Re: [Ntp] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

NTP got a bad reputation as an amplification attack vector circa 2014.  The
offending NTP servers have largely been fixed; today few public servers
will blindly amplify the Mode 7/monlist command (the major problem
source).  The organizations doing the filtering aren't receptive to
suggestions that they alter/remove their filtering schemes.

Those finding the alternate port distasteful could help by reaching out to
the organizations doing the filtering and convincing them that changes are
needed.

I don't like the alternative port idea either, but see no other simple
solution.  Short of designing yet another time transfer protocol what would
you suggest?

On Sat, Dec 4, 2021 at 8:08 PM touch@strayalpha.com <touch@strayalpha.com>
wrote:

> HI, Hal,
>
> Again, with ports team review hat on:
>
> Everything that happened below is equivalent to finding a zero-day or
> other kind of protocol error in any service.
>
> The fact that the current ’solution’ is to block that port isn’t new
> either.
>
> We don’t have resources to continually assign ‘fresh’ ports for services
> and I see no reason this one warrants an exception.
>
> There are other solutions here; if your own recommendations caused packets
> smaller than 48 to be dropped, then find a way to fragment and reassemble
> authenticated packets until you find out that larger ones get through.
>
> This is a protocol design problem, not a port assignment problem.
>
> Joe
>
> —
> Joe Touch, temporal epistemologist
> www.strayalpha.com
>
> On Dec 4, 2021, at 3:12 PM, Hal Murray <halmurray@sonic.net> wrote:
>
>
> touch@strayalpha.com said:
>
> FWIW, I don't see this assignment as appropriate.
>
>
> Without a new port, it will be close to impossible to widely deploy NTP
> security.
>
>
> Years ago (2013), NTP was used in a giant DDoS attack.  That was due to a
> bug/oversight that had been around since the early NTP work.  (I've
> tracked it
> back to 1989.)
>  https://www.spamhaus.org/news/article/695/answers-about-recent-ddos
>  https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification
> The Wikipedia chart could use another column -- the number of sites
> available.
> Almost all Linux or *BSD sites were running ntpd.
>
> The fix was trivial, but there are many essentially unattended sites
> running
> old versions of ntpd that will never get fixed.
>
> Many many many sites have quietly installed filters in their routers.  Set
> and
> forget.
>
> A typical filter drops UDP traffic to port 123 with a length other than
> 48.
> That lets old unauthenticated NTP through but authenticated packets are
> longer
> and get dropped.
>
> To use authentication on the existing port would require removing those
> filters.  Even if you could track down the right people, they would
> probably
> drag their feet until most of the sites running old unattended ntpd were
> fixed.
>
> An alternative would be to implement BCP 38.  How long has that been in
> progress?
>
> --
> These are my opinions.  I hate spam.
>
>
>
>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp
>