Re: [Ntp] NTS Hackathon coordination

[Miroslav Lichvar <[e-mail]>]

On Sat, Mar 23, 2019 at 12:37:55PM +0100, Daniel Franke wrote:
> We need to get the word out to network operators to stop filtering in this
> manner (and that if they really must filter, they should limit it to mode 7
> packets).

And mode 6 packets, which still seem to be enabled by default in the
implementations that support it.

> As a (hopefully) temporary measure, implementers should make it
> easy for users to serve NTP on an alternate port in addition to 123, and
> use Port Negotiation in NTS-KE to advertise it. There should be no need for
> any spec changes or IANA actions to accommodate this behavior; since we
> have the negotiation mechanism, there is no need for a registered port and
> administrators can pick anything not in use by another service.

That won't work with firewalls which have whitelisted UDP ports. This
is a common practice in some environments. (Stateful firewalls can't
get the number from the encrypted NTS-KE.)

I think we should specify an alternative port for NTP, where modes 6
and 7 are not allowed. The port 123 is doomed. It's increasingly
difficult to find an ISP that doesn't block the port. Some large
network operators seem to limit rate of packets using that port. Two
of my public servers recently became unusable for this reason. Nobody
cares.

Blocking and rate limiting of the port is probably the main reason why
the number of public servers is still dropping 5 years after the
amplification attacks started.

-- 
Miroslav Lichvar