Why ntpd needs an open port?

Question

On my Ubuntu system I have activated the 'Time Synchronization via Internet'. Because of that the ntp daemon gets started.

What I don't understand: Why needs ntpd an open UDP port 123? Actually, I don't want to have a ntp server running on my machine - my intention was only to synchronize my time with ntp servers on the internet.

So, my question are:

• Why is there an open port by default if I only want to synchronize with other ntp servers?

• Isn't that a unnecessary security risk?

• Has somebody a good solution for my 'problem'?

Thank you very much for your help in advance. I searched the internet already but I couldn't find sastisfactory answers.

Answer 1

Quoted from this perfect answer

ISC ntpd (the ntp package) will open UDP 123 on all your interfaces 
regardless of what you do with it. It will work anyway even if you block this
 port in iptables, assuming that you're allowing responses to established traffic 
as usual - your outbound mobilization requests to your chosen servers will be
 enough to allow the responses, and the same with further traffic sent for 
the lifetime of ntpd. Using iptables like this is probably the easiest way to 
secure ntpd. There's also some defense in depth you can do:
- run ntpd as non-root
- run it chrooted to some safe directory (really only makes sense when doing 
non-root as well, since root can break out of a chroot)
- apply ntpd's built-in access controls (see examples in ntpd.conf, and full
 docs in ntp_acc(5))

For more information please read the full answer in the link above, In addition take a look to this answer in SU