Re: [Ntp] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

It’s not the rest of the community’s job to make sure your port is useful - it is yours (the NTP community’s). 

I.e., you gave one viable way forward: fix the filtering.
I gave another - find a way around/through the filtering.

Redundant port assignments are not a “simple” solution - they are an expensive one that you should not have not, IMO, earned access to, if for no other reason than “poor stewardship of what you already have”.

Joe

—
Joe Touch, temporal epistemologist
www.strayalpha.com

> On Dec 4, 2021, at 9:00 PM, Steven Sommars <stevesommarsntp@gmail.com> wrote:
> 
> NTP got a bad reputation as an amplification attack vector circa 2014.  The offending NTP servers have largely been fixed; today few public servers will blindly amplify the Mode 7/monlist command (the major problem source).  The organizations doing the filtering aren't receptive to suggestions that they alter/remove their filtering schemes.  
> 
> Those finding the alternate port distasteful could help by reaching out to the organizations doing the filtering and convincing them that changes are needed.
> 
> I don't like the alternative port idea either, but see no other simple solution.  Short of designing yet another time transfer protocol what would you suggest?
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> On Sat, Dec 4, 2021 at 8:08 PM touch@strayalpha.com <mailto:touch@strayalpha.com> <touch@strayalpha.com <mailto:touch@strayalpha.com>> wrote:
> HI, Hal,
> 
> Again, with ports team review hat on:
> 
> Everything that happened below is equivalent to finding a zero-day or other kind of protocol error in any service.
> 
> The fact that the current ’solution’ is to block that port isn’t new either.
> 
> We don’t have resources to continually assign ‘fresh’ ports for services and I see no reason this one warrants an exception.
> 
> There are other solutions here; if your own recommendations caused packets smaller than 48 to be dropped, then find a way to fragment and reassemble authenticated packets until you find out that larger ones get through.
> 
> This is a protocol design problem, not a port assignment problem.
> 
> Joe
> 
> —
> Joe Touch, temporal epistemologist
> www.strayalpha.com <http://www.strayalpha.com/>
> 
>> On Dec 4, 2021, at 3:12 PM, Hal Murray <halmurray@sonic.net <mailto:halmurray@sonic.net>> wrote:
>> 
>> 
>> touch@strayalpha.com <mailto:touch@strayalpha.com> said:
>>> FWIW, I don't see this assignment as appropriate. 
>> 
>> Without a new port, it will be close to impossible to widely deploy NTP 
>> security.
>> 
>> 
>> Years ago (2013), NTP was used in a giant DDoS attack.  That was due to a 
>> bug/oversight that had been around since the early NTP work.  (I've tracked it 
>> back to 1989.)
>>  https://www.spamhaus.org/news/article/695/answers-about-recent-ddos <https://www.spamhaus.org/news/article/695/answers-about-recent-ddos>
>>  https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification <https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification>
>> The Wikipedia chart could use another column -- the number of sites available. 
>> Almost all Linux or *BSD sites were running ntpd.
>> 
>> The fix was trivial, but there are many essentially unattended sites running 
>> old versions of ntpd that will never get fixed.
>> 
>> Many many many sites have quietly installed filters in their routers.  Set and 
>> forget.
>> 
>> A typical filter drops UDP traffic to port 123 with a length other than 48.  
>> That lets old unauthenticated NTP through but authenticated packets are longer 
>> and get dropped.
>> 
>> To use authentication on the existing port would require removing those 
>> filters.  Even if you could track down the right people, they would probably 
>> drag their feet until most of the sites running old unattended ntpd were fixed.
>> 
>> An alternative would be to implement BCP 38.  How long has that been in 
>> progress?
>> 
>> -- 
>> These are my opinions.  I hate spam.
>> 
>> 
>> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org <mailto:ntp@ietf.org>
> https://www.ietf.org/mailman/listinfo/ntp <https://www.ietf.org/mailman/listinfo/ntp>
> _______________________________________________
> Tsv-art mailing list
> Tsv-art@ietf.org
> https://www.ietf.org/mailman/listinfo/tsv-art