Re: [Ntp] [EXT] Re: I-D Action: draft-ietf-ntp-alternative-port-00.txt

[Harlan Stenn <[e-mail]>]

On 11/1/2020 8:48 PM, Steven Sommars wrote:
> The NTP mode 7 monlist command has been used since 2013/2014 for DDoS
> attacks.
> As a countermeasure UDP port 123 traffic was/is filtered (dropped) on
> the Internet by Zayo,
> Telia, AT&T, CenturyLink and others.

mode7 has been disabled by default starting with ntp-4.2.7p230, which
was released on 1 Nov 2011.  If one waited for ntp-4.2.8 to get this
patch, it was released on 19 December 2014.

Even before that, starting with 4.2.7p26, which was released on 24 April
2010, we required a nonce before replying to a monlist request.

These changes were all on the server, not the client, so as soon as one
upgraded a vulnerable server the monlist DDoS attack would be prevented.

I'd like to see real data on the number servers that are on the public
internet that are still vulnerable to this.

> NTP filtering interferes with NTS and the NTP pool on some paths.

I'd like to see real data on this, too.  NTP Pool monitoring can be done
with simple time queries, and does not require larger NTP packets.

> Remote access to the monlist and other mode 6/7 commands has since been
> reduced, removed, modified or
> administratively disabled on many (probably most) public NTP servers.  I
> have not found any current,
> specific technical reasons why NTP filtering is still in place.  The
> ISPs I contacted gave only vague
> references to the monlist issue, if they responded at all.

Fair enough then.

>    Miroslav: NTS doesn't prevent the port from reflecting traffic
> Won't NTS simplify mitigation?   I thought crypto overhead would
> throttle attacks in software
> implementations.

Any authentication on an NTP packet, be it legacy MAC, NTS, or other
mechanisms will mitigate this.

Crypto overhead means an attacker has to have valid creds before
attacking, right?

H
--
>    Ulrich: Rate limiting in case of NTP means "random packet dropping"?
> Rate limiting is outside the scope of Miroslav's draft.  So I won't make
> a proposal here.
> 
>    Miroslav: Is a 1:1 reflection property normally considered to be a
> security issue?
> I thought UDP reflection attacks were still an issue.   See this 2017
> article: https://blog.cloudflare.com/reflections-on-reflections/
> 
> 
> Since RFC8915(NTS) has been published and since popular NTP
> implementations include NTS support
> perhaps ISPs will see increasing end-user dissatisfaction and eliminate
> or refine the port 123NTP
> filtering.  I doubt it though.  The alternate port seems necessary for
> widespread NTS deployment.
> 
> Will the Internet treat ALTPORT NTP/NTS nicely, without the type of
> filtering seen on port 123?
> I don't know.  
> 
> 
> Steve Sommars
> 
> _______________________________________________
> ntp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ntp
> 

-- 
Harlan Stenn <[e-mail]>
http://networktimefoundation.org - be a member!