Re: [Ntp] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Danny Mayer <[e-mail]>]

On 12/4/21 6:12 PM, Hal Murray wrote:
> [e-mail] said:
>> FWIW, I don't see this assignment as appropriate.
> Without a new port, it will be close to impossible to widely deploy NTP
> security.
Why would that be? NTP has a port that is widely deployed.
>
> Years ago (2013), NTP was used in a giant DDoS attack.  That was due to a
> bug/oversight that had been around since the early NTP work.  (I've tracked it
> back to 1989.)
>    https://www.spamhaus.org/news/article/695/answers-about-recent-ddos
>    https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification
> The Wikipedia chart could use another column -- the number of sites available.
>   Almost all Linux or *BSD sites were running ntpd.
>
> The fix was trivial, but there are many essentially unattended sites running
> old versions of ntpd that will never get fixed.

Yes so how is the alternative port going to magically fix this?

> Many many many sites have quietly installed filters in their routers.  Set and
> forget.
>
> A typical filter drops UDP traffic to port 123 with a length other than 48.
> That lets old unauthenticated NTP through but authenticated packets are longer
> and get dropped.
The same happened with EDNS0. Firewall administrators had to go in and 
adjust their filtering. The same thing needs to  be done for NTP. It's 
EXACTLY what would be needed for an alternate port. You're just adding 
complexity for no real benefit.
> To use authentication on the existing port would require removing those
> filters.  Even if you could track down the right people, they would probably
> drag their feet until most of the sites running old unattended ntpd were fixed.

They don't need to remove filters as much they need to change them. Are 
you saying that the alternate port would not be filtered?

Dragging feet is the norm. The same happened with EDNS0. This is just 
moving the problem without solving it.

>
> An alternative would be to implement BCP 38.  How long has that been in
> progress?
>
We cannot help people who don't implement best practices. We can only 
point them to the documentation.

Danny