Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Time Is Running Out for NTP

infoworld.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Time Is Running Out for NTP

#21

Post by ploxiln »

hga wrote: post #7

Classic NTP is hardly the only game in town. For example, see the NTPsec work in progress: https://www.ntpsec.org/ which I'll probably transition to someday, maybe even get an el-cheapo GPS receiver now that I'm not effectively living in a basement. And I've personally be using chrony for a while, although my needs are significantly less than whatever level of accuracy it provides. There are some other clients out th…

Hmm does ntpsec only test their website with Chrome? Firefox says "Secure Connection Failed ... The OCSP server suggests trying again later." I guess that's one of the reasons Chrome TLS devs say online (looked-up on-demand) certificate revocation is useless.

Re: Time Is Running Out for NTP

#22

Post by lgas »

throwbsidbdk wrote: post #19
hga wrote: post #7

Classic NTP is hardly the only game in town. For example, see the NTPsec work in progress: https://www.ntpsec.org/ which I'll probably transition to someday, maybe even get an el-cheapo GPS receiver now that I'm not effectively living in a basement. And I've personally be using chrony for a while, although my needs are significantly less than whatever level of accuracy it provides. There are some other clients out th…

My biggest issue with NTP is little control over who runs the servers. Unlike the CA system that has checks in place against bad actors, practically anyone can run an NTP pool. It was discovered a while ago for example that some part of the Linux default NTP servers are run by shodan. So when your machine gets the time it lets shodan know you've got a server running so they can port scan you. It would be stupid not t…

NTP is more analogous to an SMTP server, HTTP server or any of the other myriad servers anyone can run on the internet with absolutely no vetting. The CA system is something different entirely. If you're confident that an NTP server is safe, don't use it. The same you would do with a potentially malicious website.

Re: Time Is Running Out for NTP

#23

Post by PhantomGremlin »

notaplumber wrote: post #6
kijeda wrote: post #4

I thought NTP was a protocol, not a piece of software. Is the article conflating them, or is there only one single implementation of it that everyone relies upon?

There's OpenNTPD which is maintained by the OpenBSD/OpenSSH developers. It has been poorly criticized for its focus on security rather than absolute precision, but it's more than adequate for most peoples timekeeping needs. http://www.openntpd.org/ It has privilege separation, sandboxing and if your OS/distribution uses LibreSSL it implements HTTPS constraints. http://man.openbsd.org/ntpd.conf.5 http://man.openbsd.or…

it's more than adequate for most peoples timekeeping needs

Yes it is. I'm on a cable modem and currently using OpenNTPD to talk to 5 NTP servers. My largest offset is currently 3.6 milliseconds. That's fine for general purpose computing. Anyone who needs better should probably buy some NTP or PTP hardware for his LAN.

Re: Time Is Running Out for NTP

#24

Post by jevinskie »

toomuchtodo wrote: post #16
privong wrote: post #15

Earlier quoted context omitted.

> IMHO, too much of NTP relies on GPS, but that's a separate matter. I'm curious to know more. Can you please elaborate or point to some articles discussing this?

https://ntpserver.wordpress.com/2008/09/10/ntp-server-stratu... http://www.ntp.org/ntpfaq/NTP-s-refclk.htm TL;DR Most NTP networks are relying on GPS versus a high precision on-site time keeping device. Break GPS, and you break timekeeping for a wide swath of the worldwide NTP pool. But thems the breaks when you can get access to atomic clocks in space (each GPS satellite carries an atomic clock on board) just by sti…

If anyone is wondering: yes, you can own your very own atomic clock for a "reasonable" price! I encourage everyone to read [0] where a father takes his kids and a few atomic clocks up a mountain and back down. By looking at the clock drift due to changes in gravity, he was able to observe relativity!

[0]: http://leapsecond.com/great2005/

Re: Time Is Running Out for NTP

#25

Post by tatersolid »

jerdfelt wrote: post #18
kijeda wrote: post #4

I thought NTP was a protocol, not a piece of software. Is the article conflating them, or is there only one single implementation of it that everyone relies upon?

There is NTP the protocol[1], and there is NTP the implementation[2]. While the implementation is popular, there are alternatives. There is also OpenNTPd, chrony and ntimed for instance. There are also alternatives to the NTP protocol too, such as PTP and SNTP. [1] https://www.ietf.org/rfc/rfc5905.txt [2] http://www.ntp.org/

Don't forget the billion-plus machines out there running Windows Time Service (which strangely has had zero security issues I can remember, even when running in server mode).

Re: Time Is Running Out for NTP

#26

Post by frio »

toomuchtodo wrote: post #16
privong wrote: post #15

Earlier quoted context omitted.

> IMHO, too much of NTP relies on GPS, but that's a separate matter. I'm curious to know more. Can you please elaborate or point to some articles discussing this?

https://ntpserver.wordpress.com/2008/09/10/ntp-server-stratu... http://www.ntp.org/ntpfaq/NTP-s-refclk.htm TL;DR Most NTP networks are relying on GPS versus a high precision on-site time keeping device. Break GPS, and you break timekeeping for a wide swath of the worldwide NTP pool. But thems the breaks when you can get access to atomic clocks in space (each GPS satellite carries an atomic clock on board) just by sti…

There was an interesting presentation at Kiwicon (a New Zealand security conference) the other day; someone demonstrated mimicing a GPS radio to trigger NTP drift in servers. The upshot was that it wasn't difficult, and gave you an avenue to replaying TOTP/2fa tokens...

Re: Time Is Running Out for NTP

#27

Post by throwaway4891a »

privong wrote: post #15
mmagin wrote: post #5

Article doesn't bother to mention that there are completely different projects which implement NTP servers with varying levels of functionality (openntpd, chrony, ntpsec, ntimed). And while the pool.ntp.org system is a nice scheme, it's hardly a global necessity. You can fairly easily get a stratum 1 server going on your own infrastructure. IMHO, too much of NTP relies on GPS, but that's a separate matter.

> IMHO, too much of NTP relies on GPS, but that's a separate matter. I'm curious to know more. Can you please elaborate or point to some articles discussing this?

A side-effect of a 4+ satellite fix is both extremely accurate and extremely precise computation of current time (in addition to location). (GPS sats broadcast time, receivers triangulate.) Some high-quality receivers (Trimble, probably others) attempt to count the number of pseudowavelengths back to the satellite, including relativistic, gravimetric and atmospheric effects. http://www.trimble.com/gps_tutorial/sub_phases.aspx

Re: Time Is Running Out for NTP

#28

Post by privong »

throwaway4891a wrote: post #27
privong wrote: post #15

Earlier quoted context omitted.

> IMHO, too much of NTP relies on GPS, but that's a separate matter. I'm curious to know more. Can you please elaborate or point to some articles discussing this?

A side-effect of a 4+ satellite fix is both extremely accurate and extremely precise computation of current time (in addition to location). (GPS sats broadcast time, receivers triangulate.) Some high-quality receivers (Trimble, probably others) attempt to count the number of pseudowavelengths back to the satellite, including relativistic, gravimetric and atmospheric effects. http://www.trimble.com/gps_tutorial/sub_ph…

Thanks, but I was asking why heavy use of GPS in NTP pools was a bad thing, rather than how GPS can be used to determine a reference time (I'm aware of the use of GPS as a stratum 0 clock).

Re: Time Is Running Out for NTP

#29

Post by JdeBP »

jerdfelt wrote: post #18
kijeda wrote: post #4

I thought NTP was a protocol, not a piece of software. Is the article conflating them, or is there only one single implementation of it that everyone relies upon?

There is NTP the protocol[1], and there is NTP the implementation[2]. While the implementation is popular, there are alternatives. There is also OpenNTPd, chrony and ntimed for instance. There are also alternatives to the NTP protocol too, such as PTP and SNTP. [1] https://www.ietf.org/rfc/rfc5905.txt [2] http://www.ntp.org/

... and TAICLOCK.

* http://cr.yp.to/proto/taiclock.txt

Re: Time Is Running Out for NTP

#30

Post by JdeBP »

tatersolid wrote: post #25
jerdfelt wrote: post #18

Earlier quoted context omitted.

There is NTP the protocol[1], and there is NTP the implementation[2]. While the implementation is popular, there are alternatives. There is also OpenNTPd, chrony and ntimed for instance. There are also alternatives to the NTP protocol too, such as PTP and SNTP. [1] https://www.ietf.org/rfc/rfc5905.txt [2] http://www.ntp.org/

Don't forget the billion-plus machines out there running Windows Time Service (which strangely has had zero security issues I can remember, even when running in server mode).

W32Time has different kinds of issues, in my experience. With it, one's problems tend to be that, by design until very recently, it doesn't provide to-the-second accuracy.

* https://blogs.technet.microsoft.com/askds/2007/10/23/high-ac...

* https://greyware.com/software/domaintime/v5/overview/w32time...

* https://technet.microsoft.com/en-gb/windows-server-docs/iden...

Post reply on HN