Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread E-Mail Sent to this address will be added to the BlackLists
Greg Troxel wrote: > Really, ntpd should, when run with a config file of only > > server 0.pool.ntp.org > server 1.pool.ntp.org > server 2.pool.ntp.org # IMHO, More like: restrict -4 default limited kod nomodify notrap nopeer noquery restrict 127.0.0.1 restrict -6 default limited kod nomodif

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread Sanal, Arjun (NSN - IN/Bangalore)
> There are I believe some other options with newer version of ntp (orphan > mode?) as well, but I do not know the details. Thanks everybody. Orphan mode seems to help. -- Arjun ___ questions mailing list questions@lists.ntp.org http://lists.ntp.org/li

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread William Unruh
On 2014-01-16, Steve Kostecke wrote: > On 2014-01-16, Greg Troxel wrote: > >> Harlan Stenn writes: >> >>> William Unruh writes: I do not mean the default in the config file, I mean the default if there is no config file or if nothing is set in the config file. >>> >>> Then ntpd won't c

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Steve Kostecke
On 2014-01-16, Miroslav Lichvar wrote: > IIRC the pool command in 4.2.6 uses quite a lot of servers, which > probably is not an acceptable use of pool.ntp.org. I think it was > improved later in 4.2.7. The page about recommended configuration > doesn't mention it yet. > > http://www.pool.ntp.org/

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Steve Kostecke
On 2014-01-16, David Lord wrote: > Steve Kostecke wrote: > > [---=| Quote block shrinked by t-prot: 25 lines snipped |=---] >> [snip: sample defaults] > I have "restrict -4 limited kod nomodify notrap nopeer noquery" > > I've not checked most recent docs but thought "limited" was > needed for

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Harlan Stenn
David Lord writes: > I have "restrict -4 limited kod nomodify notrap nopeer noquery" > > I've not checked most recent docs but thought "limited" was > needed for "kod". It is. > There were also some posts indicating that "kod" could be > counter productive leading to self inflicted DOS. I'd lov

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Brian Utterback
On 1/16/2014 3:45 PM, Steve Kostecke wrote: On 2014-01-16, Greg Troxel wrote: Harlan Stenn writes: The majority use case for ntpd is to synchronize your clock to UTC (i.e. a leaf-node client). So an ntpd ought to have the following defaults: driftfile /path/to/ntp.drift pool pool.ntp.org i

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread David Lord
Steve Kostecke wrote: On 2014-01-16, Greg Troxel wrote: Harlan Stenn writes: William Unruh writes: I do not mean the default in the config file, I mean the default if there is no config file or if nothing is set in the config file. Then ntpd won't connect to anything and there will be no

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Steve Kostecke
On 2014-01-16, Greg Troxel wrote: > Harlan Stenn writes: > >> William Unruh writes: >>> I do not mean the default in the config file, I mean the default if >>> there is no config file or if nothing is set in the config file. >> >> Then ntpd won't connect to anything and there will be no data to

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread William Unruh
On 2014-01-16, Maarten Wiltink wrote: > "Sanal, Arjun (NSN - IN/Bangalore)" wrote in message > news:592c0209968e17479f27087d92c1f7e414e...@sgsimbx006.nsn-intra.net... > > [...] >> The setup is a blade server, which has one master blade server which >> runs the ntp server. All other blades sync th

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Martin Burnicki
Rob wrote: Martin Burnicki wrote: I bet the "server" options for pool servers are in there because this was used in earlier versions before the "pool" keyword was introduced, and it still works. instead, and I'd have to look up when the 'pool' directive was put in there. IIRC this is suppor

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Martin Burnicki
Miroslav Lichvar wrote: On Thu, Jan 16, 2014 at 02:28:32PM +0100, Martin Burnicki wrote: Harlan Stenn wrote: pool 0.debian.pool.ntp.org iburst I bet the "server" options for pool servers are in there because this was used in earlier versions before the "pool" keyword was introduced, and it

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Miroslav Lichvar
On Thu, Jan 16, 2014 at 02:28:32PM +0100, Martin Burnicki wrote: > Harlan Stenn wrote: > > pool 0.debian.pool.ntp.org iburst > > I bet the "server" options for pool servers are in there because > this was used in earlier versions before the "pool" keyword was > introduced, and it still works. >

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Rob
Martin Burnicki wrote: > I bet the "server" options for pool servers are in there because this > was used in earlier versions before the "pool" keyword was introduced, > and it still works. > >> instead, and I'd have to look up when the 'pool' directive was put in >> there. > > IIRC this is supp

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Martin Burnicki
Harlan Stenn wrote: Ralph Aichinger writes: Debian seems to ship the following (minus comments and disabled stuff): driftfile /var/lib/ntp/ntp.drift server 0.debian.pool.ntp.org iburst server 1.debian.pool.ntp.org iburst server 2.debian.pool.ntp.org iburst server 3.debian.pool.ntp.org iburst re

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Martin Burnicki
Harlan Stenn wrote: Martin, I'm OK including updated ntp.conf files in the distribution, for 4.2.8 even. How about changing the built-in default restrictions in in 4.2.8 so that they match what is commonly used nowadays, without having to specify the restrict lines? Martin -- Martin Burnic

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Harlan Stenn
Martin, I'm OK including updated ntp.conf files in the distribution, for 4.2.8 even. H ___ questions mailing list questions@lists.ntp.org http://lists.ntp.org/listinfo/questions

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Harlan Stenn
Ralph Aichinger writes: > Greg Troxel wrote: > > Really, ntpd should, when run with a config file of only > > > > server 0.pool.ntp.org > > server 1.pool.ntp.org > > server 2.pool.ntp.org > > Debian seems to ship the following (minus comments and disabled stuff): > > driftfile /var/lib/ntp/n

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Martin Burnicki
Harlan Stenn wrote: Greg Troxel writes: Harlan Stenn writes: William Unruh writes: I do not mean the default in the config file, I mean the default if there is no config file or if nothing is set in the config file. Then ntpd won't connect to anything and there will be no data to report.

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Ralph Aichinger
Greg Troxel wrote: > Really, ntpd should, when run with a config file of only > > server 0.pool.ntp.org > server 1.pool.ntp.org > server 2.pool.ntp.org Debian seems to ship the following (minus comments and disabled stuff): driftfile /var/lib/ntp/ntp.drift server 0.debian.pool.ntp.org iburst

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Harlan Stenn
Rob writes: > Harlan Stenn wrote: > > So please complain as much as you want. Please volunteer as much as you > > want. Please financially support Network Time as much as you want. I > > also invite folks to pay attention to what they want to "get", and see > > how what they are and are not doi

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Rob
Harlan Stenn wrote: > So please complain as much as you want. Please volunteer as much as you > want. Please financially support Network Time as much as you want. I > also invite folks to pay attention to what they want to "get", and see > how what they are and are not doing correlates to what

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Miroslav Lichvar
On Wed, Jan 15, 2014 at 08:35:32PM +, Rob wrote: > William Unruh wrote: > > I do not mean the default in the config file, I mean the default if > > there is no config file or if nothing is set in the config file. > > That only becomes meaningful when ntpd starts to actually work without > con

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Rob
Harlan Stenn wrote: > William Unruh writes: >> I do not mean the default in the config file, I mean the default if >> there is no config file or if nothing is set in the config file. > > Then ntpd won't connect to anything and there will be no data to report. The data to report is not what ntpd c

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread Jochen Bern
On 16.01.2014 08:00, Arjun Sanal wrote: > The setup is a blade server, which has one master blade server which > runs the ntp server. All other blades sync the time from this master. > The master itself gets it time from a higher ntp server. The problem > is when the master says that it is not suit

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread Terje Mathisen
David Taylor wrote: Is there not a case for issuing 4.2.8 now, warts and all, and advising the world of the upgrade? 4.2.7p410 is working well on all my systems, and 4.2.7p411 is only a documentation update. There's a very good case for doing so, the only formal stopper is the current list of

Re: [ntp:questions] better rate limiting against amplification attacks?

2014-01-16 Thread David Taylor
Is there not a case for issuing 4.2.8 now, warts and all, and advising the world of the upgrade? 4.2.7p410 is working well on all my systems, and 4.2.7p411 is only a documentation update. -- Cheers, David Web: http://www.satsignal.eu ___ questions m

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread David Woolley
On 16/01/14 07:00, Sanal, Arjun (NSN - IN/Bangalore) wrote: [Excessively long line re-wrapped.] The problem is when the master says that it is not suitable for synchronization, the client blades shouldn't reject it. If they, do all the blades will end up with different time. Use orphan mode,

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread Martin Burnicki
Maarten Wiltink wrote: "Sanal, Arjun (NSN - IN/Bangalore)" wrote in message news:592c0209968e17479f27087d92c1f7e414e...@sgsimbx006.nsn-intra.net... [...] The setup is a blade server, which has one master blade server which runs the ntp server. All other blades sync the time from this master. T

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread Maarten Wiltink
"Sanal, Arjun (NSN - IN/Bangalore)" wrote in message news:592c0209968e17479f27087d92c1f7e414e...@sgsimbx006.nsn-intra.net... [...] > The setup is a blade server, which has one master blade server which > runs the ntp server. All other blades sync the time from this master. > The master itself get

Re: [ntp:questions] need option to ignore 'leap not in sync error'

2014-01-16 Thread mike cook
Le 16 janv. 2014 à 08:00, Sanal, Arjun (NSN - IN/Bangalore) a écrit : > > On 14/01/2014 14:58, Sanal, Arjun (NSN - IN/Bangalore) wrote: >>> Hi, >>> I understand that whenever the server sets the Leap Indicator flag to 11 >>> [not synchronized] the default behavior of ntp client is to reject the