Subject: RE: xntpd udp relay

From: Sean Brown <[email-masked]>
Date: Wed, 14 Jun 2000 12:00:47 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Scott,

ntpd can be configured to use certificate authentication between the client
and server similar to SSH, kerberos, or SSL.  However, I prefer to use
packet filtering to selectively allow traffic from my time sources on port
123.  Using ipchains, I create a new chain containing rules for the
timesources I use (there are three).  I then forward all traffic going to
port 123 to this rule.  Anything not from those timesources gets dumped.

My firewall acts as the main time server for my network.  I have other
systems get their time from the firewall and then act as lower tier time
servers for the workstations.

Since I use public time sources, I have not taken the time to configure
certificate authentication.  However, a more secure option would probably
use both packet filtering and the builtin authentication of ntpd.

Sean Brown

> -----Original Message-----
> From: Ted Keller [mailto:[email-masked]]
> Sent: Wednesday, June 14, 2000 9:16 AM
> To: Scott McEachern
> Cc: [email-masked]
> Subject: Re: xntpd udp relay
> 
> 
> [To be removed from this list send the message "unsubscribe 
> fwtk-users" in the
> BODY of a mail message to [email-masked].]
> 
> Scott,
> 
> ntpd uses both tcp and udp.  So you are right - with the firewall by
> itself, you can't pass these packets through to an internal server.
> 
> However, you may want to ask yourself a couple of questions....
> 1. why am I running it?
> 
> 2. where do I get my time source from?
> 
> As for the first question, ntpd runs in two modes - that as a 
> client (I go
> and get the time and set my clock functions accordingly) and 
> as a server
> (I will tell someone else the time if they ask for it).
> 
> If accurate time on the firewall is important to you, then 
> you have to run
> at least the client on the firewall machine - otherwise the firewall
> machine's clock will drift.  If I use the Internet as the 
> time source and
> want to sync my internal network, then the firewall will also 
> have to be a
> server in addition.  Now, with the ntp.conf file, you can at 
> least specify
> who can ask you for time.
> 
> On the second question, where do I get my time from?  
> Consider acquiring
> an internal time source (GPS system or equivalent).  They are 
> relatively
> inexpensive and help solve the problem of trusting internet 
> sources for
> this function. Also, it helps solve the issue of passing these type of
> packets across your firewall.  Your internal network can use 
> the trusted
> time source.  Your firewall, if you desire, can also point to 
> that source.
> Everything can operate in "client mode".
> 
> ted keller
>  
>

---

From: Raymond Lee <[email-masked]>
Date: Thu, 15 Jun 2000 09:31:37 +0800

Hi all,

I'm a new subscriber to the list.  The reason for my joining it is because I just
got started in the role of Internet Security and there are numerous security
issues out there that I need to pick up and learned in a very limited period of
time, say 6 months or less. I've read up numerous article and books as well as
visited internet security sites and got myself even more confused.

Before I go on, I should outline my background on the Internet security - limited
hands on experience in CISCO Router configm, a tad of experience in CheckPoint
Firewall and ISS RealSecure stuff.  As for Linux, my experience so far is ----- 1
week.

Just wondering if I want to get up to speed in the shortest period of time, do I
need to get myself setup like the rest of most people i.e. have the entire LAN,
WAN and servers installed at home?

I will keep reading up the good stuff that's been trading back and forth.

Any suggestion/advise will be very much appreciated.

Thanks.

Ray