0

Would running an NTP daemon on my personal computer provide extra security? I'm asking because a tool was telling me to get a NTP daemon for security reasons. However afaik that tool is mostly tailored for servers and now I'm wondering if that recommendation also goes for PCs / clients.
If it would provide some extra security please also shortly elaborate why.
I'm running Debian 9.1 with KDE.

1
  • 1
    I would name the tool – sourcejedi Aug 20 '17 at 20:09
1

NTP is the Network Time Protocol.

The NTP daemon does nothing more than keeping your computer clock synchronized with lower stratum time servers (for Debian, they're *.debian.pool.ntp.org per default). It is recommended to have it running on your machine, but it doesn't do anything security-related.

To install it, run

apt-get install ntp
1
  • 6
    There is a security aspect to NTP, but it’s a bit more complex than just running a daemon locally. (You want to avoid time poisoning in some contexts.) – Stephen Kitt Aug 18 '17 at 11:36
1

I recommend keeping an accurate clock, as it's likely displayed on-screen in your GUI. I've often been confused if that shows the wrong time :). Most systems use some form of NTP for this. But if you want to reduce attack surface, and just run ntpdate manually the one time, that's not a bad decision either IMO.

There is a security aspect, but on a personal computer this is very tangential. Reasoning:

There are two security benefits of accurate clocks.

  1. Well-synchronized logging information is said to be useful in responding to security incidents. This is not relevant for an individual PC.
  2. If the date is too far out of range, security mechanisms for expiring specifically expired SSL certificates will not work correctly.

We would not expect the clock to drift enough to cause date mismatches while the system is running. However, the clock could go wrong for other reasons. For example the RTC battery could run out.

For this situation, nptd is (for example, in the Debian init script defaults) launched with the -g option. It will set the clock from the internet time servers no matter how far out of date it was.

It's unlikely that at the same time you would be subject to an attack replaying old, expired SSL certificates. The attacker would be taking a big bet that your clock was also out of date. It's much more likely that a bad clock would cause false positive errors rather than false negatives. The bigger security issue is that the user might be confused by the SSL expiry errors, into "clicking though" a real SSL error.

However I don't believe this is very practical as an attack.

"Availability" is also a security property, but this refers to some active attack which causes Denial of Service. If you lose accurate time service due to a hardware failure or user error, this is not a security failure in itself.

The second reason this is tangential, is that NTP is not secured in the same sense that SSL (https://) or apt-get is secured. A hostile network could attempt to detect ntpd -g and provide false time anyway.

0

There are two NTP related concepts. The first is NTP client and the second - NTP server.

NTP server provides correct time for NTP clients via 123 port and because of this it can become a victim of DDOS attacks. There are some statistics that many NTP servers use very old versions of NTP daemons (about a quarter and more). Attackers can exploit the vulnerabilities that were discovered in outdated versions of the NTP daemon.

But this is not your problem because you need NTP client, which only sinchronize local time with public NTP servers. You need to choose trusted servers (e.g. http://www.pool.ntp.org/ru/) and configure correctly you daemon.

0

Every recommendation could be applied to PCs and clients, but you need to have some backgroud about them... as dr01 said, this particular service could avoid some time poisoning, You can see and example here about time poisoning...

Some useful recommendations could be:

Always run services in trusted networks

This means that if you need or want to run a service, you need to ensure that this service is going to be kept inside your network... you'll need a good firewall behind your router to keep that secure.

Run the service if you really need it

This is quite simple, if you need the service, run it, but if you don't, avoid it. The more services you run, the more vectors that you leave to an attacker to try to hack you.

Don't run services as root besides those that are necessary

This is obvious, but always good to remember... avoid to run unneeded services as root, if any of those is compromised, then the whole machine is compromised.

My community has a quite good guide about securing services if you need to search more detailed info about any other service that you may be running now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.