2

FreeBSD port net/ntp was marked forbidden because it is vulnerable to traffic spoofing and amplification attacks, as documented in CVE-2013-5211.

However, there's been no support from the upstream provider, ntp.org.

It would also appear that the developers were aware of the issues as early as 2011-December, and have not sought recourse other than to suggest configuration changes to mitigate the problem: http://lists.ntp.org/pipermail/pool/2011-December/005616.html

Without relying on FreeBSD's 'world' version of ntpd, what other packages are available to replace ntpd?

3
  • I do not understand what is wrong with using the reference implementation and a proper configuration?
    – dfc
    Commented Apr 11, 2014 at 17:47
  • Not secure by default, and such versions where it is fixed are still in 'development'; the last stable release of ntpd was Dec-2011. support.ntp.org/bin/view/Main/SoftwareDownloads
    – antiduh
    Commented Apr 11, 2014 at 19:20
  • With all due respect I have to say that "not secure by default" is BS. 4.2.6p5 can be configured securely or insecurely. You can use the noquery restriction or disable monitor. Vulnerable to traffic spoofing is nonsensical. Plain DNS (not curve/dnssec) is also vulnerable to traffic spoofing. ICMP is vulnerable to traffic spoofing.
    – dfc
    Commented Apr 11, 2014 at 21:21

2 Answers 2

2

Chrony seems to be a drop-in replacement for ntpd that is being actively maintained, and as of this writing, does not appear to have any known, unresolved vulnerabilities.

OpenBSD's OpenNTPD also appears to be actively maintained, however there appears to be some valid criticism (OpenNTPD's docs, Wikipedia) that it may not be as exactly accurate as ISC's NTP was.

2

In addition to the two options you provide in your answer to your question you can also use ntpns from phk@freebsd. However ntpns is targeted towards high performance stratum-1 servers so it may not be what you are looking for.

ntpns download: http://phk.freebsd.dk/NTPns/phkrel/

Personally I think you should use the latest 4.2.7 from the ntp reference implementation. I manage a number of S1 ntpservers that all run 4.2.7 smoothly. and have done so for over two years now (4.2.7p270 was my first 4.2.7 server). If you are unwilling to use 4.2.7 series and do not need the precision offered by phk's ntpns I would suggest using chrony. Miroslav is actively developing chrony and is very responsive to the user community.

ADDENDUM: I do not have a lot of experience with openntpd. My impression is that precision timekeeping takes a back seat for security and simplicity. The timekeeping goal seems to be "good enough for most purposes."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .