The program produces a file containing ten pseudo-random printable ASCII strings suitable for the MD5 message digest algorithm. It also produces an additional ten hex-encoded random bit strings suitable for the SHA-1 and other message digest algorithms.
The keys file must be distributed and stored using secure means beyond the scope of NTP itself. The keys can also be used as passwords for the ntpq utility program.
Print the version string and exit.
ntpkeygen uses the system randomness source. On a POSIX system, this is usually /dev/urandom. Immediately after a reboot, on any OS, there may not be sufficient entropy available for this program to perform well. Do not run this program from any startup scripts. Only run this program on an active host with a lot of available entropy.
ntpkeygen also makes a soft link from ntp.keys to the generated file. ntp.keys is the normal file used in ntp.conf.
It is important to understand that entropy must be evolved for each generation, for otherwise the random number sequence would be predictable. Various means dependent on external events, such as keystroke intervals can be used to do this and some systems have built-in entropy sources.
This implementation uses Python’s random.SystemRandom class, which relies on os.urandom(). The security of os.urandom() is improved in Python 3.5+.
Since the file contains private shared keys, it should be visible only to root or ntp.
In order to use a shared key, the line to be used must also be setup on the target server.
This file is also used to authenticate remote configuration commands used by the ntpq(1) utility.
Comments may appear in the file and are preceded with the # character.
Following any headers the keys are entered one per line in the format:
|keyno||Positive integer in the range 1-65,535|
|type||Type of key (MD5, SHA-1, AES-CMAC etc). This program generates only AES.|
|key||the actual key, printable ASCII or hex|
Successful program execution.
The operation failed or the command syntax was not valid.