I was reviewing VPC flow-logs of my EC2 instance (standard AWS Linux image), where I stumbled upon an entry with port 123 (NTP) with destination as 107.170.0.6 (kapu.ruselabs.com)
Being new to this, i digged further and found more strange looking NTP Servers being used by my VM.
[ec2-user@ip-... ~]$ ntpq -p
remote refid
-------------------------
+time.mclarkdev. 167.114.204.238
-aprihop.cdknnjl 173.162.192.156
*chl.la 216.218.254.202
+kapu.ruselabs.c 200.98.196.212
I understand that this is most likely a standard practice, but I dont feel comfortable when my box is talking to strangers. In this case I am unable to find which person/organisation runs kapu.ruselabs.com
So the question is, what are best-practices around using NTP servers when running VMs in AWS.