Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What are the security considerations to keep in mind when using an NTP server to synchronize time? Wikipedia lists that there are no known high-risk vulnerabilities, but are there any lower risk weak points one should be aware of?

Also, are there any special concerns when using NTP pool servers?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Paper written for GIAC qualification with in depth analysis of NTP security.

An overview of NTP that's a little less verbose.

NTP is therefore vulnerable to security threats, whether from a malicious hacker who wants to alter the timestamp to commit fraud or a DDoS attack (Distributed Denial of Service - normally caused by malicious malware that floods a server with traffic) that blocks server access.

With regards to the pool servers, please remember they're volunteered servers.

From what I've read in the past, unless you have time critical tasks the highest risk is DDOS.

share|improve this answer
    
I would think the DDOS would affect the NTP server itself, not the server synching to the NTP server. –  joeqwerty Dec 4 '09 at 21:52
    
cis.udel.edu/~mills/database/brief/autokey/autokey.ppt Mills is the original author for NTP. In his powerpoint he specifies that - An intruder can generate packets faster than the server, network or client can process them, especially if they require expensive cryptographic computations. –  Darren Hall Dec 4 '09 at 22:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.