IT-CS NTP page

restrict default ignore
server   137.138.18.69
restrict 137.138.18.69 mask 255.255.255.255 nomodify notrap noquery
server   137.138.16.69
restrict 137.138.16.69 mask 255.255.255.255 nomodify notrap noquery
server   137.138.17.69
restrict 137.138.17.69 mask 255.255.255.255 nomodify notrap noquery
fudge    127.127.1.0 stratum 10
restrict 127.0.0.1 nomodify notrap

On CDB-managed machines, this can be done via ncm-ntpd (use 1.1.2 or better to get the above restricted behaviour).

Failure to restrict NTP properly can lead to remote attackers getting detailed information on the operating system (i.e. kernel version) and host time (helpful for some timing-related attacks), and even modify the machine's clock (which is at least disruptive, and again can be used for some attacks - e.g. re-using expired credentials).