On Thu, Mar 09, 2017 at 03:16:57PM +0000, Moser, Stefan wrote: > Now assume that one of the remote NTP clients turns bad, deliberately > configures forged > time, and enters "peer <IP_of_my_local_NTP_server>" in its ntp.conf. This > (correct me > if I'm wrong) creates a dynamic mobilization with my local NTP server, and my > local > NTP server will eventually believe in the client's (now it's a peering > server....) time.
Stefan, Ahh, now I understand the problem. You are misunderestimating NTP. Simply being authenticated allows you to establish the symmetric association -- it does not mean ntpd will select that peer to provide time to it. If it provides time that differs from the servers it has configured (even if unauthenticated), the selection and filter algorithms will ignore the symmetric association. The peer, even if authenticated and malacious, needs to pass all the filtering and selection algorithms any source of time does. Authentication authenticates the peer and the the timestamps -- it does not assure quality of the time provided, and ntpd does not make that assumption. > I think that this a potential security problem, and I'm looking for a > parameter > which I can use to r e j e c t dynamic mobilizations of a u t h e n t i c a t > e d > remote servers with my local server. For *un*authenticated servers, 'nopeer' > is > the parameter for doing this. But 'nopeer' does only work for unauthenticated > connections. You can always use "notrust" forcing the clients to authenticate even if you're simply a server to them. There's nothing that says you must use authentication with symmetric mode; they are orthagonal to each other (although, you should authenticate symmetric peers as a best practice -- but you may also authenticate simple clients.) --msa _______________________________________________ questions mailing list questions@lists.ntp.org http://lists.ntp.org/listinfo/questions