Subject: Re: xntpd udp relay

From: [email-masked] (James Seymour)
Date: Wed, 14 Jun 2000 08:15:40 -0400 (EDT)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

In message <[email-masked]>,
Scott McEachern <[email-masked]> wrote:
[snip]
> 
>     Just a quick question here:
>     I'm running xntpd on my firewall box, and my boss wants it off and
> running on an internal machine.
>     As far as I know, xntpd uses udp and the toolkit doesn't relay udp
> at all, ...

Yes.

>     ... thus the xntpd _must_ run on the firewall machine.
>     Is there _any_ way to get around this?

Udprelay, maybe?

> 
>     Actually, while I'm thinking about it, something similar applies to
> nameservers.  ...
[snip]

Assuming that you name serve for your domain as it appears on the 'net,
and assuming that you don't want the DNS for your internal stuff
exposed to the 'net, you need an outside nameserver anyway.  If your
boss is concerned about possible BIND exploits compromising your
firewall, then you need to put it up on a separate "outside" server.
But now you have a quandary.  You don't really want to put it up on an
outside server that's unprotected by the firewall (I wouldn't
think--unless you want to deal with hardening that machine), so you'd
probably want to put it up on a third ("service") port off your
firewall.

Personally, I don't see any problem with running ntp or bind on the
firewall--providing you keep an eye out for exploits and keep 'em
up-to-date.

Regards,
Jim
-- 
Jim Seymour                         | Medar, Inc.
[email-masked]                  | 24775 Crestview Ct.
Systems & Network Administrator     | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897

---

From: dreamwvr <[email-masked]>
Date: Wed, 14 Jun 2000 12:00:41 -0600

Hi,
   well here is another read on it. if you are lucky enough to use gps clock
well your most likely not allowing udp port 123 anyhow. But lets justs say you
need to hit 3 stratum 2 timeservers out there. Well another approach is to 
allow only stateful connections est from   the inside to the 3 timeservers that 
you keep time with.. Then make certain that those time servers are allowed to 
tell you the time for your client but that's it using the nomodify in your 
ntp.conf file. That way even if they are spoofed the time servers can't 
modify can only give time. Plus when i scoured all the advisories from 
beginning to end i did not see any on ntp hacks. That is not saying they do 
not exist just that non are recorded. most likely they make your time screwed 
up which is why you have redundant ones so that 'insane' values are rejected.
which means if all 3 are screwed well your screwed.. which is why insane values 
are rejected.. you can widen your stratum 2 volume of servers for more
redundancy but do not gain any more really. There is a way to dailup as well
to NIS to get the time which as well might be a better idea. 
 Last but certainly not least consider udp-relay or equivalent but
your most  likely on your own on that one as have yet to come across a good faq
on  that issue. Anyone using it successfully? they would be on FWTK if anywhere
i would say. 
					Best Regards,
					[email-masked]
  Reuters, London, February 29, 1998:
Scientists have announced discovering a meteorite which will strike the
earth in March, 2028.  Millions of UNIX coders expressed relief for being
spared the UNIX epoch "crisis" of 2038. 
_______________________________________________________________________
 
************** DREAMWVR.COM - TOTAL INTERNET SERVICES ****************
  TOTAL DESIGN - DEVELOPMENT - INTEGRATION - SECURITY - Click Here..
           <http://www.dreamwvr.com/services/MAX_SEC.html>;
   DREAMWVR.COM - The Console of Many... 90 Topics Covered
<http://www.dreamwvr.com/dynamicduo.html>;
<mailto:[email-masked]>;
->> LINUX-MANDRAKE Solution Provider and North American Distributor<<-
                        PRODUCT OF THE YEAR!
<http://www.dreamwvr.com/mandrake/mandrake-main.html>;
 "===0 PGP Key Available
*************** "As Unique as the Company You Keep."*****************
    "If anyone speaks from DREAMWVR.COM its certainly not me:-)"
________________________________________________________________________