859190 – network:time/ntp: DDOS

Bug 859190 - network:time/ntp: DDOS

Summary: network:time/ntp: DDOS

Status:	RESOLVED DUPLICATE of bug 857195

Alias:	None

Product:	openSUSE Tumbleweed
Classification:	openSUSE
Component:	Network (show other bugs)
Version:	13.1 Milestone 4
Hardware:	Other openSUSE 13.1

Priority:	P5 - None Severity: Major (vote)
Target Milestone:	13.2 Milestone 0
Assignee:	E-mail List
QA Contact:	E-mail List

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2014-01-17 11:33 UTC by Dirk Stoecker
Modified:	2014-01-17 13:35 UTC (History)
CC List:	0 users

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
My default ntp configuration from an Hetzner uBuntu server (2.12 KB, text/plain) 2014-01-17 11:35 UTC, Dirk Stoecker	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Dirk Stoecker 2014-01-17 11:33:22 UTC

The current NTP default setup does not differntiate between internal and external access.

The default setup should be modified, so that external access is restricted and admins need to remove restrictions when wanted. Probabably 99% of all NTP installations aren't meant to be worldwide visible, but suse defaults are extremely open.

E.G. Ubuntu has
# By default, exchange time with everybody, but don't allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery

Comment 1 Dirk Stoecker 2014-01-17 11:35:11 UTC

Created attachment 574790 [details]
My default ntp configuration from an Hetzner uBuntu server

Comment 2 Reinhard Max 2014-01-17 13:35:24 UTC

The security team decided that we only need to change this in Factory.

BTW, the Bugzilla product openSUSE.org is about the openSUSE project and its infrastructure. Bugs against openSUSE should be reported against either openSUSE Factory or one of the released versions.

*** This bug has been marked as a duplicate of bug 857195 ***