FreeBSD15.0 : 初期設定(Vimインストール,SSH接続のセキュリティ対策,ファイアウォール,NTPサーバー)

Contents

1. Vim インストール
2.locateデータベースの利用
3. SSH接続のセキュリティ対策
4. ファイアウォール設定
5. NTPサーバー設定

1. Vim インストール

エディタとして使い慣れたVimを使用しますので下記の通りインストール

# pkg install -y vim

1	# pkg install -y vim

Vimを標準のエディタとして利用可能するため".shrc"を編集し、再度ログインしなおすと反映する
FreeBSD15はデフォルトシェルがでshになっている

次のコマンドで現在のSHELLを確認できる

# echo $SHELL
/bin/sh

1 2	# echo $SHELL /bin/sh

# vim ~/.shrc
以下の内容を追加する
alias vi='vim'

設定反映
# shutdown -r now

# vim ~/.shrc

以下の内容を追加する

alias vi='vim'

設定反映

# shutdown -r now

Vimの使用環境を整えるため".vimrc"を新規作成し、下記内容を記入

# vi ~/.vimrc 

以下の内容を追加する
set nocompatible
set encoding=utf-8
set nobackup
set tabstop=4
set clipboard+=autoselect
set number
syntax on
highlight Comment ctermfg=LightCyan
set wrap
set backspace=indent,eol,start
set autoindent

# vi ~/.vimrc

以下の内容を追加する

set nocompatible

set encoding=utf-8

set nobackup

set tabstop=4

set clipboard+=autoselect

set number

syntax on

highlight Comment ctermfg=LightCyan

set wrap

set backspace=indent,eol,start

set autoindent

再起動すると反映される

2.locateデータベースの利用

FreeBSDではupdatedbを利用すると次のようなエラーが出ます

 # /usr/libexec/locate.updatedb
>>> WARNING
>>> Executing updatedb as root.  This WILL reveal all filenames
>>> on your machine to all login users, which is a security risk.

# /usr/libexec/locate.updatedb

>>> WARNING

>>> Executing updatedb as root. This WILL reveal all filenames

>>> on your machine to all login users, which is a security risk.

エラーの内容は
rootユーザで updatedb を実行してます。
これは、すべてのログインユーザにすべてのファイル名を見ることが可能になってしまいます。これは、セキュリティリスクです。

FreeBSDではperiodic の下のスクリプトがcronによって実行されるので、cronが実行してくれるlocateデータベースの更新スクリプトを利用する

# /etc/periodic/weekly/310.locate

Rebuilding locate database:

# /etc/periodic/weekly/310.locate

Rebuilding locate database:

試しにsshdというキーワードで検索してみる

# locate sshd
/etc/pam.d/sshd
/etc/rc.d/sshd
/etc/ssh/sshd_config
/usr/libexec/sshd-auth
/usr/libexec/sshd-session
/usr/local/share/vim/vim91/ftplugin/sshdconfig.vim
/usr/local/share/vim/vim91/syntax/sshdconfig.vim
/usr/ports/deskutils/py-paperless/files/sshd_config.in
/usr/ports/deskutils/py-paperless-ngx/files/sshd_config.in
/usr/ports/security/openssh-portable/files/extra-patch-pam-sshd_config
/usr/ports/security/openssh-portable/files/patch-sshd.8
/usr/ports/security/openssh-portable/files/patch-sshd.c
/usr/ports/security/openssh-portable/files/patch-sshd_config
/usr/ports/security/openssh-portable/files/patch-sshd_config.5
/usr/ports/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd-session.conf
/usr/ports/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd.conf
/usr/sbin/sshd
.
.
.
.

# locate sshd

/etc/pam.d/sshd

/etc/rc.d/sshd

/etc/ssh/sshd_config

/usr/libexec/sshd-auth

/usr/libexec/sshd-session

/usr/local/share/vim/vim91/ftplugin/sshdconfig.vim

/usr/local/share/vim/vim91/syntax/sshdconfig.vim

/usr/ports/deskutils/py-paperless/files/sshd_config.in

/usr/ports/deskutils/py-paperless-ngx/files/sshd_config.in

/usr/ports/security/openssh-portable/files/extra-patch-pam-sshd_config

/usr/ports/security/openssh-portable/files/patch-sshd.8

/usr/ports/security/openssh-portable/files/patch-sshd.c

/usr/ports/security/openssh-portable/files/patch-sshd_config

/usr/ports/security/openssh-portable/files/patch-sshd_config.5

/usr/ports/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd-session.conf

/usr/ports/security/py-fail2ban/files/patch-config_filter.d_bsd-sshd.conf

/usr/sbin/sshd

3. SSH接続のセキュリティ対策

3.1 SSHポートの変更、ルートユーザーのログイン不可

# vi /etc/ssh/sshd_config

#   $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

Port 2244
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile  .ssh/authorized_keys

# vi /etc/ssh/sshd_config

# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and

# FreeBSD has a few additional options.

Port 2244

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying

#RekeyLimit default none

# Logging

#SyslogFacility AUTH

#LogLevel INFO

# Authentication:

#LoginGraceTime 2m

PermitRootLogin no

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2

# but this is overridden so installations will only check .ssh/authorized_keys

AuthorizedKeysFile .ssh/authorized_keys

16行目 : sshポート番号を2244に変更
35行目 : コメントを外しrootでssh接続できないようにする

設定の反映

# service sshd restart
Performing sanity check on sshd configuration.
Stopping sshd.
Waiting for PIDS: 1458.
Performing sanity check on sshd configuration.
Starting sshd.

# service sshd restart

Performing sanity check on sshd configuration.

Stopping sshd.

Waiting for PIDS: 1458.

Performing sanity check on sshd configuration.

Starting sshd.

3.2 公開鍵認証方式にする
① 公開鍵、秘密鍵ペアの作成---一般ユーザーにログインして作成する
作成先・ファイル名を指定しなければ、 /home/(ユーザ名)/.ssh/ に id_ed25519, id_eed25519.pub が作成される。途中、鍵用のパスワードも入力する。

# su - huong
$ ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/huong/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase): [Password]
Enter same passphrase again: [Password]
Your identification has been saved in /home/huong/.ssh/id_ed25519
Your public key has been saved in /home/huong/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:xboQ1lwuaVzf2FXCOtK2tD6Pie9c2mbG1GHvODpZ3y4 huong@Lepard
The key's randomart image is:
+--[ED25519 256]--+
|          o  .. +|
|       + * . +.o |
|      o B +.o.o  |
|     . o +. *  o |
|      . S  + +..o|
|       . .  o o o|
|        .  . =.+.|
|           o=*E +|
|          .oOOo+.|
+----[SHA256]-----+

# su - huong

$ ssh-keygen -t ed25519

Generating public/private ed25519 key pair.

Enter file in which to save the key (/home/huong/.ssh/id_ed25519):

Enter passphrase (empty for no passphrase): [Password]

Enter same passphrase again: [Password]

Your identification has been saved in /home/huong/.ssh/id_ed25519

Your public key has been saved in /home/huong/.ssh/id_ed25519.pub

The key fingerprint is:

SHA256:xboQ1lwuaVzf2FXCOtK2tD6Pie9c2mbG1GHvODpZ3y4 huong@Lepard

The key's randomart image is:

+--[ED25519 256]--+

| o .. +|

| + * . +.o |

| o B +.o.o |

| . o +. * o |

| . S + +..o|

| . . o o o|

| . . =.+.|

| o=*E +|

| .oOOo+.|

+----[SHA256]-----+

$ cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
$ chmod 600 ~/.ssh/authorized_keys
$ chmod 700 ~/.ssh/

$ cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys

$ chmod 600 ~/.ssh/authorized_keys

$ chmod 700 ~/.ssh/

➁作成した秘密鍵id_ed25519　をwinSCPでwindowsの[\Users\user\.ssh]配下に保存

➂SSH設定ファイルを編集
40行目 : コメントを外す
PermitRootLogin no

$ su -
# vi /etc/ssh/sshd_config

#   $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and
# FreeBSD has a few additional options.

Port 2244
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

$ su -

# vi /etc/ssh/sshd_config

# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

# Note that some of FreeBSD's defaults differ from OpenBSD's, and

# FreeBSD has a few additional options.

Port 2244

#AddressFamily any

#ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying

#RekeyLimit default none

# Logging

#SyslogFacility AUTH

#LogLevel INFO

# Authentication:

#LoginGraceTime 2m

PermitRootLogin no

#StrictModes yes

#MaxAuthTries 6

#MaxSessions 10

sshサービス再起動

# service sshd restart

1	# service sshd restart

④Tabby Terminalで接続する方法
オプション[-i c:\USERS\xxxxx\.ssh\id_ed25519]でkeyを指定する

C:\Users\xxxxx>ssh huong@192.168.11.83 -p 2244 -i c:\USERS\xxxxx\.ssh\id_ed25519
Enter passphrase for key 'c:\USERS\xxxxx\.ssh\id_ed25519': ←公開鍵作成時設定したパスワード入力
Last login: Thu Dec 4 20:46:30 2025 from 192.168.11.6
FreeBSD 15.0-RELEASE (GENERIC) releng/15.0-n280995-7aedc8de6446

huong@Lepard:~$

⑤公開鍵暗号方式を用いた認証によるSSH接続

公開鍵暗号方式を用いた認証によるSSH接続は他のLinuxと同様に行うことができますので下記を参考にしてください

MiracleLinux9.2 : 公開鍵暗号方式によるSSH接続

公開鍵暗号方式を用いた認証によるSSH接続公開鍵、秘密鍵ペアの作成OpenSSH 使って Linux サーバに接続するユーザの公開鍵と秘密鍵のペアを作成します。鍵ペアの作成は ssh-keygen をを使います。公開鍵と秘密鍵のペアの作成はリモートログインするユーザ権限で実行します。作成先・ファイル名を指定しなければ、 /home/(ユーザ名)/.ssh/ に id_ed25519, id_eed25519.pub が作成される。途中、鍵用のパスワードも入力する。

4. ファイアウォール設定

FreeBSDでは以下のファイアーウォールがあります
・pf
・ipfw
・ipf
今回は、ipfwを使用してファイアーウォールの設定をします。

4.1 ipfwが動くか確認

# ipfw list
...
Commnad not found.以外が出力されればOKです

# ipfw list

...

Commnad not found.以外が出力されればOKです

4.2 ipfwを使用するための設定を /etc/rc.conf に追記
/etc/rc.conf ファイルをvimエディタで編集するより、sysrcコマンドを利用するほうが便利

# sysrc firewall_enable="YES"　　　　　←サーバー起動時に有効化
firewall_enable: NO -> YES

# sysrc firewall_logdeny="YES"　　　　←拒否時に  /var/log/security にログ出力
firewall_logdeny: NO -> YES

# sysrc firewall_script="/usr/local/etc/ipfw.rules"    ←追加設定スクリプトを指定
firewall_script: /etc/rc.firewall -> /usr/local/etc/ipfw.rules

# sysrc firewall_enable="YES"　　　　　←サーバー起動時に有効化

firewall_enable: NO -> YES

# sysrc firewall_logdeny="YES"　　　　←拒否時に /var/log/security にログ出力

firewall_logdeny: NO -> YES

# sysrc firewall_script="/usr/local/etc/ipfw.rules" ←追加設定スクリプトを指定

firewall_script: /etc/rc.firewall -> /usr/local/etc/ipfw.rules

4.3 追加設定スクリプト(/usr/local/etc/ipfw.rules)を作成

# vi /usr/local/etc/ipfw.rules

1	# vi /usr/local/etc/ipfw.rules

追加設定スクリプトの内容-----とりあえず次のサービスポートを開放する
ftp (20,21), 初期ssh (22), smtp (25), dns (53) , http (80), ntp(123) , https(443) pop3(110), imap(143), mail-over(587) , 変更後SSH(2244)

#! /bin/sh
#
 
IPF="ipfw -q add"
ipfw -q -f flush
 
#loopback
$IPF 10 allow all from any to any via lo0
$IPF 20 deny all from any to 127.0.0.0/8
$IPF 30 deny all from 127.0.0.0/8 to any
$IPF 40 deny tcp from any to any frag
 
# statefull
$IPF 50 check-state
$IPF 60 allow tcp from any to any established
$IPF 70 allow all from any to any out keep-state
$IPF 80 allow icmp from any to any
 
$IPF 90 allow tcp from any to any 20 in
$IPF 100 allow tcp from any to any 20 out
$IPF 110 allow tcp from any to any 21 in
$IPF 120 allow tcp from any to any 21 out
$IPF 130 allow tcp from any to any 22 in
$IPF 140 allow tcp from any to any 22 out
$IPF 150 allow tcp from any to any 25 in
$IPF 160 allow tcp from any to any 25 out
$IPF 170 allow udp from any to any 53 in
$IPF 175 allow tcp from any to any 53 in
$IPF 180 allow udp from any to any 53 out
$IPF 185 allow tcp from any to any 53 out
$IPF 190 allow tcp from any to any 80 in
$IPF 200 allow tcp from any to any 80 out
$IPF 210 allow tcp from any to any 110 in
$IPF 220 allow tcp from any to any 110 out
$IPF 230 allow tcp from any to any 123 in
$IPF 240 allow tcp from any to any 123 out
$IPF 250 allow tcp from any to any 143 in
$IPF 260 allow tcp from any to any 143 out
$IPF 270 allow tcp from any to any 443 in
$IPF 280 allow tcp from any to any 443 out
$IPF 290 allow tcp from any to any 587 in
$IPF 300 allow tcp from any to any 587 out
$IPF 310 allow tcp from any to any 2244 in
$IPF 320 allow tcp from any to any 2244 out

 # deny and log everything
$IPF 500 deny log all from any to any

#! /bin/sh

IPF="ipfw -q add"

ipfw -q -f flush

#loopback

$IPF 10 allow all from any to any via lo0

$IPF 20 deny all from any to 127.0.0.0/8

$IPF 30 deny all from 127.0.0.0/8 to any

$IPF 40 deny tcp from any to any frag

# statefull

$IPF 50 check-state

$IPF 60 allow tcp from any to any established

$IPF 70 allow all from any to any out keep-state

$IPF 80 allow icmp from any to any

$IPF 90 allow tcp from any to any 20 in

$IPF 100 allow tcp from any to any 20 out

$IPF 110 allow tcp from any to any 21 in

$IPF 120 allow tcp from any to any 21 out

$IPF 130 allow tcp from any to any 22 in

$IPF 140 allow tcp from any to any 22 out

$IPF 150 allow tcp from any to any 25 in

$IPF 160 allow tcp from any to any 25 out

$IPF 170 allow udp from any to any 53 in

$IPF 175 allow tcp from any to any 53 in

$IPF 180 allow udp from any to any 53 out

$IPF 185 allow tcp from any to any 53 out

$IPF 190 allow tcp from any to any 80 in

$IPF 200 allow tcp from any to any 80 out

$IPF 210 allow tcp from any to any 110 in

$IPF 220 allow tcp from any to any 110 out

$IPF 230 allow tcp from any to any 123 in

$IPF 240 allow tcp from any to any 123 out

$IPF 250 allow tcp from any to any 143 in

$IPF 260 allow tcp from any to any 143 out

$IPF 270 allow tcp from any to any 443 in

$IPF 280 allow tcp from any to any 443 out

$IPF 290 allow tcp from any to any 587 in

$IPF 300 allow tcp from any to any 587 out

$IPF 310 allow tcp from any to any 2244 in

$IPF 320 allow tcp from any to any 2244 out

# deny and log everything

$IPF 500 deny log all from any to any

システムの再起動

# shutdown -r now

1	# shutdown -r now

ipfwのリストを表示

# ipfw list
00010 allow ip from any to any via lo0
00020 deny ip from any to 127.0.0.0/8
00030 deny ip from 127.0.0.0/8 to any
00040 deny tcp from any to any frag offset
00050 check-state :default
00060 allow tcp from any to any established
00070 allow ip from any to any out keep-state :default
00080 allow icmp from any to any
00090 allow tcp from any to any 20 in
00100 allow tcp from any to any 20 out
00110 allow tcp from any to any 21 in
00120 allow tcp from any to any 21 out
00130 allow tcp from any to any 22 in
00140 allow tcp from any to any 22 out
00150 allow tcp from any to any 25 in
00160 allow tcp from any to any 25 out
00170 allow udp from any to any 53 in
00175 allow tcp from any to any 53 in
00180 allow udp from any to any 53 out
00185 allow tcp from any to any 53 out
00190 allow tcp from any to any 80 in
00200 allow tcp from any to any 80 out
00210 allow tcp from any to any 110 in
00220 allow tcp from any to any 110 out
00230 allow tcp from any to any 123 in
00240 allow tcp from any to any 123 out
00250 allow tcp from any to any 143 in
00260 allow tcp from any to any 143 out
00270 allow tcp from any to any 443 in
00280 allow tcp from any to any 443 out
00290 allow tcp from any to any 587 in
00300 allow tcp from any to any 587 out
00310 allow tcp from any to any 2244 in
00320 allow tcp from any to any 2244 out
00500 deny log ip from any to any
65535 deny ip from any to any

# ipfw list

00010 allow ip from any to any via lo0

00020 deny ip from any to 127.0.0.0/8

00030 deny ip from 127.0.0.0/8 to any

00040 deny tcp from any to any frag offset

00050 check-state :default

00060 allow tcp from any to any established

00070 allow ip from any to any out keep-state :default

00080 allow icmp from any to any

00090 allow tcp from any to any 20 in

00100 allow tcp from any to any 20 out

00110 allow tcp from any to any 21 in

00120 allow tcp from any to any 21 out

00130 allow tcp from any to any 22 in

00140 allow tcp from any to any 22 out

00150 allow tcp from any to any 25 in

00160 allow tcp from any to any 25 out

00170 allow udp from any to any 53 in

00175 allow tcp from any to any 53 in

00180 allow udp from any to any 53 out

00185 allow tcp from any to any 53 out

00190 allow tcp from any to any 80 in

00200 allow tcp from any to any 80 out

00210 allow tcp from any to any 110 in

00220 allow tcp from any to any 110 out

00230 allow tcp from any to any 123 in

00240 allow tcp from any to any 123 out

00250 allow tcp from any to any 143 in

00260 allow tcp from any to any 143 out

00270 allow tcp from any to any 443 in

00280 allow tcp from any to any 443 out

00290 allow tcp from any to any 587 in

00300 allow tcp from any to any 587 out

00310 allow tcp from any to any 2244 in

00320 allow tcp from any to any 2244 out

00500 deny log ip from any to any

65535 deny ip from any to any

5. NTPサーバー設定

5.1 /etc/ntp.conf中の参照先NTPサーバーを書き換えます。日本にある適当なサーバーを追加します。

# vi /etc/ntp.conf

32,33行目コメントにしてその下に追記
#pool 0.freebsd.pool.ntp.org iburst
#pool 2.freebsd.pool.ntp.org iburst
pool ntp.nict.jp iburst

# vi /etc/ntp.conf

32,33行目コメントにしてその下に追記

#pool 0.freebsd.pool.ntp.org iburst

#pool 2.freebsd.pool.ntp.org iburst

pool ntp.nict.jp iburst

5.2 ntp自動起動設定

# sysrc ntpd_enable="YES"
# sysrc ntpd_sync_on_start="YES"

1 2	# sysrc ntpd_enable="YES" # sysrc ntpd_sync_on_start="YES"

5.3 時刻を修正
時刻がずれすぎると NTP デーモンが動作を停止させるのでntpdate コマンドで時刻を修正してから NTP デーモンを起動させる

# ntpdate ntp.nict.jp
 4 Dec 13:24:07 ntpdate[1682]: step time server 61.205.120.130 offset -32400.282086 sec

# /etc/rc.d/ntpd start
Starting ntpd.

# ntpdate ntp.nict.jp

4 Dec 13:24:07 ntpdate[1682]: step time server 61.205.120.130 offset -32400.282086 sec

# /etc/rc.d/ntpd start

Starting ntpd.

5.4 時刻同期確認(少し時間をおいてから確認する)

# ntpq -p

     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
 ntp.nict.jp     .POOL.          16 p    -   64    0    0.000   +0.000   0.008
+ntp-b3.nict.go. .NICT.           1 u    6   64    3   11.049   -1.350   1.434
+ntp-a2.nict.go. .NICT.           1 u    4   64    3   12.186   -0.601   0.747
*ntp-k1.nict.jp  .NICT.           1 u    4   64    3    7.746   -0.570   0.643
+ntp-a3.nict.go. .NICT.           1 u    4   64    3   12.576   -0.433   0.823
+ntp-b2.nict.go. .NICT.           1 u    1   64    3   12.873   -1.038   0.580