Authenicated NTP
-
Posted in General because I couldn't find NTP. Feel free to move this where it needs to go.
For those of us who are super tin foil, we use authenticated NTP. See NIST for how to setup.
The value of /var/etc/ntp.key should be of the form:
<key number> [M or SHA1] <your authentication key>
Whey you fill out Services->Authentication key with your private key, there is no place to input the number. Thus result in /var/etc/ntp.key is (where 12345 is my key number):
1 [M or SHA1] <your authentication key]
I edited the file and was able to test correctly.
ntpdate -d -a 12345 -k /var/etc/ntp.keys 129.6.15.32 6 Apr 17:20:48 ntpdate[49359]: ntpdate 4.2.8p15@1.3728-o Fri Feb 5 22:16:11 UTC 2021 (1) transmit(129.6.15.32) receive(129.6.15.32) receive: authentication passed transmit(129.6.15.32) receive(129.6.15.32) receive: authentication passed transmit(129.6.15.32) receive(129.6.15.32) receive: authentication passed transmit(129.6.15.32) receive(129.6.15.32) receive: authentication passed server 129.6.15.32, port 123 stratum 1, precision -29, leap 00, trust 000 refid [NIST], root delay 0.000244, root dispersion 0.000488 reference time: e4174f31.00000000 Tue, Apr 6 2021 17:20:49.000 originate timestamp: e4174f36.6798cfe3 Tue, Apr 6 2021 17:20:54.404 transmit timestamp: e4174f36.662f96ed Tue, Apr 6 2021 17:20:54.399 filter delay: 0.03932 0.03625 0.03706 0.03622 ---- ---- ---- ---- filter offset: +0.001771 +0.000226 +0.000641 +0.000198 ---- ---- ---- ---- delay 0.03622, dispersion 0.00029, offset +0.000198 6 Apr 17:20:54 ntpdate[49359]: adjust time server 129.6.15.32 offset +0.000198 sec
Anybody else using authenticated NTP?
V/r,
-LamaZ
-
@lamaz said in Authenicated NTP:
Anybody else using authenticated NTP?
I would think that a pretty small subset of users..
I run my own local ntp on my network, I don't see the point of having to auth my own devices to talk to my own ntp, over my own local network ;)
I could see if running some sort of public available ntp, and you only wanted authed users to be able to access it.
That IP is just ntp-g.nist.gov - do they require auth to talk to it? Ahhh your using
https://www.nist.gov/pml/time-and-frequency-division/time-services/nist-authenticated-ntp-service -
@johnpoz I'll rephrase. How can we fix this bug? :) The GUI is missing the key number field.
-
I would have to look into that RFC..
But if have discovered something that doesn't allow it to work.. Then yeah submit a bug report over at https://redmine.pfsense.org/
I would link to this thread...
Or if @jimp or maybe @stephenw10 check out this thread, and they feel its warranted they might open one..
edit: Wow you have to snail mail them or fax to get a key, how old school ;)
edit2: Without even trying to set this up, I could see another problem, what if you have different servers with different keys.. How could you setup your different servers in the gui to use different keys?
What if you want server A to use auth, and B not too? I don't see in the gui how you could set this up?
edit3: I found this over at redmine
https://redmine.pfsense.org/issues/8794You know what I am thinking is that setting is for just pfsense NTP server, and clients to auth to it.. And not as pfsense to be client and auth to servers.
notice this statement in the redmine
"pfSense NTP client still doesn't have authentication support, so I set the target version to 2.5.next"So it seems they are aware, and on their radar..
edit: I might play with this locally, just to play with it.. Never ran into the want/need to auth ntp.. But look interesting.
And btw - this seems like good enough section for this kind of discussion. Thanks for bringing it up.
-
I got authenticated NTP working. I made a diff file for those who feel adventurous.
Changes needed are in the function
system_ntp_configure()
in the file/etc/inc/system.inc
. The GUI doesn't support it yet, so I made the change a local variable $ntp_key. The original value was hard coded to 1, so I made that the default.--- /etc/inc/system.inc.original 2021-04-14 13:20:08.366622000 -0400 +++ /etc/inc/system.inc 2021-04-14 14:14:51.708673000 -0400 @@ -1772,6 +1772,7 @@ $driftfile = "/var/db/ntpd.drift"; $statsdir = "/var/log/ntp"; $gps_device = '/dev/gps0'; + $ntp_key = "1"; safe_mkdir($statsdir); @@ -1802,7 +1803,8 @@ /* set NTP server authentication key */ if ($config['ntpd']['serverauth'] == 'yes') { - $ntpkeyscfg = "1 " . strtoupper($config['ntpd']['serverauthalgo']) . " " . base64_decode($config['ntpd']['serverauthkey']) . "\n"; + $ntp_key = "12345"; + $ntpkeyscfg = $ntp_key . " " . strtoupper($config['ntpd']['serverauthalgo']) . " " . base64_decode($config['ntpd']['serverauthkey']) . "\n"; if (!@file_put_contents("{$g['varetc_path']}/ntp.keys", $ntpkeyscfg)) { log_error(sprintf(gettext("Could not open %s/ntp.keys for writing"), $g['varetc_path'])); return; @@ -1818,10 +1820,11 @@ if ($config['ntpd']['serverauth'] == 'yes') { $ntpcfg .= "# Authentication settings \n"; + $ntpcfg .= "enable auth \n"; $ntpcfg .= "keys /var/etc/ntp.keys \n"; - $ntpcfg .= "trustedkey 1 \n"; - $ntpcfg .= "requestkey 1 \n"; - $ntpcfg .= "controlkey 1 \n"; + $ntpcfg .= "trustedkey " . $ntp_key . " \n"; + $ntpcfg .= "requestkey " . $ntp_key . " \n"; + $ntpcfg .= "controlkey " . $ntp_key . " \n"; $ntpcfg .= "\n"; } @@ -1988,7 +1991,10 @@ } if (substr_count($config['ntpd']['noselect'], $ts)) { $ntpcfg .= ' noselect'; - } + } + if ($config['ntpd']['serverauth'] == 'yes') { + $ntpcfg .= " key " . $ntp_key . " "; + } $ntpcfg .= "\n"; } unset($ts);
Before using this patch file, make sure to change the value of $ntp_key from 12345 to whatever your NTP key provider gave you (NIST in my case).
Apply patch, verify that it works:
[21.02.2-RELEASE][admin@your-sweet-pfsense-server-name]/root: ntpq -pc as remote refid st t when poll reach delay offset jitter ============================================================================== *ntp-g.nist.gov .NIST. 1 u 7 64 377 10.865 -0.019 0.738 ind assid status conf reach auth condition last_event cnt =========================================================== 1 64816 f61a yes yes ok sys.peer sys_peer 1
Enjoy!
PS - Why authentication you ask?
-LamaZ
-
@lamaz said in Authenicated NTP:
PS - Why authentication you ask?
Nothing wrong with that... But run my own stratum 1 ntp server locally.. So yeah I trust it, and don't have any concerns.
While I agree this is neat shit, and could see the want/need - Your work could help them bring it to the masses faster (you would hope)
-
@johnpoz said in Authenicated NTP:
But run my own stratum 1 ntp server locally.. So yeah I trust it, and don't have any concerns.
Much respect. Keep it local when you can.
-
Maybe if I get board at some point - I will send the snail mail to get access to that ntp ;)
How long did it take you to get info back? Curious.
-
@johnpoz I want to say it was like 2-3 weeks. I wasn't keeping an accurate timeline. I can tell you that you must send the initial request via snail mail. I tried faxing my initial request and never seemed to get anywhere.
Your answer will come via an email from NIST that will have you log into an HTTPS site (an Accellion appliance) to download your keys.
-
Status update. Just upgraded to 21.05. This still works pretty much as is. After upgrade I did:
cd /etc patch -u -b inc/system.inc -i /root/system.inc.ntp-auth.patch
The -b will create a backup file (system.inc.original) in case anything goes wrong. Then modify the value $ntpkey in your /etc/inc/system.inc, and restart the ntp service.
Done.
-
Just upgraded to 22.01/2.6.0 and happy to say that this patch still works.
At first I got excited when I read on the release notes that maybe this would get added:
https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html
“ Added: Support SHA-256 hash NTP authentication #12213” -
@johnpoz Thanks for the information on this
-
Just upgraded to 23.01-RELEASE. The patch above doesn't work at the moment.
After restarting the NTP daemon, something has changed and now /etc/inc/system.inc is overwritten every time NTP is (re)started. I haven't figured out what changed and where I can write permanent updates tofunction system_ntp_configure()
.I figured out the issue. Version 23.01 changed the syntax for calling GUI fields. Here is a patch for 23.01. Don't forget to change the ntp_key value from 12345 to your NIST provided key.
system.inc.ntp-auth.23.01.patch
--- /etc/inc/system.inc.orig.23.01 2023-02-20 11:07:17.000586000 -0500 +++ /etc/inc/system.inc 2023-02-20 20:05:49.538823000 -0500 @@ -1828,6 +1828,7 @@ $driftfile = "/var/db/ntpd.drift"; $statsdir = "/var/log/ntp"; $gps_device = '/dev/gps0'; + $ntp_key = "1"; safe_mkdir($statsdir); @@ -1857,7 +1858,8 @@ /* set NTP server authentication key */ if (config_get_path('ntpd/serverauth') == 'yes') { - $ntpkeyscfg = "1 " . strtoupper(config_get_path('ntpd/serverauthalgo')) . " " . base64_decode(config_get_path('ntpd/serverauthkey')) . "\n"; + $ntp_key = "12345"; + $ntpkeyscfg = $ntp_key . " " . strtoupper(config_get_path('ntpd/serverauthalgo')) . " " . base64_decode(config_get_path('ntpd/serverauthkey')) . "\n"; if (!@file_put_contents("{$g['varetc_path']}/ntp.keys", $ntpkeyscfg)) { log_error(sprintf(gettext("Could not open %s/ntp.keys for writing"), g_get('varetc_path'))); return; @@ -1874,9 +1876,9 @@ if (config_get_path('ntpd/serverauth') == 'yes') { $ntpcfg .= "# Authentication settings \n"; $ntpcfg .= "keys /var/etc/ntp.keys \n"; - $ntpcfg .= "trustedkey 1 \n"; - $ntpcfg .= "requestkey 1 \n"; - $ntpcfg .= "controlkey 1 \n"; + $ntpcfg .= "trustedkey " . $ntp_key . " \n"; + $ntpcfg .= "requestkey " . $ntp_key . " \n"; + $ntpcfg .= "controlkey " . $ntp_key . " \n"; $ntpcfg .= "\n"; } @@ -2049,6 +2051,9 @@ } if (substr_count(config_get_path('ntpd/noselect'), $ts)) { $ntpcfg .= ' noselect'; + } + if (config_get_path('ntpd/serverauth') == 'yes') { + $ntpcfg .= " key " . $ntp_key . " "; } $ntpcfg .= "\n"; }
And the results showing valid auth
[23.01-RELEASE][admin@your-sweet-pfsense-server-name]/root: ntpq -pc as remote refid st t when poll reach delay offset jitter ============================================================================== *ntp-g.nist.gov .NIST. 1 u 68 64 377 5.806 -1.114 1.331 ind assid status conf reach auth condition last_event cnt =========================================================== 1 39518 f61a yes yes ok sys.peer sys_peer 1
-LamaZ
-
@johnpoz you can fax them also I just did, I want to test this, I have seen time jumps during cyber security classes in the past. 10-15 min jumps. Maybe this will fix it again with the use of my firewall I have not seen that in a while. Still I want to check it out. "Users who wish to use this service should send a letter to NIST using the US mail or FAX machine (e-mail is not acceptable)."
-
@lamaz were you ever in the past having issues that's with time jumps 10-15 mins around noonish?
-
For one device in the network it will be perhaps acceptable, but if you one and only device is the time server for the entire network and "something" occurs, you have to do the hardcore "aftermath" job to count all different time stamps
for finding something out! If you now have one good time source and offer it to the entire network, they (all devices)
have the same time stamp and let us name it "problems"
can be faster and more easy able to find out. A good time
sync server may be good for any kind of scenario or problems have to be find out. -
@dobby_ I have the firewall serving all time now, I am going to attempt the authenticated stratum NTP servers, the only problem is I might not have the pool of 4-5 servers to do the offsets time math equations automatically anymore as the authenticated server comes with only key for access. Prior to the pool I noticed slight time jumps in the past during my breaks or quizes. Yes NTP is an older protocol and does have some bugs I have noticed. I only ever spotted the jumps with a manual clock, and yes it's not all of them. Again during a test, or quiz a jump of 15 mins is a huge amount of time, and something was causing this deleting time to rush the tests, only reason was to cause a stressful environment. Again, these are problems that the multi pool solved. Will authenticated servers come with a pool? That I hope to find out soon. My current pool and time is set up with the slowed earth leap second offsets that the scientific community has listed for use. I also hope that still works. I have very precise time. I flat don't like it messed with anymore. Precision is what makes the difference. Logs is what tracks unethical behavior so it can be reported. It's unethical to move time like that during someone's break and or during a quiz. I am waiting for my letter in the mail so I can learn about authenticated NTP it, I hope it comes with a pool also.
-
@dobby_ the pools work very well as "NTP will only sync if a majority of the servers agree on the time. For best results you should configure between 3 and 5 servers (NTP support pages recommend at least 4 or 5), or a pool. If only one server is configured, it will be believed, and if 2 servers are configured and they disagree, neither will be believed." if 4 are used if one moves a large amount the other 3 have to agree if they don't, the time that is served never changes, if they are still off by a couple seconds between servers it balances them with an equation. It's a really good solution, as abuse is pointed to only one server so it doesn't effect the pool. You have to NAT NTP to the firewall for everything that wants time. I have it inverted anything that doesn't request my firewall for NTP gets NAT(ed) to it without knowing, that's when the abuse stopped forever. They now required 3 out of the 4 time servers to agree to on what is served. PfSense is amazing software when you get into it. NIST servers fixed everything for me with the jumps. I can't wait to test out authenticated services.
(I need my key to make it more secure)
(Pool Running and moving to stratum 1) -
Auth. NTP servers give you a bit more safe feeling, because they are knowing how many users are using that servers!
Its not like "tomorrow 15 million users" begin using that server and it is going down or responding slower, the delay is growing or the server is not any more responding.I use a mix of more then one NTP and also want to let it grow. At first I use NTP servers pool over WAN they are
connected to or based on an atomic clock. Might be the
best in my eyes. I have a fallback line over LTE for a
second chance to get the time over the internet.
The LTE modem has also a GPS antenna connected
so I got one more time source.The next way to set up was a miniCPIe GPS (only) card
inside of the pfSense and all is fine now.- wired internet
- wireless internet
- gps only
May be that auth. NTP server will be an option on top of all, because they know then the amount of users exactly
and can set up another one if the responds time goes down or will be lower and not anymore so fast. -
@dobby_ in the early 2000s we use to have to set the DTE and DCE clock rates for the network routers to work correctly, if they had no clock rates set they would not function. Imagine something like a Ciena or Juniper backbone system today, how perfectly in time they have to be to support supernet city to city communications. Time is amazing stuff as it is time of use specific.