Matthias Urlichs wrote (a long time ago): > The default configuration already limits which peers ntpd trusts.
The paranoid amongst us don't even want potentially malicious packets getting that far. If ntpd has to inspect a packet to determine whether or not it should trust that packet, it's potentially already vulnerable to attack. > If you need to filter more strictly, you can use iptables, or > authenticated NTP packets. Personally, I don't see much of a need to > implement what amounts to a packet filter in a network daemon when > there's a perfectly valid way to do this already. It's a valid strategy sometimes referred to as the many layers of security. First layer is often network topography, second layer may be a packet filter, third layer may be restricting a service from listening on certain interfaces, and a fourth layer may be access controls within that service. These multiple layers mean that if a single layer fails (say, a misconfigured packet filter) the service doesn't instantly become vulnerable. Relying on a single layer may be appropriate for your situation, but it's not always appropriate. It's discourteous for you to simply dismiss the concerns of others whose situations may not match yours. Add me to the list of people who would like a "listen w.x.y.z" configuration parameter. -- Sam "Eddie" Couter | mailto:[EMAIL PROTECTED] Debian Developer | mailto:[EMAIL PROTECTED] | jabber:[EMAIL PROTECTED] OpenPGP fingerprint: A46B 9BB5 3148 7BEA 1F05 5BD5 8530 03AE DE89 C75C
signature.asc
Description: Digital signature
