aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYi Zhao <yi.zhao@windriver.com>2020-01-03 10:42:45 +0800
committerKhem Raj <raj.khem@gmail.com>2020-01-03 13:56:00 -0800
commit2401ade3c48771097456046da3347c884908d3a1 (patch)
treec07be1cc4516c5b9ad7ddeddd2eed3f62e7dcfe1
parent5b15fb9c839a276220651946efd1d1a303ff0d45 (diff)
downloadmeta-openembedded-contrib-2401ade3c48771097456046da3347c884908d3a1.tar.gz
meta-openembedded-contrib-2401ade3c48771097456046da3347c884908d3a1.tar.bz2
meta-openembedded-contrib-2401ade3c48771097456046da3347c884908d3a1.zip
ntp: restrict NTP mode 6 queries
The current NTP server responds to mode 6 queries from any clients. Devices that respond to these queries have the potential to be used in NTP amplification attacks. An unauthenticated, remote attacker could potentially exploit this, via a specially crafted mode 6 query, to cause a reflected denial of service condition. See: https://www.tenable.com/plugins/nessus/97861 https://scan.shadowserver.org/ntpversion/ Update ntp.conf to restrict NTP mode 6 queries. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
-rw-r--r--meta-networking/recipes-support/ntp/ntp/ntp.conf6
1 files changed, 5 insertions, 1 deletions
diff --git a/meta-networking/recipes-support/ntp/ntp/ntp.conf b/meta-networking/recipes-support/ntp/ntp/ntp.conf
index 676e186453..b59003092b 100644
--- a/meta-networking/recipes-support/ntp/ntp/ntp.conf
+++ b/meta-networking/recipes-support/ntp/ntp/ntp.conf
@@ -14,4 +14,8 @@ driftfile /var/lib/ntp/drift
server 127.127.1.0
fudge 127.127.1.0 stratum 14
# Defining a default security setting
-restrict default
+restrict -4 default notrap nomodify nopeer noquery
+restrict -6 default notrap nomodify nopeer noquery
+
+restrict 127.0.0.1 # allow local host
+restrict ::1 # allow local host