RSA Authentication Manager 8.x ntpq -p Command Fails with "Request Timed Out" When Checking NTP status
20 days ago
Originally Published: 2015-06-12
Article Number
000062882
Applies To

RSA Product Set: SecurID
RSA Product/ Service Type: Authentication Manager
RSA Version/Condition: 8.7 and lower

Issue
When running the ntpq -p command to check NTP peer status on RSA Authentication Manager 8.x, the command times out and returns an error — even when NTP is synchronizing correctly.
Observable symptoms:
  • Running ntpq -p from an SSH session or console connection returns a timeout error
  • No NTP peer table is displayed
  • NTP synchronization itself is unaffected — the error is specific to the query command
Error output:
localhost: timed out, nothing received
***Request timed out
Cause
The default ntp.conf on RSA Authentication Manager 8.x restricts NTP queries from the IPv6 localhost (::1), causing ntpq commands run from the local SSH session to time out.
Authentication Manager does not fully disable IPv6, so the system accepts IPv6 connections — but the default NTP configuration only permits queries from the IPv4 localhost (127.0.0.1). Because ntpq queries originate from the IPv6 localhost when run locally, they are silently blocked.
The relevant section of the default /etc/ntp.conf shows a restrict entry for IPv4 but none for IPv6:
 
restrict default kod nomodify notrap nopeer noquery
restrict -6 default ignore
restrict 127.0.0.1
# Missing: restrict -6 ::1
Resolution
Step 1: Connect to the Authentication Manager primary server via SSH.
ℹ️ NOTE — For instructions on establishing an SSH connection, see  How to SSH to an RSA Authentication Manager Server — covers SSH access setup for both appliance and virtual deployments.
 
Step 2: Log in as rsaadmin and enter the operating system password when prompted.
 
Step 3: Switch to the root user:
sudo su -
Enter the operating system password again when prompted.
 
Step 4: Open the NTP configuration file in a text editor: 
vi /etc/ntp.conf
 
Step 5: Press i to enter Insert mode.
 
Step 6: Scroll to the bottom of the file and add the following line:
restrict -6 ::1
The updated block should look like this: 
restrict default kod nomodify notrap nopeer noquery
restrict -6 default ignore
restrict 127.0.0.1
restrict -6 ::1
Step 7: Save and exit the file: 
:wq!
Step 8: Restart the NTP service: 
service ntp restart
Expected output:
Shutting down network time protocol daemon (NTPD)    done
Starting network time protocol daemon (NTPD)         done
ℹ️ NOTE — On Authentication Manager 8.4 and later, use the following command instead:
sudo systemctl restart ntpd.service
 
Step 9 — Verify: Run ntpq -p to confirm the fix was successful. You should now see a populated NTP peer table instead of the timeout error:
ntpq -p
Expected output:
✅ If the peer table is displayed, the fix has been applied successfully.
 
Notes
Scope of this fix: This change only enables the ability to query NTP status from the localhost using Linux commands such as ntpq -p. It does not affect NTP synchronization, and it will not alter or break any existing NTP configuration.
 
Expected behavior before fix: The ntpq -p command times out on all Authentication Manager 8.x servers — even when the configured NTP servers are reachable and syncing correctly. This is by design in the default configuration.

.

Related Articles

Trending Articles

Don't see what you're looking for?