From owner-freebsd-security@FreeBSD.ORG  Mon Dec 22 19:02:25 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 830699B6
 for <freebsd-security@freebsd.org>; Mon, 22 Dec 2014 19:02:25 +0000 (UTC)
Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com
 [66.111.4.25])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 53CD21AD3
 for <freebsd-security@freebsd.org>; Mon, 22 Dec 2014 19:02:25 +0000 (UTC)
Received: from compute2.internal (compute2.nyi.internal [10.202.2.42])
 by mailout.nyi.internal (Postfix) with ESMTP id 8217A20E55
 for <freebsd-security@freebsd.org>; Mon, 22 Dec 2014 14:02:18 -0500 (EST)
Received: from web3 ([10.202.2.213])
 by compute2.internal (MEProxy); Mon, 22 Dec 2014 14:02:18 -0500
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=
 messagingengine.com; h=message-id:x-sasl-enc:from:to
 :mime-version:content-transfer-encoding:content-type:subject
 :date:in-reply-to:references; s=smtpout; bh=oG14fDg1Orl76GiVXcZm
 6l8wYlw=; b=K0b4P652F+B8LfFiPJie5jy94loLWZA3Gy2l2fY8URyPiU8aVDre
 2ZbPp9Ge4sMZ/vBNr4wEXmzl4hFmxvjXe4DwxUmYauJ3pNLPhQcx5A/L5rBMMtIh
 LO1li5q1XOuTaMCRvPiRv7vvPKJy2yHd3DNhrzzoEMuxgE/Yz3thDWw=
Received: by web3.nyi.internal (Postfix, from userid 99)
 id 4FA2E107BF5; Mon, 22 Dec 2014 14:02:18 -0500 (EST)
Message-Id: <1419274938.916478.205831685.0E7433EA@webmail.messagingengine.com>
X-Sasl-Enc: ykD/WViW6Qc4yZmKbn3lpoH/vPXLFZkh+F0cbRkl8dc2 1419274938
From: Mark Felder <feld@FreeBSD.org>
To: freebsd-security@freebsd.org
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain
X-Mailer: MessagingEngine.com Webmail Interface - ajax-31f62092
Subject: Re: ntpd vulnerabilities
Date: Mon, 22 Dec 2014 13:02:18 -0600
In-Reply-To: <201412221745.KAA28186@mail.lariat.net>
References: <252350272.1812596.1419241828431.JavaMail.zimbra@cleverbridge.com>
 <B6AF154A-FE22-4357-9031-91D661FD7E57@localhost.lu>
 <F7FACD2F-3AFE-4717-B4B9-B54A6FC70458@localhost.lu>
 <201412221745.KAA28186@mail.lariat.net>
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 22 Dec 2014 19:02:25 -0000

On Mon, Dec 22, 2014, at 11:39, Brett Glass wrote:
> I'd like to propose that FreeBSD move to OpenNTPD, which appears to 
> have none of the
> fixed or unfixed (!) vulnerabilities that are present in ntpd. 
> There's already a port.
> 

Historically OpenNTPD has been dismissed as a candidate because of its
reduced accuracy and missing security features. For example, it doesn't
implement the NTPv4 functionality or authentication.

Quite literally the OpenNTPD is vulnerable to a MITM attack because of
the lack of authentication. Their stance has been that you should trust
your NTP servers and suggest using a VPN for the NTP traffic. Probably
not a bad idea, honestly.

I don't have a qualified opinion, but that should get you on the right
track if you want to research further.