Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a number of openSUSE VMs (mostly 13.1). One of the VMs is configured to sync its time with the outside world, the other ones sync with this one. This has never caused problems (I am aware of).

Now I noticed that ntpd on the outside-connected VM causes about 9% CPU load (permanently!) and makes connections to 15+ hosts causing outbound traffic of about 100K/s and inbound traffic at a little lower level (all from/to my UDP port 123) – which even continues (now for several minutes) after I have stopped ntpd and there is no such outbound traffic any more.

I had configured ntpd to the pool address de.pool.ntp.org but that does not make a difference.

I made a distro upgrade (booting from DVD) and afterwards even reinstalled ntp without any change.

Edit: problem "solved"

After I have blocked incoming UDP 123 completely ntpd acts normally. I still don't understand what may have caused this. It should not be possible to connect to this VM port from the outside. There is no port forwarding in the VDSL router.

But: A few minutes ago I sent a UDP packet to port 123 from the Internet and (whyever) the VDSL router passed it to the VM. If I repeat that now then the packet does not reach the VM any more. Maybe that was a strange NAT side effect of the many UDP 123 connections.

I am going to block this traffic except for the intended servers.

share|improve this question
    
What are the hosts in question? –  Faheem Mitha Apr 19 at 16:42
1  
This was in the news recently: blog.cloudflare.com/…. The largest attack ever recorded was achieved using NTPD as an amplification attack. –  slm Apr 19 at 18:25
1  
It's possible that external access was allowed via UPnP rather than an explicit port forward. Unlikely, though. –  Bob Apr 20 at 4:23

1 Answer 1

up vote 12 down vote accepted

If you have NTP Reflection enabled your NTP servers might be used as a part of DDoS. To make sure NTP reflection is disabled, add this to your ntp.conf:

disable monitor

Then restart all ntp services.

More info on NTP based DDoS: http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks

share|improve this answer
    
See the edit to my question. I am a bit confused because this system should not have been reachable on this port from the outside. –  Hauke Laging Apr 19 at 17:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.