root@dc2:/home/eida# cat /etc/ntp.conf
driftfile /var/lib/ntp/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
pool [SERVER].eida.lan # jako pool - hlavní NTP v síti
server time.euro.apple.com # fallback
restrict -4 default kod limited nomodify notrap nopeer mssntp
restrict -6 default kod limited nomodify notrap nopeer mssntp
restrict 127.0.0.1
restrict ::1
restrict default kod nomodify notrap nopeer mssntp
restrict source notrap nomodify noquery mssntp
ntpsigndsocket /var/lib/samba/ntp_signd/

root@dc2:/home/eida# setfacl -m u:ntp:rwx /var/lib/samba/ntp_signd/