alnum:]' < /dev/urandom | head -c 20)" >> /etc/ntp/keys
#
#keys	/etc/ntp/keys	# path for keys file
#trustedkey 1		# define trusted keys
#requestkey 1		# key (7) for accessing server variables
#controlkey 1		# key (6) for accessing server variables