Re: [Ntp] [tsvwg] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Miroslav Lichvar <[e-mail]>]

On Tue, Dec 07, 2021 at 10:23:10AM +0100, Martin Burnicki wrote:
> I find it ridiculous to start using a new port for NTP because some admins
> block the original, well-known port because many years ago there was a
> possibility for DDoS for servers that weren't properly configured.

That possibility still exists. It's a security issue in the protocol.
The modes 6 and 7, and Autokey cannot be fixed without breaking
compatibility. They cannot be exposed to Internet. On my public
servers I still see scans looking for the amplification commands. If
everyone suddenly stopped blocking NTP, I think we would see an
explosion in the amplification attacks.

It is not just some admin in a random company deciding to block NTP.
It's major ISPs with millions of customers and huge transit networks
in the Internet. We cannot expect them to be asking individual owners
of misconfigured servers to fix their stuff and keep watching them
indefinitely.

I assume your products don't support NTS yet? I think you would have
have a different view on the subject with customers complaining it
doesn't work reliably.

> What if that would be done for any service for which there was a security
> problem in the past? Would a new port e.g. for DNS be proposed just because
> some DNS servers that weren't properly configured could be misused?

Well, DNS has this issue too. It allows traffic amplification and it's
a big issue that requires a lot of resources to keep it running.

But unlike DNS, NTP cannot fall back to TCP. Fortunately, NTP as a
time synchronization protocol exchanging constant amount of data does
not need any amplification. It can be easily restricted to a
non-amplifying subset.

-- 
Miroslav Lichvar