I run one of the few NTP servers in India. You can see my server's monitored health in the NTP pool system, and I have a public profile in the NTP pool system which shows all of my servers (there's currently only 1).
I was inspired to setup an NTP server in India because of an article about NTP on LWN.
These are some notes about what I've done.
- Digital Ocean $5/month droplet in BLR1 region running 64 bit Debian Jessie.
- Setup my DNS server to point the hostname at the IPv4 address.
- Login via DO web-console (after changing root password) and set SSH to a different port
- Install some extras:
sudo apt-get install ntp ntp-doc apticron vim screen bmon lighttpd - Configure ntp to use a few stratum1 and stratum2 servers which are kinda nearby
- Run bmon in a screen for "real-time" bandwidth tracking
- Setup lighttpd HTTP redirect for
(.*).pool.ntp.orgtowww.pool.ntp.org. Lighttpd has since been removed. - Setup server in the pool DNS system management console
- Configure apticron to email me every day if there's updates to be applied. This doesn't seem to actually work, I don't get the emails, yet.
- Enabled unattended upgrades via
dpkg-reconfigure -plow unattended-upgradeswhich will make an apt config file which defaults to updating package lists every day (a bit redundant with apticron maybe?) and installing stable updates. - IPv6 address added to the NTP pool, now. But this has difficulty with the amount of traffic.
- Setup and enabled fail2ban due to botnets probing sshd in interesting ways (even though I run sshd on a non-standard port).
- Setup some long term monitoring which makes pretty graphs, like munin or mrtg
- Show pretty monitoring graphs through a web interface
- Fix ipv6 CPU consumption due to route lookups and other ipv6 function calls.
- After you add a server to the NTP pool system, it'll take a few hours (was about 6 in my first try) till the monitoring will consider your server to have a good enough score to be added to the pool.
- The "Net speed" setting in the NTP pool DNS system doesn't seem to be that effective. Setting my desired bandwidth to 3 Mbps resulted in sustained 4-5 Mbps and peak 7 Mbps traffic while setting my desired bandwidth to 10 resulted in sustained 6-7 Mbps and peak 9 Mbps traffic.
- Currently I have my "Net speed" set to 25 Mbps and will monitor how that translates into real world traffic levels.
- Network traffic for an NTP server will be roughly symmetrical.
- 9 Mbps of up/down traffic is about 30% CPU load on my $5/month droplet. My droplet says it has a Xeon E5-2650Lv3 1.8 GHz CPU.
- Currently RAM usage is under 100 MB.
- Digital Ocean has no way to monitor network transfer amounts per month even though they show numbers for each level of droplets ($5/month droplets are listed with 1000 GB transfer per month) but they do not spell out how they measure transfer and they do not track it in a way which is visible to the customer in their control panel. I opened a support ticket to ask if I'd be charged for overages, as I'm on track to transfer a couple TB per month, and their response was that until they show the info in the control panel, they won't charge customers for overages and that they'd be sure to email customers prior to rolling out such a change. Other than causing tons of confusion (google for this topic) by listing the transfer levels for each droplet size, this seems quite reasonable on their part.
- I see horrible latency to/from my server. Round trip times to anthing outside of India is consistently over 150 ms. From the USA it's over 200 ms, always (which kind of makes sense due to physics).
- During the day, India Standard Time, I currently see an average of about 10 kpps. Assuming that a client sends 1 packet every 64 seconds, this equates to about 640k clients. At peak times, which are in the evening India Standard Time, this goes up, and from about midnight till 6 am India Standard Time, this goes down. The traffic levels are very consistent day to day.
As per http://lists.ntp.org/pipermail/pool/2016-December/007992.html it is a good idea to disable connection tracking for UDP on an NTP server, since not disabling this will carry a bit of overhead tracking all of the queries.
Making the iptables and ip6tables rules persistent can use Debian's iptables-persistent package. During install, just accept to write out the current rules as it'll create the correct files in the correct locations (the documentation is a bit lacking, but dpkg does the right thing) in
/etc/iptables/rules.v{4,6}.