The Network Time Protocol (NTP) is used to synchronise network time clients to an accurate time reference. It is widely used by computer networks to ensure correct network time. However, many network administrators overlook security issues when implementing NTP. This article attempts to briefly describe the features that can be used to maintain a secure network when implementing the Network Time Protocol.
NTP provides a well-defined protocol for synchronising time critical process to an accurate reference. It utilises UDP (User Datagram Protocol) over IP to transfer time stamp information between servers and clients. However, the fields in each message are unencrypted and easy to read by network listening devices. Therefore, unscrupulous or malicious users can potentially replicate timestamps in order to disrupt network time synchronisation. If not implemented correctly, it can pose a significant security risk.
The protocol does however, provide a means of securing timestamps using authentication to verify the identity of the source. By configuring the protocol correctly and by using the implemented security features, NTP can be made secure from attack by malicious users.
Authentication is a means by which a client can ensure that a timestamp has come from the intended source. By using a set of agreed encrypted passwords, the client can authenticate the source of any received timestamp. Sets of pre-defined security keys are agreed between server and client. These keys are encrypted using MD5 encryption algorithms. When a client receives a timestamp, checking the security key against the previously agreed list of keys can verify the source.
The MD5 encryption (Message Digest Encryption 5) used to encrypt security keys is a 128-bit cryptographic hash function, which outputs a fingerprint of the key. MD5 is a highly secure encryption, widely used on forums and by online communities for authentication purposes. MD5 encryption is used by NTP to ensure the security of the keys passed between the server and client.
Security keys are stored in a keys file, generally named ‘ntp.keys’. The keys are stored line-by-line, with a number of pre-defined fields. The first field ‘Key Number’ is used as a key reference. The second field specifies an encryption type – usually ‘M’ for MD5 encryption. The third and final field is the key itself.
The key file also needs to be specified in the configuration file ‘ntp.conf’ using the ‘keys filename’ option. Also specified is a list of trusted keys that can be used for authentication purposes.
Restricting access to a NTP server can further enhance security. The protocol has a number of access control options that can restrict access to individual clients or a range of clients. Access control options are specified in the configuration file using the ‘restrict’ keyword. Restricting access to known clients can protect a NTP server from unknown or rogue users and also prevent it from getting swamped by unscrupulous users.
It is very easy to implement authentication but it is often overlooked by network administrators, leaving servers vulnerable to attack. Ensure your network is secure and implement NTP authentication before its too late.
no comment untill now