I am configuring five new RHEL6 NTP servers. Each uses a list of five USNO servers as their source with at least one unique server one each one. Each of the five servers also peers to the others. None of them is publicly accessible.I'm not entirely sure of what my restrict line(s) should look like. Do I want to remove the nomodify option so the peers can update each other? I don't have the nopeer option as that would obviously be counter to the whole peering configuration. Do I want nomodify as a catch-all and have specific restrict lines without it for each of the peers?ntp.conf from the first of the five:restrict default kod notraprestrict 127.0.0.1driftfile /var/lib/ntp/driftlogfile /var/log/ntp.logserver tick.usno.navy.mil iburstserver ntp-s1.cise.ufl.edu iburstserver ntp.colby.edu iburstserver navobs1.oar.net iburstserver gnomon.cc.columbia.edu iburstbroadcast 10.153.156.127 autokeypeer local-ntp-server.2 iburst autokeypeer local-ntp-server.3 iburst autokeypeer local-ntp-server.4 iburst autokeypeer local-ntp-server.5 iburst autokeycryptoincludefile /etc/ntp/crypto/pwkeysdir /etc/ntp/crypto/
Do I need nomodify set on NTP servers which are not publicly accessible?
ntp
nomodify has nothing to do with server synchronization. nomodify has to do with changing settings on the server with ntpq/ntpdc. From the ntp access restriction documentation: nomodify    Deny ntpq and ntpdc queries which attempt to modify the state of the server    (i.e., run time reconfiguration). Queries which return information are permitted.http://www.eecis.udel.edu/~mills/ntp/html/accopt.htmlWhy use 5 stratum one servers across five peers? Surely you could get by with 3 USNO servers and two servers from pool.ntp.org? 