Thi article explains the importance of using an authenticated timing reference when using a NTP time server (Network Time Protocol)
NTP
(Network Time Protocol) synchronises networks to a single time source using
timestamps to represent the current time of the day, this is essential for time
sensitive transactions and many system applications such as email.
NTP is
therefore vulnerable to security threats, whether from a malicious hacker who
wants to alter the timestamp to commit fraud or a DDoS attack (Distributed
Denial of Service - normally caused by malicious malware that floods a server
with traffic) that blocks server access.
However,
being one of the Internet’s oldest protocols and having been developed for over
25 years, NTP is equipped with its own security measures in the form of
authentication.
Authentication
verifies that each timestamp has come from the intended time reference by
analysing a set of agreed encryption keys that are sent along with the time
information. NTP, using Message Digest encryption (MD5) to un-encrypt the key,
analyses it and confirms whether it has come from the trusted time source by
verifying it against a set of trusted keys.
Trusted
authentication keys are listed in the NTP server configuration file (ntp.conf)
and are normally stored in the ntp.keys file. The key file is normally very
large but trusted keys tell the NTP server which set of subset of keys is
currently active and which are not. Different subsets can be activated without
editing the ntp.keys file using the trusted-keys config command.
Authentication
is therefore highly important in protecting a NTP server from malicious attack;
however there are many time references were authentication can’t be trusted.
Microsoft,
who has installed a version of NTP in their operating systems since Windows
2000, strongly recommends that a hardware source is used as a timing reference
as Internet sources can’t be authenticated.
NTP is
vital in keeping networks synchronised but equally important is keeping systems
secure. Whilst network administrators spend thousands in anti-viral/malware
software many fail to spot the vulnerability in their time servers.
Many network
administrators still entrust Internet sources for their time reference. Whilst
many do provide a good source for UTC time (Coordinated Universal Time - the
international standard of time), such as nist.gov, the lack of authentication
means the network is open to abuse.
Other
sources of UTC time are more secure and can be utilized with relatively low
cost equipment. The easiest method is to use a specialist , these radio transmissions are vulnerable to interference and have
a finite range.
Authentication
for NTP has been developed to prevent malicious tampering with system
synchronisation just as firewalls have been developed to protect networks from
attack but as with any system of security it only works if it is utilised.
About the author
Richard N Williams is a technical author and a
specialist in the telecommunications and network time synchronisation industry
helping to develop dedicated time server products. Please visit us for
more information about a GPS time server or other NTP
products.
Tags: authentication keys, ddos attack, denial of service, hardware source, internet sources, malicious attack, malicious hacker, message digest, network time protocol, ntp keys, ntp server, own security, security measures, sensitive transactions, system applications, time reference, time references, time source, timing reference