Secure default configuration (approved by NTP upstream per IRC): by default deny all non-time queries so that monlist-based NTP reflection attacks are blocked; Rate-limit queries and issue KoD for limit-exceeded; Ensure IPv6 localhost is allowed as it is used by default.

Package-Manager: portage-2.2.7/cvs/Linux x86_64

4 files changed, 154 insertions, 27 deletions

diff --git a/net-misc/ntp/ChangeLog b/net-misc/ntp/ChangeLog
index 4e6abc080cdd..0b8484abe095 100644
--- a/net-misc/ntp/ChangeLog
+++ b/net-misc/ntp/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for net-misc/ntp
-# Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/ntp/ChangeLog,v 1.202 2013/12/24 11:01:52 vapier Exp $
+# Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/net-misc/ntp/ChangeLog,v 1.203 2014/01/01 23:59:55 robbat2 Exp $
+
+*ntp-4.2.6_p5-r10 (01 Jan 2014)
+
+  01 Jan 2014; Robin H. Johnson <robbat2@gentoo.org> +ntp-4.2.6_p5-r10.ebuild,
+  files/ntp.conf:
+  Secure default configuration (approved by NTP upstream per IRC): by default
+  deny all non-time queries so that monlist-based NTP reflection attacks are
+  blocked; Rate-limit queries and issue KoD for limit-exceeded; Ensure IPv6
+  localhost is allowed as it is used by default.
 
   24 Dec 2013; Mike Frysinger <vapier@gentoo.org> files/ntp-client.confd,
   files/ntp-client.rc:
diff --git a/net-misc/ntp/Manifest b/net-misc/ntp/Manifest
index c3930798a9bf..65c4dfe7fbb3 100644
--- a/net-misc/ntp/Manifest
+++ b/net-misc/ntp/Manifest
@@ -1,6 +1,3 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA256
-
 AUX man-pages/genmans.sh 1864 SHA256 87f46fd035c9432e6dc9f8e4273aae2e5a9616dbaa13d20909a6e01044369c1a SHA512 03a8434f1f852d3eafdd0c63a19bdb490ac0194d81fd6d2e04fac5840169a48169b8bf7b5ad56b5ed61efba51852b0ce331eb8af0c640797075a530f88a916db WHIRLPOOL ffbe1ef7279ddb867aef9620f713b00af7fed593fd95c2f5c8a2b93670b6855bca1e5b22b63e8d07eee53b91987c9f82f5e45b8ca4935d566ab3c271d2d48ce2
 AUX man-pages/ntp.conf.5.patch 503 SHA256 d26c1006d72d76591588fbd058000596b17b0b9bcbd184d4e6cedbc31c3b1027 SHA512 6e75a7900c2cde0484e57e18b1244ed188b58be54b6622c3777251a2f412a27a98c41a65d6d62d93f9e84856f211bb268bd005aca146bc27aed982daf63f24fe WHIRLPOOL f5d8d571206478a12f1f80e483b4b7cb94707e1c0caf55c45c319e81fb5425d5e61686ad3eb13c0bb4c694621858f8a9399eb5f5b92237fb39ccb5aaba90b6cd
 AUX man-pages/ntp.xsl 5831 SHA256 8a41227ded8953c90f49022f68bdaba60f9d82fe528d5a93157672c5bf8db03d SHA512 c4fb1333a35a803783dc209186ea9005a0e529aba96103460e23a0eca483414898037802686cfff04bf910b06eb27ba8805c460962c3626af2d0951904484cbd WHIRLPOOL 0376d57f0e657c9a09fa83c69485fe202f4ef6d46957d7a2680410cb08ac0d5083e4bcb4221175acc942d211fdbb7ffbbf4d9ed00a43b8087c90fbe2a4e3f808
@@ -9,7 +6,7 @@ AUX ntp-4.2.4_p7-CVE-2009-3563.patch 1752 SHA256 4a6eb328ccfe3be771dc0932d6f6ee8
 AUX ntp-4.2.4_p7-nano.patch 393 SHA256 440c13a0eaeab78cb4f8a806b20b128d2d7d845d3842f2e8acc88dc5f2deb1b4 SHA512 b8531f8b33a4d062ae5910e5775edc5e52a5df971b6fbcc7efdc55fa34681a38bc8881ab6164acfa692e4105bc1ae6d3e20fa06592cb04b7bd935dfd0abd9746 WHIRLPOOL 66dcf8cf79468c8f58e87cceeefea35ccbc930329eee18ed2b0b1c749aa645486207ebb413fe962c9b6824ffc00ed64636622194f8a3e4cf611d3b7ff822325f
 AUX ntp-client.confd 776 SHA256 c7dc517cdb5ee10e2a07ccea15ec47ba0b7aff8ac1469204c8d7faf71bcae2c5 SHA512 2d6b9d96c55787cf4556332054a61399368dcf37cf76a14aaba3f8e2e4fdd47ce25808f9babda2ca1f2a6e7387c043e023251ba2b99786426c875bd7cb6592a6 WHIRLPOOL 7282c74d564f776cb6e8e15d79cb77e60088c516a71f87c28d96bda7e67bddc3d35e01cf86eac58655c2536d0a4a023b6142527bc8ec62318524114502d5cc99
 AUX ntp-client.rc 827 SHA256 2e4a42dd64b7c6dacfcfefdab8dc1e7c45d7a0966ef8b928583d18393362c719 SHA512 04cabf1c501922f5c90a3201ee3418acf3934cb4e61640c3915b7d515f246d8fe3ac38f10b9947d574878b92871c9dba59d351a8c15eea1dbde52f518ecac7a5 WHIRLPOOL 08611b1dcacb85fff955c3c6af7118704b7b9a269d8070a538854aea980e5975c0d72ea9bc6f42115e871937a9f90b64d12bda01040a45c5dc70d144f4343d00
-AUX ntp.conf 1517 SHA256 907ebf0c12e5c75cd32ce7ad45e600d356caacfecbe0858ac24260ff4695d0c9 SHA512 4973c1fce84b9096b421b7314ef1d45f22ee6a0734c122685f9fb3368c4e09336258fa8a1c9aba58593536b099549af607ed10256979c23e8bf25f90526923c5 WHIRLPOOL 13f13fcdb92941488d96f8a273839360bc1cda6713d0e5c7d292a341dd65d9f88088f380504b29bd65cd78501ece94a2ae490b9ab3ed875b4a8db930dabef989
+AUX ntp.conf 1614 SHA256 1e644397a0360a997064d0704b489c66b17ae2c50b49278ba46ec04942f13fb6 SHA512 b21afb9d2b9302edf702fce536218fa916e810e916c207dd6f2f09a9a793a465bc929b9a36108d49ddb3552e221b57cbb2e9f916eba78662b19c4b9c2b3e806c WHIRLPOOL c84ab4e53d8c778f64a656a920aa062b4c03cd871684814f3f2bf6a3d8b76870a921d91676cfe71d84db0865b887f64ebe3d403a81a91af656987d74469cc6cf
 AUX ntpd.confd 192 SHA256 40803821f498267f6567436eedc18201b5ae4b5390d6872fb15a94200c2ac06f SHA512 a9e96a214d3c21a3f4863709c48a11f9dedc73e2d83a9b20761021df44a9acb56757e77f113aa0314f5f3923e9cb26bc6e0147658d20e8a74d078d415a171d91 WHIRLPOOL 75ba0559326dac961a6b228d6ee58ea8b4442ace200c36ef07101bc00b8fc12dfca78bc6474870f29928c1b9cb1397a4bfc8706befdf33178abad1a5f558b372
 AUX ntpd.rc 819 SHA256 f7c58e8f8e91ee0c1b947e9684b0a9e9e27220e0c97a8b06ee4e3bc5578a88b2 SHA512 b32a4f5ed6b12a6a0254951e530ffcd006ec8719847c6b146bced7d29e482d2312448802ef2c22f85d6a3fd8d6ee7f6913485fad71dd57759da112e8248fc62e WHIRLPOOL 87cb1e26d78a026a507f0e38ad611970e158d1f633aad8681843cef44aaaa999e73fbd46e5a884116fabab2af3f96db1115c8e1e161f5da67820423e422d96fb
 AUX ntpd.service-r1 171 SHA256 302ce93a9fe6e56063aece43d2109b98602333a7155641f3a6a41a4cf687a011 SHA512 15e0b038c756f9c5195cb69ff25dcad5a86bc80bc697875d351592c18d65db6e9b74482de4997015c63bc09ad6e9fdc282b27954bf859d944032ae3594be6548 WHIRLPOOL 17a2e93d9fe266d1e39900102fd05eac62b208a8a393fcaa27bff46b29f9ae89bd05330d95027eac57c2db3e1ab15b8133855237a7b0e158ab708850ede38572
@@ -36,27 +33,11 @@ EBUILD ntp-4.2.6_p3-r1.ebuild 3834 SHA256 e00887e5ec5bb588ea65a783a0f7fe7b76ff5c
 EBUILD ntp-4.2.6_p3.ebuild 3742 SHA256 a3e399627267b88b1bf40d5838ac2b633e94f3b153d3eb19fb684b6235af5bb5 SHA512 1b45865895f4f254ccae1b8c6a40fcb8eca90d479ba0dbbc0f0e4c14a10aaa27c41aaad9d25875c4c0fccd9b92c0cc939138e87e95c21ceab31fcbecd86a65fa WHIRLPOOL 6a96d424e03ebce6b581a01dbe6db1e9a24e1de7311910377cfa8fc7f95647a53cb277e69d9d5fcc6fb0ba413217252c5f65341404d24534669a9de7f13dd65f
 EBUILD ntp-4.2.6_p4.ebuild 3831 SHA256 699bcf80337326262bed9eec4d17a2d5a55c242e61ff91dd6af66a6821b0b37f SHA512 2c816ccecbc9d69925806ba4a769c6669e4214c139d1e2b81fce7dae503eae671a7076f108f0125882a17ff77dc5b0647e7ebedaded1c806053e23a70aaaa7bf WHIRLPOOL 2f3e50d446b1416cd00462d76670fe301e0840b79fa94625ef48e823cbe18ccdb186a290adec06a24f8ce74153c074e4a6bbc6c46a1a6f30f49dd656a261b7b9
 EBUILD ntp-4.2.6_p5-r1.ebuild 3784 SHA256 b5f103c04700e8266e2720ccfc1fd0b7135a3fcf0cc23f40925d7ecff8918a5d SHA512 460f6a4e57f9d5196c8822eb8a69db6d58975b959cc0917c486b41acb472548ca6bb261191997c3a7103c517d11bb9f1a52b923ef8932a11cab88e1a3538f697 WHIRLPOOL 5453e6f5fa18fd541f48b79ba9be89cf4a48988ba3d122829b22a3f8b63135578059265fb279291c905ade49724461d1525fbd97649e6f7a45aff22008b196ea
+EBUILD ntp-4.2.6_p5-r10.ebuild 4278 SHA256 0480bfeb97513c51c4f2053c4ad3693e99b7467fb65d872c5faf19cb07944aa0 SHA512 297d83127b3cc4516c77df51f0fee0f58bf18a0f0c2c5500b7adac29b2a3bc8e88437276dc7681a818c7f1a4c2b329cdcf0f3fadf013ccbde59b0edc8c4a8cca WHIRLPOOL 64bdcdf2d23dd151bbf781caf61ed5f42c6c58db0ea1560ad4c48ad3cd4a935a1eac8f410b5f6d421f2275ccbe43a19e91cf55df995b3aefe200227c51060e94
 EBUILD ntp-4.2.6_p5-r2.ebuild 3869 SHA256 4c5a7f80315243b8fa9c7acf57fd9e0c84831fa1a42c2cc6c1144a8fb2a64c11 SHA512 e52b92bb66ced7e1f2771544727e5eb9cd1999cd7ab9766f1a7d30b158971c91d3882b281cac8cf27fbdbb45ca14d49ca2c3e54256f85fed62e8cb21341a7d0b WHIRLPOOL 2342083adc37e255ec8f2fe29126a6280c3a265b0fb09a8b6ff021edf3cacb1b879dc435eb0c54102f82be1315c1c53a8d4cd211ca4c8ef8832305ae1989ed26
 EBUILD ntp-4.2.6_p5-r7.ebuild 4222 SHA256 d2e6cb23292e646cca2cf08b2e8d93855ba8330627e504cd4e5606b3e3d3c280 SHA512 0917209c3d81a6bcbf18efd0c876aeafca14e32806bf30d34c0b095f6c5566931537c4b522b79f9abb6ddf2efc4804beafd1f5b86796710a4eda7766d62e68f6 WHIRLPOOL 43e4a66214bcc09d4b7a9241ec447f9f4f77bfa95d5efc8af82da85f57433f5f1a849298f62f12aa498fa39701708fec9fc5c8f022cd7980037e582249ab5bac
 EBUILD ntp-4.2.6_p5-r8.ebuild 4275 SHA256 cf99bf16360fef7a956e82d5098b9e037aa764b5f54f7b751cec353aa316518b SHA512 1394a61eb664737317e39b16e46d805c0b9a3032c111a38398819c72d670bdfb6fa3823104e26d71ecd33bdef36c365be60118caa3a809de79b64d2ac0556915 WHIRLPOOL ffca3d78ecf236e358a5ef7858d333dfee2a57d395c589c7c1a58572f012ea271dbfb67bfeddcf62175d47ed0dbdf6f5d16f2592949790bfc501e4def88fcf86
 EBUILD ntp-4.2.6_p5-r9.ebuild 4278 SHA256 60402cf5dfc048e91acb65f591a78c3de3a0241f4fa0eb1a79e1f55592d2bae8 SHA512 d069d4b63d2a9c0fe4f0f47c04ab6941301bc2c1aa966af9ebd69dbd5ec07f18645abce3ecf1b9519a14b8b5e81af21a342a477e889a9aaaac126e5951153a5e WHIRLPOOL 775a1045c08068e66f9dd79450fba2421b498df9c4edc41b5f2a8fe9c4c25f436d9c2e9ecd5c5770d8b0d953dbface8362dba7732583563610bd188891628a98
 EBUILD ntp-4.2.6_p5.ebuild 3809 SHA256 d9c4e1d7c7dbcb5b2d831e39d32b23d2ac58f09f130b8c1d67a26af0fc2a5dce SHA512 cf8b7cc652f92432fcf0b14ad37c172794ce06c81a4a560eadc3fe532aae66485fad6663cfe9bc33161412a3fa68a3c113f36d0eb8fd8f4c57ea0509dc91e763 WHIRLPOOL 459711eb1457dc77c1b2c8b2a010a4a0a11b5b2f6b03414183d7692c13b85c7a79d46f30376f90ea19726ab8f61426b0f6ddfaf38507596db9e1bf95fd5d71ed
-MISC ChangeLog 28455 SHA256 2d1d22b3e8358112681c1200cf6f47e659e3c7cd7544191b3742e0bd586659c0 SHA512 7e35532154912242d72fadadd241ed29a5fc551ebf58830a18ce575379798f9f63e2b1a1647c0ee18789b1cceb44f90bdd01ba0f7e7fec5446be6a1ad194275e WHIRLPOOL ad1fec39a9f94f301a41d005f1ab0dbebef1fbdc8d0d5c54058707156ca856c4ac3d3b3e4c54f21c985e95d09f53de328527dae1c5cefbb4c2a8a305f9cd0c9c
+MISC ChangeLog 28867 SHA256 932e830f483ab7f2e4ad9b33c8ab155c12f26fd19857d8d74960710cefd60044 SHA512 ffed8f8ddcc0104d184a0ae70a96aef6273c9f81d72dd09ec6fcc197d6cd54b4376b6cb0831f308c8ca43e9dd32309df3bd6e9ab475aaf6cfea6d90d21c46e50 WHIRLPOOL 9e64fbf2fc35e3487f20ccf2434cbb93563d073ea133a62a3cf10acffd4c924b47b6a34f3767c6fa37befddb6c26dd4b54408e5df1dc2b3809fed49ed73933eb
 MISC metadata.xml 837 SHA256 57b162a2c709963d5760fdb3abe7d2a12e6e55a6abe816b16db30e9e2ae10a4e SHA512 d1403413373a0785712c40fd1a96c4649ef368b30efc5735667626ad760bb2336ba28fd335c75fc781ad6222e7dd9f53ad5dd2f558b3cbbf719104684fa0d9ed WHIRLPOOL 1513304c252dfb8f9a06a7cce1e13ab41ac80e0f0db7e231891430168df6e71a81e88984d47a694d6a5d0fd5a9c04dd1318c504baf21c7be6bd0d99b307db867
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.22 (GNU/Linux)
-
-iQIcBAEBCAAGBQJSuWnOAAoJELEHsLL7fEFWtRMQAJpaiKCduXLisZl2Y9fQzOHb
-RVl6D+9mMMBFoewIFNx8M7M7CF6+N7A5kLwyOHZkx17kU3yx/xeSeyYXtoiFjhaw
-khIhmYYeQa/+PjD4nQCbXxdxbJmZQi8iRUKELbWdAn8a7InJWXiE/ZSGKPd4KtLC
-ZMpfqlD/OG8HjZbowWKrhdwGRqLvaCH+8eBcjAOWYBzz2T6ICsOdIgl/VDybfuJ8
-v0psmRLReIKRqD5Ydo6gEe3bLkk5/vJitKd0uVZMn71daGCwEX5+6R14SnOEgTIz
-2f6SHwcUlCMqmT1/ErwYESAIOEXGmtBg/WLl8Mkx+COWZCqsxbltv/s5XiNa2IDk
-FzCpt7mJHiiS23IdlY664rq0XsQNiqcZ738nqRMN1pkgThuG2CjLfT8ZLvioX3EZ
-2dpCfqQvlFM302/6iMaTp8kZJZTgQLZesvwKywEb7rMpFtDbdIR+IAA7r5LtvZ9g
-6ZZqccWZS1TFxu2fRB99w0oDDpfPmxS5E+aP0DQxSIJvKAF5SHFViBKyIWrpLciS
-7bHkhtOM5ueXPQcTkUrYyCEkYf5W6UK1Ex9nFzgq12hwXemwQXxgolMyHskDgPJf
-hAt4GHV7euDcRSX/QlS1anAYxtIKdm8b7kKfp0cRe0pL/law8M14aXi01ZHM4lBp
-nLtbqDcJdxGXA/HAG3SA
-=AYtY
------END PGP SIGNATURE-----
diff --git a/net-misc/ntp/files/ntp.conf b/net-misc/ntp/files/ntp.conf
index e376fbea2186..97bed8dd13cd 100644
--- a/net-misc/ntp/files/ntp.conf
+++ b/net-misc/ntp/files/ntp.conf
@@ -38,10 +38,12 @@ driftfile	/var/lib/ntp/ntp.drift
 #restrict default ignore
 
 
-# To deny other machines from changing the
-# configuration but allow localhost:
-restrict default nomodify nopeer
+# Default configuration:
+# - Allow only time queries, at a limited rate, sending KoD when in excess.
+# - Allow all local queries (IPv4, IPv6)
+restrict default nomodify nopeer noquery limited kod
 restrict 127.0.0.1
+restrict [::1]
 
 
 # To allow machines within your network to synchronize
diff --git a/net-misc/ntp/ntp-4.2.6_p5-r10.ebuild b/net-misc/ntp/ntp-4.2.6_p5-r10.ebuild
new file mode 100644
index 000000000000..0a2c2e4bb06e
--- /dev/null
+++ b/net-misc/ntp/ntp-4.2.6_p5-r10.ebuild
@@ -0,0 +1,135 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-misc/ntp/ntp-4.2.6_p5-r10.ebuild,v 1.1 2014/01/01 23:59:55 robbat2 Exp $
+
+EAPI="4"
+
+inherit eutils toolchain-funcs flag-o-matic user systemd
+
+MY_P=${P/_p/p}
+DESCRIPTION="Network Time Protocol suite/programs"
+HOMEPAGE="http://www.ntp.org/"
+SRC_URI="http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-${PV:0:3}/${MY_P}.tar.gz
+	mirror://gentoo/${MY_P}-manpages.tar.bz2"
+
+LICENSE="HPND BSD ISC"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x86-freebsd ~amd64-linux ~ia64-linux ~x86-linux ~m68k-mint"
+IUSE="caps debug ipv6 openntpd parse-clocks samba selinux snmp ssl vim-syntax zeroconf"
+
+DEPEND=">=sys-libs/ncurses-5.2
+	>=sys-libs/readline-4.1
+	kernel_linux? ( caps? ( sys-libs/libcap ) )
+	zeroconf? ( net-dns/avahi[mdnsresponder-compat] )
+	!openntpd? ( !net-misc/openntpd )
+	snmp? ( net-analyzer/net-snmp )
+	ssl? ( dev-libs/openssl )
+	selinux? ( sec-policy/selinux-ntp )
+	parse-clocks? ( net-misc/pps-tools )"
+RDEPEND="${DEPEND}
+	vim-syntax? ( app-vim/ntp-syntax )"
+PDEPEND="openntpd? ( net-misc/openntpd )"
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+	enewgroup ntp 123
+	enewuser ntp 123 -1 /dev/null ntp
+}
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-4.2.4_p5-adjtimex.patch #254030
+	epatch "${FILESDIR}"/${PN}-4.2.4_p7-nano.patch #270483
+	append-cppflags -D_GNU_SOURCE #264109
+}
+
+src_configure() {
+	# avoid libmd5/libelf
+	export ac_cv_search_MD5Init=no ac_cv_header_md5_h=no
+	export ac_cv_lib_elf_nlist=no
+	# blah, no real configure options #176333
+	export ac_cv_header_dns_sd_h=$(usex zeroconf)
+	export ac_cv_lib_dns_sd_DNSServiceRegister=${ac_cv_header_dns_sd_h}
+	econf \
+		--with-lineeditlibs=readline,edit,editline \
+		$(use_enable caps linuxcaps) \
+		$(use_enable parse-clocks) \
+		$(use_enable ipv6) \
+		$(use_enable debug debugging) \
+		$(use_enable samba ntp-signd) \
+		$(use_with snmp ntpsnmpd) \
+		$(use_with ssl crypto)
+}
+
+src_install() {
+	default
+	# move ntpd/ntpdate to sbin #66671
+	dodir /usr/sbin
+	mv "${ED}"/usr/bin/{ntpd,ntpdate} "${ED}"/usr/sbin/ || die "move to sbin"
+
+	dodoc INSTALL WHERE-TO-START
+	doman "${WORKDIR}"/man/*.[58]
+	dohtml -r html/*
+
+	insinto /usr/share/ntp
+	doins "${FILESDIR}"/ntp.conf
+	cp -r scripts/* "${ED}"/usr/share/ntp/ || die
+	use prefix || fperms -R go-w /usr/share/ntp
+	find "${ED}"/usr/share/ntp \
+		'(' \
+		-name '*.in' -o \
+		-name 'Makefile*' -o \
+		-name support \
+		')' \
+		-exec rm -r {} \;
+
+	insinto /etc
+	doins "${FILESDIR}"/ntp.conf
+	newinitd "${FILESDIR}"/ntpd.rc ntpd
+	newconfd "${FILESDIR}"/ntpd.confd ntpd
+	newinitd "${FILESDIR}"/ntp-client.rc ntp-client
+	newconfd "${FILESDIR}"/ntp-client.confd ntp-client
+	newinitd "${FILESDIR}"/sntp.rc sntp
+	newconfd "${FILESDIR}"/sntp.confd sntp
+	if ! use caps ; then
+		sed -i "s|-u ntp:ntp||" "${ED}"/etc/conf.d/ntpd || die
+	fi
+	sed -i "s:/usr/bin:/usr/sbin:" "${ED}"/etc/init.d/ntpd || die
+
+	keepdir /var/lib/ntp
+	use prefix || fowners ntp:ntp /var/lib/ntp
+
+	if use openntpd ; then
+		cd "${ED}"
+		rm usr/sbin/ntpd || die
+		rm -r var/lib
+		rm etc/{conf,init}.d/ntpd
+		rm usr/share/man/*/ntpd.8 || die
+	else
+		systemd_newunit "${FILESDIR}"/ntpd.service-r1 ntpd.service
+		systemd_enable_ntpunit 60-ntpd ntpd.service
+	fi
+
+	systemd_dounit "${FILESDIR}"/ntpdate.service
+	systemd_install_serviced "${FILESDIR}"/ntpdate.service.conf
+	systemd_dounit "${FILESDIR}"/sntp.service
+	systemd_install_serviced "${FILESDIR}"/sntp.service.conf
+}
+
+pkg_postinst() {
+	ewarn "You can find an example /etc/ntp.conf in /usr/share/ntp/"
+	ewarn "Review /etc/ntp.conf to setup server info."
+	ewarn "Review /etc/conf.d/ntpd to setup init.d info."
+	echo
+	elog "The way ntp sets and maintains your system time has changed."
+	elog "Now you can use /etc/init.d/ntp-client to set your time at"
+	elog "boot while you can use /etc/init.d/ntpd to maintain your time"
+	elog "while your machine runs"
+	if grep -qs '^[^#].*notrust' "${EROOT}"/etc/ntp.conf ; then
+		echo
+		eerror "The notrust option was found in your /etc/ntp.conf!"
+		ewarn "If your ntpd starts sending out weird responses,"
+		ewarn "then make sure you have keys properly setup and see"
+		ewarn "http://bugs.gentoo.org/41827"
+	fi
+}