[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <56A90755.2030706@river.com>
Date: Wed, 27 Jan 2016 11:07:17 -0700
From: Richard Johnson <rdump@...er.com>
To: oss-security@...ts.openwall.com
Cc: pool@...ts.ntp.org, team@...urity.debian.org, secalert@...hat.com
Subject: Re: shodan.io actively infiltrating ntp.org IPv6 pools
for scanning purposes
On 2016-01-27 06:05, Loganaden Velvindron wrote:
> Shouldn't we have some kind of policy for operators participating in
> pool.ntp.org to prevent such issues ?
If the issue is 'port scanning by the IPv6 NTP pool participant', why bother?
Any IPv6 NTP pool provider will naturally have peer IPv6 addresses to use and
record. It's one way that researchers at measurement organizations already
track IPv6 use and growth.
Others can, do, and will use popular public services like NTP to enumerate and
record active peer addresses as well. And some of those others will do things
with that data.
A policy that says "do not log peer addresses" would be nice for privacy
reasons, and bad for maintenance reasons. Practically speaking, violations
will be undetectable, and it'll be unenforceable.
Maybe a policy that says 'do not engage in DoS' instead?
Either way, when we don't want to be scanned, regardless of how the scanner
gets their target addresses, we tend to use perimeter firewalls.
Richard
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
