Disabling NTP on OS X Lion or older Following a new security vulnerability in the Network Time Protocol software package, Apple has provided a software update for Mountain Lion and newer versions of OS X.

As usual, the older versions of OS X that one may be stuck with (because the hardware does not support newer versions, because one needs Rosetta, …) are not covered by the security update.

My questions are:


is disabling “set date and time automatically” in Software Preferences enough to ensure that ntpd is not running?
what might break if the ntdp binary was simply deleted for safety on OS X Snow Leopard or Lion?


In doubt I might use these instructions to limit the scope of ntpd without completely disabling/deleting it, but in this case there remains the risk of getting it wrong and leaving ntpd exposed.
Instead of disabling ntpd, you should download the source for version 4.2.8 of ntp and compile it yourself. All you need is Xcode for Lion/SnowLeo. It should work on 10.6.x and 10.7.x just fine.

I have updated my 10.10 install immediately after the CVE was made public and source code released and I didn't wait on Apple to release the update. 

To compile ntpd, download the source from ntp.org and apply the patch for OS X/FreeBSD. After applying this patch, you will be able to just run "./configure &amp;&amp; make." Then you can copy the binaries to appropriate directories (/usr/sbin/ and /usr/bin/).

For Mac OS X 10.7 (Lion):

mkdir ntpd-fix
cd ntpd-fix
curl http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8.tar.gz | tar zxf -
cd ntp-4.2.8/ntpd
curl http://bugs.ntp.org/attachment.cgi?id=1165 | patch -p1
cd ..
./configure &amp;&amp; make


Here's the list of files and folders to which they belong to that will be built from the source above. After compilation, all these files will be in various sub-folders.

/usr/bin/sntp  
/usr/bin/ntp-keygen  
/usr/bin/ntpq  
/usr/sbin/ntpdc  
/usr/sbin/ntpdate  
/usr/sbin/ntpd


Rename old ones using something like:

sudo mv /usr/sbin/ntpd /usr/sbin/ntpd.old


and then move the new one in. Make sure to chown the files after moving them in place:

sudo chown root:wheel /usr/sbin/ntpd


Note: I did not use  sudo make install because I didn't trust the Makefile  (I wasn’t sure it would place files in the same folders that Apple has originally placed them in and wanted to be sure they're still in the same spot as old ones). Manually moving 6 files is not a big issue. Rest of the files (man pages, html pages, etc are the same so you don't have to bother moving those.)