Home / server / Questions / 199255
Accepted
Harry
Asked: 2010-11-08 21:48:10 +0800 CST

Securing NTP: which method to use?

  • 772

Can someone good at NTP configuration please share which method is the best/easiest to implement a secure, tamper-proof version of NTP? Here are some difficulties...

  1. I don't have the luxury of having my own stratum 0 time source, so must rely on external time servers.

  2. Should I read up on the AutoKey method or should I try to go the MD5 route?

  3. Based on what I know about symmetric cryptography, it seems that the MD5 method relies on a pre-agreed set of keys (symmetric cryptography) between the client and the server, and, so, is prone to man-in-the-middle attack.

  4. AutoKey, on the other hand, does not appear to work behind a NAT or a masquerading host. Is this still true, by the way? (This reference link is dated 2004, so I'm not sure what is the state of art today.)

    4.1 Are public AutoKey-talking time servers available?

  5. I browsed through the NTP book by David Mills. The book looks excellent in a way (coming from the NTP creator after all), but the information therein is also overwhelming. I just need to first configure a secure version of NTP and then may be later worry about its architectural and engineering underpinnings.

Can someone please wade me through these drowning NTP waters? Don't necessarily need a working config from you, just info on which NTP mode/config to try and may be also a public time server that supports that mode/config.

Many thanks,

/HS

security ntp md5

1 Answers

  1. Best Answer

    The final answer is here.

    Thanks actually to David Mills and Danny Mayer for answering the question.

    To summarize:

    Symmetric key cryptography works fine behind a NAT box. See the Authentication Support page in the official NTP documentation on ntp.org. As I said, the intended Autokey model is for the server and client to live on the Internet side of the NAT box and have it serve time to the internal network via a separate interface.

    Also,

    Here's Dr. Mills' PowerPoint slides describing the NTP Security Model:

    http://www.ece.udel.edu/~mills/database/brief/autokey/autokey.ppt

    • 3