Firewall & "Network Time"

Question

Level 2

169 points

Firewall & "Network Time"

In My Sharing Panel, I just noticed that "Network Time" is checked "on" in my firewall. I don't know what it is. The only other thing I have checked is Personal File Sharing so I can swap files with my other Mac. What is "Network Time?" & can I "uncheck" it?

Kenmackay

Posted on Oct 21, 2005 10:47 PM

Reply

Answer 1

Area 51

Level 2

250 points

Oct 21, 2005 11:19 PM in response to Kenmackay

I think it's the port that is used to sync the system clock from a time server.

In System Preferences go to Date & Time and click on the Date & Time tab. You will see a setting for the time server. Your firewall settings are currently allowing this traffic. Otherwise, your computer would not be able to sync it's clock with a time server.

Reply

Answer 2

Jwall

Level 4

1,225 points

Oct 21, 2005 11:22 PM in response to Kenmackay

I believe that is checked to allow UDP traffic on port 123 when you have the system clock set to automatically sync with a time server.

If you open System Preferences -> Date and Time you will see the check box.

You should be able to un-check it in the firewall settings.

Reply

Answer 3

Jwall

Level 4

1,225 points

Oct 21, 2005 11:48 PM in response to Area 51

My network firewall is setup to block inbound UDP traffic, and my PB firewall has the network time port un-checked... and the PB seems to stay in sync. (Set time automatically is checked).

If I open terminal and type: ntptrace it shows the connection with the time server... Anyone know for sure if this port needs to be open for proper sync function with the time server?

Reply

Answer 4

Oct 23, 2005 1:04 PM in response to Jwall

Yes, needs to be open.
And it's not dangerous, because you only have ntpd listening on port 123 for traffic it initiated, it won't answer ssh connection requests which have to come in through port 22.
This is how ipfw works: It lets specified traffic through on specified ports, not just anything on port 123.

Reply

Answer 5

Kenmackay Author

Level 2

169 points

Oct 23, 2005 3:52 PM in response to Jwall

I found out that Network Time (NTP) uses port 123. It is Date & Time preferences for Network Time Server synchronization. It is used for NTP service on a network. This allows queries OUT to an authoritative time server, & INCOMING queries from local clients. So, in those cases, the Firewall should be opened to allow the traffic through.
I recently upgraded 3 Mac's to Tiger: 2 on my local network: cable modem with Airport Express & 2 Mac's (Both had Personal File Sharing CHECKED by me before upgrading). The other Mac was not included in the network & had NO CHECKS automatically placed by the Tiger install.
That leads me to think that my checking of "Personal File Sharing" led to the automatic checking of "Network Time" during the other 2 installs. Since I'm not a server Administrator & don't need to have time tracking, I guess I could FIREWALL IT. . . . . . No?

Kenmackay

Reply

Answer 6

Oct 24, 2005 1:36 AM in response to Kenmackay

File Sharing opens port 548 in the Firewall.
Port 123 was probably opened by Date & Time Preferences: If you have "Set date & time automatically" enabled, your computer is getting it's time frome a server.
I hust tested here and found even with the disabled (closed) port 123, my computer's getting its time over the network.
Thus I'd say you can safely close the port in your firewall.

Gregor

Reply

Answer 7

Jwall

Level 4

1,225 points

Oct 24, 2005 4:51 PM in response to madconqueror

I was able to confirm that as well.. you do not need UDP port 123 open for an outbound request to update time from the network. It also works with all UDP blocked under advanced settings in the firewall tab.

Reply

Answer 8

Kenmackay Author

Level 2

169 points

Oct 24, 2005 6:17 PM in response to Kenmackay

Thanks for all the input guys! I unchecked "Network Time" & haven't had any problems. I'm still wondering why the Tiger install automatically checked it . . . . . maybe because of my "mini-NETWORK" of 2 computers, connected wirelessly via airport express. Thanks again.

Kenmackay

Reply