[Ntp] Antw: Re: NTS Hackathon coordination

>>> Miroslav Lichvar <mlichvar@redhat.com> schrieb am 27.03.2019 um 10:31 in
Nachricht <20190327093142.GH16488@localhost>:
> On Sat, Mar 23, 2019 at 12:37:55PM +0100, Daniel Franke wrote:
>> We need to get the word out to network operators to stop filtering in this
>> manner (and that if they really must filter, they should limit it to mode
7
>> packets).
> 
> And mode 6 packets, which still seem to be enabled by default in the
> implementations that support it.

As a side-note: Our university also had blocked almost all NTP traffic to the
outside, making NTP pool servers ridiculous: The client gets a long list of
addresses through DNS, but cannot reach any of those. If you compare that to
some multicast/manycast solution, the client wouldn't receive any server. I'd
prefer the second.

In the past I could query various "outside" servers, even with mode 6 packets.
I don't like the state as it is now, but if there's threat (mostly by lawyers
claiming refund for denial of service originating from the universitiy's
network) the security people shut down service. More and more services get shut
down here...

> 
>> As a (hopefully) temporary measure, implementers should make it
>> easy for users to serve NTP on an alternate port in addition to 123, and
>> use Port Negotiation in NTS‑KE to advertise it. There should be no need
for
>> any spec changes or IANA actions to accommodate this behavior; since we
>> have the negotiation mechanism, there is no need for a registered port and
>> administrators can pick anything not in use by another service.
> 
> That won't work with firewalls which have whitelisted UDP ports. This
> is a common practice in some environments. (Stateful firewalls can't
> get the number from the encrypted NTS‑KE.)
> 
> I think we should specify an alternative port for NTP, where modes 6
> and 7 are not allowed. The port 123 is doomed. It's increasingly
> difficult to find an ISP that doesn't block the port. Some large
> network operators seem to limit rate of packets using that port. Two
> of my public servers recently became unusable for this reason. Nobody
> cares.
> 
> Blocking and rate limiting of the port is probably the main reason why
> the number of public servers is still dropping 5 years after the
> amplification attacks started.
> 
> ‑‑ 
> Miroslav Lichvar
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 