[Bug 1039420] [NEW] NTP security vulnerability because not using authentication by default

2012-08-21 Thread Alba Nader
*** This bug is a security vulnerability *** Public security bug reported: Ubuntu implements so much security one way or another. So much defenses against network level man in the middle or malicious proxies or wifi hotspots. Cryptographic verification generally works well but there is one big dr

[Bug 1039420] Re: NTP security vulnerability because not using authentication by default

2012-08-21 Thread Alba Nader
No need to keep this private. Has been publicly discussed but without proper bug report and the discussion felt into oblivion. http://ubuntu.5.n6.nabble.com/authenticated-NTP-td4486136.html -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

[Bug 1039420] Re: NTP security vulnerability because not using authentication by default

2012-09-02 Thread Alba Nader
I have some ideas ideas... There is already ntp.ubuntu.com, can you add authentication? Ubuntu has importance. Can you officially ask the NTP pool if they could add authentication? Can you publicly the problem somewhere? A blog post? I am sure some NTP server volunteers would like to add authen

[Bug 1039420] Re: NTP security vulnerability because not using authentication by default

2012-09-04 Thread Alba Nader
NTP has public and private keys. http://doc.ntp.org/4.1.0/genkeys.htm Just like SSL, gpg, etc. Of course ntp.ubuntu.com and other server owners keep their private key secure. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to ntp in Ubunt