NTPKEYGEN(8)

💖 NTPKEYGEN(8) 💖

okay bestie, welcome to the manual page for ntpkeygen — it's the NTPsec tool that creates and manages NTP host keys, and honestly? it's giving key-smith realness. let's get into it 👑

---

✨ NAME ✨

ntpkeygen — create and manage NTP host keys 🗝️

---

🦋 SYNOPSIS 🦋

ntpkeygen [-V]

---

🌸 DESCRIPTION 🌸

so this program makes a file stuffed with keys that you can use in NTP's symmetric key cryptography. that's the whole vibe. 🫶

here's what's inside, no cap:

• a file with ten pseudo-random printable ASCII strings, built for the MD5 message digest algorithm
• plus an additional ten hex-encoded random bit strings, built for SHA-1 and other message digest algorithms 💅

⚠️ the keys file has to be distributed and stored using secure means beyond the scope of NTP itself. do not just casually yeet this file around. it is not that kind of file.

oh and btw, those keys can also be used as passwords for the ntpq utility program. multitasking queen behavior fr fr 💅

---

🎀 COMMAND LINE OPTIONS 🎀

• -V, --version — prints the version string and then exits. that's it, that's the option. short and iconic. ✨

---

🔥 RUNNING THE PROGRAM 🔥

the simplest way to run ntpkeygen? be logged in directly as root. main character energy, but make it privileged.

the recommended procedure is:

1. change into the keys directory — usually /etc/ntp/
2. run the program
3. chown the output file to ntp:ntp
4. it should be mode 400 🔒

Warning 🚨 ntpkeygen uses the system randomness source. on a POSIX system, that's usually /dev/urandom. keep in mind: immediately after a reboot, on any OS, there may not be sufficient entropy available for this program to perform well. do not run this program from any startup scripts. only run this program on an active host with a lot of available entropy. periodt. 🌈

---

🧚 KEY FILE ACCESS AND LOCATION 🧚

file names begin with the prefix ntpkey and end with the postfix hostname.filestamp, where:

• hostname is the owner name — usually the string returned by the Unix gethostname() routine 🖥️
• filestamp is the NTP seconds when the file was generated, in decimal digits ⏱️

ntpkeygen also makes a soft link from ntp.keys to the generated file. and ntp.keys is the normal file used in ntp.conf. iykyk 💫

---

💜 RANDOM SEED FILE 💜

every key generation scheme has to have some means to randomize the entropy seed used to initialize the internal pseudo-random number generator that the library routines use. that's just the assignment.

important thing to understand, bestie: entropy must be evolved for each generation, because otherwise the random number sequence would be predictable 😭. various means dependent on external events — like keystroke intervals — can be used to do this, and some systems have built-in entropy sources. slay for them.

this implementation uses Python's random.SystemRandom class, which relies on os.urandom(). and the security of os.urandom() is improved in Python 3.5+ — check the docs at https://docs.python.org/library/os.html#os.urandom if you wanna read up. 🌸

---

👑 CRYPTOGRAPHIC DATA FILES 👑

unlike NTP Classic, this implementation generates only AES keys — not MD5 or SHA1. glow-up behavior honestly.

since the file contains private shared keys, it should be visible only to root or ntp. nobody else. gatekeeping for safety. 🙈

in order to use a shared key, the line to be used must also be setup on the target server. both sides need to be in on the bit, fr fr.

this file is also used to authenticate remote configuration commands used by the ntpq(1) utility.

comments may appear in the file and are preceded with the # character. 💬

following any headers, the keys are entered one per line in the format:

• keyno — positive integer in the range 1-65,535 🔢
• type — type of key (MD5, SHA-1, AES-CMAC etc). this program generates only AES.
• key — the actual key, printable ASCII or hex 🔑

---

⭐ EXIT STATUS ⭐

one of the following exit values will be returned:

• 0 (EXIT_SUCCESS) — successful program execution. we love to see it 🎉
• 1 (EXIT_FAILURE) — the operation failed or the command syntax was not valid. 💀

---

okay that's the whole page!! go forth and generate keys responsibly, bestie 🫶🔑

NTPsec · version date: 2026-10-21 · NTPKEYGEN(8) — mwah, bye!! 💖✨🎀