Sun Storage 7000 Unified Storage: How to resolve 'NTP' security spoofing

Asset ID:	1-71-1617152.1
Update Date:	2018-05-25
Keywords:

Solution Type Technical Instruction Sure

Solution 1617152.1 : Sun Storage 7000 Unified Storage: How to resolve 'NTP' security spoofing

Applies to:

Sun Storage 7410 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Oracle ZFS Storage ZS3-2 - Version All Versions to All Versions [Release All Releases]
Sun Storage 7210 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Oracle ZFS Storage ZS3-4 - Version All Versions to All Versions [Release All Releases]
Sun ZFS Storage 7120 - Version All Versions to All Versions [Release All Releases]
7000 Appliance OS (Fishworks)

Goal

The NTP client has a vulnerability to NTP spoofing.

Solution

This is a NTP server side issue - NTP clients within the subnet should be setup with Auth Keys to the NTP server.

The NTP server (public-facing IP address) set the “noquery” directive to avoid spoofing the NTP IP address.

How to disable monlist

Disable “monlist” within the NTP server

To disable “monlist” functionality on a public-facing NTP server that cannot be updated to 4.2.7, add the “noquery” directive to the “restrict default” line in the system’s ntp.conf, as shown below:

Start the NTP daemon with noquery enabled in the NTP conf file.

Solaris /etc/inet/ntp.conf

# for IPv4
restrict default limited kod nomodify notrap nopeer noquery
# for IPv6
restrict -6 default limited kod nomodify notrap nopeer noquery
# for internal status (loopback)
restrict 127.0.0.1

NOTE: While possible, specifying the password on ntpdc's command line like ntpdc -c "keyid 1" -c "passwd pw" -c "other_command" is NOT recommended.

How to Confirm an Authorization Key

/usr/sbin/ntpdc [ntp server]
ntpdc> version
ntpdc 4.2.5p200@1.1948-o Thu Mar 29 13:59:28 PDT 2012 (1)
ntpdc>

ntpdc> monlist
***Server doesn't implement this request

ntpdc> keyid
no keyid defined

After configuring the NAS NTP Authentication Keys
ntpdc> keyid
keyid is 1

How to Setup an Authorization Key

To associate authentication keys with servers via the CLI, the serverkeys property should be set to a list of values in which each value is a key to be associated with the corresponding server in the servers property.

If a server does not use authentication, the corresponding server key should be set to 0.

For example, to use the key created to authenticate the server "carp":

CLI:> configuration services ntp
CLI:configuration services ntp> set servers=carp
servers = carp (uncommitted)
CLI:configuration services ntp> set serverkeys=1
serverkeys = 1 (uncommitted)
CLI:configuration services ntp> commit
CLI:configuration services ntp>

MD5 A 1-to-8 character ASCII string, using the MD5 authentication scheme. md5secret

CLI:configuration services ntp authkey> create
CLI:configuration services ntp authkey-000 (uncommitted)> get
  keyno = (unset)
  type = (unset)
  key = (unset)
CLI:configuration services ntp authkey-000 (uncommitted)> set keyno=1
  keyno = 1 (uncommitted)
CLI:configuration services ntp authkey-000 (uncommitted)> set type=M
  type = M (uncommitted)
CLI:configuration services ntp authkey-000 (uncommitted)> set key=md5secret
  key = ******** (uncommitted)
CLI:configuration services ntp authkey-000 (uncommitted)> commit
CLI:configuration services ntp authkey>

Confirm on the NAS that NTP is configured with a authkey

CLI:configuration services ntp> ls
Properties:
   = offline
  date = 2014-1-24
  time = 23:53:29
  use_multicast = false
  multicastaddr = 224.0.1.1
  servers = carp
  serverkeys = 1

Children:
  authkey => NTP Authentication Keys
CLI:configuration services ntp>
CLI:configuration services ntp> authkey
CLI:configuration services ntp authkey> ls
Properties:

Authkeys:
  authkey-000

CLI:configuration services ntp authkey>
CLI:configuration services ntp authkey> select authkey-000
CLI:configuration services ntp authkey-000> ls
Properties:
  keyno = 1
  type = M
  key = *********

CLI:configuration services ntp authkey-000>

Examples of Auth Keys

Type	Description	Example
DES	A 64 bit hexadecimal number in DES format	0101010101010101
NTP	A 64 bit hexadecimal number in NTP format	8080808080808080
ASCII	A 1-to-8 character ASCII string	coconuts
MD5	A 1-to-8 character ASCII string, using the MD5 authentication scheme.	md5secret

After the keys have been specified, an NTP server can be associated with a particular private key.

For a given key, all of the key number, key type and private key values must match between client and server for an NTP server to be authenticated.

BUI_NTP

References

The 'HELP' in the NAS Brower User Interface (BUI) can help with setting up NTP keys
https:// hostname :215/#configuration/services=ntp
https:// hostname :215/wiki/index.php/Configuration:Services:NTP
NTP Attacks CVE-2013-5211 - http://www.us-cert.gov/ncas/alerts/TA14-013A

Sun Storage 7000 Unified Storage System: Configuring the ZFSSA for Active Directory (Doc ID 1402154.1)
Configuration / Services / NTP

Server Settings: If NTP is configured on the network, enter the server IP and authorization keys if applicable. See MSKB Document #816042 (http://support.microsoft.com/kb/816042) for details on how to configure NTP on a Windows Server. Active Directory will not tolerate a time difference of more than five minutes (by default). It is strongly recommended that NTP is used to keep the server time of the ZFSSA synchronized with the AD servers.

Clock: If NTP is not available, determine the current time of the Domain Controller(s), and manually set the time of the system being used for administration to this time. Click the "sync" button in the BUI to set the server time to match the administration workstation time. Note that this is a one-time setting, and if either the ZFSSA clock or the Domain Controller clocks drift out of sync Active Directory connectivity may be lost.

Sun Storage 7000 Unified Storage System: How to sync to an NTP Server that is behind (in time) the NAS Appliance (Doc ID 1561520.1)

***Checked for relevance on 25-MAY-2018***

References

<NOTE:1402154.1> - Sun Storage 7000 Unified Storage System: Configuring the ZFSSA for Active Directory
http://www.us-cert.gov/ncas/alerts/TA14-013A
<NOTE:1561520.1> - Sun Storage 7000 Unified Storage System: How to sync to an NTP Server that is behind (in time) the NAS Appliance
<NOTE:1022253.1> - KMS - System Time Synchronization
http://support.microsoft.com/kb/816042
http://www.pool.ntp.org/zone/@

Attachments

This solution has no attachment