4 ms·
Yes. And that's exactly what's been implemented in modern versions of ntpd (> 4.2.7p26, 2010/04/24... yes, 2010). The problem is: 1) No one has upgraded NTPD
by devicenull 13y ago
Yes. And that's exactly what's been implemented in modern versions of ntpd (> 4.2.7p26, 2010/04/24... yes, 2010).
The problem is:
1) No one has upgraded NTPD (and often can't, for embedded devices like IPMI controllers)
2) This can be fixed by basic configuration in older NTPD versions, but up until recently many linux distributions were shipping vulnerable configs.
This particular command (monlist) is a management query, it's in no way related to serving up accurate time.
- michaelmior 13y agoAs far as I can tell, the default Ubuntu ntpd config still allows monlist. (That is, /etc/ntp.conf in saucy doesn't have disable monitor.)
- deleted 13y ago[deleted]
- dfc 13y agoWhat are the default restrictions? Is noquery enabled?
- devicenull 13y agodisable monitor is not really the best way to fix this. You're better off adding 'noquery' to the end of the 'restrict default' lines.
- michaelmior 13y agoThanks for clarifying. I'm not familiar with ntpd configuration as it's something I usually just install and forget about.
- makomk 13y agoThe Debian default config has noquery set for everywhere but localhost which is I believe safer (disables all ntpdc queries not just the one used here). Ubuntu's likely the same.
- michaelmior 13y agoThe default Ubuntu config has the following restrict -4 default kod notrap nomodify nopeer noquery restrict -6 default kod notrap nomodify nopeer noquery Edit: Note that this also exists in Ubuntu 12.04, so the latest LTS is fine as well.
- michaelmior 13y agoYes, noquery is enabled (at least in saucy). It isn't however in precise, which is the current LTS. I'm unclear of the difference between noquery and disable monitor.