Re: [Ntp] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

["[e-mail]" <[e-mail]>]

HI, Hal,

Again, with ports team review hat on:

Everything that happened below is equivalent to finding a zero-day or other kind of protocol error in any service.

The fact that the current ’solution’ is to block that port isn’t new either.

We don’t have resources to continually assign ‘fresh’ ports for services and I see no reason this one warrants an exception.

There are other solutions here; if your own recommendations caused packets smaller than 48 to be dropped, then find a way to fragment and reassemble authenticated packets until you find out that larger ones get through.

This is a protocol design problem, not a port assignment problem.

Joe

—
Joe Touch, temporal epistemologist
www.strayalpha.com

> On Dec 4, 2021, at 3:12 PM, Hal Murray <[e-mail]> wrote:
> 
> 
> [e-mail] said:
>> FWIW, I don't see this assignment as appropriate. 
> 
> Without a new port, it will be close to impossible to widely deploy NTP 
> security.
> 
> 
> Years ago (2013), NTP was used in a giant DDoS attack.  That was due to a 
> bug/oversight that had been around since the early NTP work.  (I've tracked it 
> back to 1989.)
>  https://www.spamhaus.org/news/article/695/answers-about-recent-ddos
>  https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification
> The Wikipedia chart could use another column -- the number of sites available. 
> Almost all Linux or *BSD sites were running ntpd.
> 
> The fix was trivial, but there are many essentially unattended sites running 
> old versions of ntpd that will never get fixed.
> 
> Many many many sites have quietly installed filters in their routers.  Set and 
> forget.
> 
> A typical filter drops UDP traffic to port 123 with a length other than 48.  
> That lets old unauthenticated NTP through but authenticated packets are longer 
> and get dropped.
> 
> To use authentication on the existing port would require removing those 
> filters.  Even if you could track down the right people, they would probably 
> drag their feet until most of the sites running old unattended ntpd were fixed.
> 
> An alternative would be to implement BCP 38.  How long has that been in 
> progress?
> 
> -- 
> These are my opinions.  I hate spam.
> 
> 
>