diff --git a/manifests/config.pp b/manifests/config.pp
index 91990ba1..75b331f2 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -2,12 +2,21 @@
 class ntp::config inherits ntp {
 
   if $keys_enable {
-    $directory = ntp_dirname($keys_file)
-    file { $directory:
+    file { $keys_file:
+      ensure => file,
+      owner  => 0,
+      group  => 0,
+      mode   => '0644',
+    }
+  }
+
+  if $config_dir {
+    file { $config_dir:
       ensure  => directory,
       owner   => 0,
       group   => 0,
-      mode    => '0755',
+      mode    => '0644',
+      recurse => false,
     }
   }
 
diff --git a/manifests/init.pp b/manifests/init.pp
index 14adf595..f2b43755 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -2,6 +2,7 @@
   $autoupdate        = $ntp::params::autoupdate,
   $broadcastclient   = $ntp::params::broadcastclient,
   $config            = $ntp::params::config,
+  $config_dir        = $ntp::params::config_dir,
   $config_template   = $ntp::params::config_template,
   $disable_auth      = $ntp::params::disable_auth,
   $disable_monitor   = $ntp::params::disable_monitor,
@@ -56,6 +57,10 @@
   validate_string($service_name)
   validate_bool($udlc)
 
+  if $config_dir {
+    validate_absolute_path($config_dir)
+  }
+
   if $autoupdate {
     notice('autoupdate parameter has been deprecated and replaced with package_ensure.  Set this to latest for the same behavior as autoupdate => true.')
   }
diff --git a/manifests/params.pp b/manifests/params.pp
index 47a89800..71dc6872 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -1,6 +1,7 @@
 class ntp::params {
 
   $autoupdate        = false
+  $config_dir        = undef
   $config_template   = 'ntp/ntp.conf.erb'
   $disable_monitor   = false
   $keys_enable       = false
diff --git a/spec/classes/ntp_spec.rb b/spec/classes/ntp_spec.rb
index 4864e888..d27628aa 100644
--- a/spec/classes/ntp_spec.rb
+++ b/spec/classes/ntp_spec.rb
@@ -45,9 +45,6 @@
               :keys_requestkey => '3',
             }}
 
-            it { should contain_file('/etc/ntp').with({
-              'ensure'  => 'directory'})
-            }
             it { should contain_file('/etc/ntp.conf').with({
               'content' => /trustedkey 1 2 3/})
             }
@@ -69,9 +66,6 @@
             :keys_requestkey => '3',
           }}
 
-          it { should_not contain_file('/etc/ntp').with({
-            'ensure'  => 'directory'})
-          }
           it { should_not contain_file('/etc/ntp.conf').with({
             'content' => /trustedkey 1 2 3/})
           }