At 09:56 PM 3/17/2014, Ronald F. Guilmette wrote:
(It was explained to me at the time that NTP operates a bit like DNS...
with which I am more familiar... i.e. that all outbound requests originate
on high numbered ports, well and truly away from all low numbered ports,
including, in particular, 123. I am just re-verifying that my understanding
in this regard is correct, and that my current blanket firewall rule is
fine as it stands.)
Different implementations do different things in this regard. Alas, newer
versions of ntpd seem to use UDP port 123 as the originating port when
synchronizing with outside servers while older versions did it right and
used high, ephemeral ports. This means that stateful firewalling is
required for security, and even with it spoofing is still possible if the
attacker can guess which servers you query. (The ones in the default FreeBSD
ntp.conf file are likely to work most of the time.)
We should definitely patch the ntpd that's shipped with FreeBSD to issue
queries on randomly chosen ephemeral ports, as well as changing the default
ntp.conf file to prevent relaying. As we've seen with DNS, UDP-based services
are so ripe for attacks (due to the lack of a 3-way handshake) that they need
to be protected in every way possible.
--Brett Glass
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscr...@freebsd.org"
