How do you secure NTP, and how do you configure NTP authentication on IOS?
Show the answer
Say this first
Three layers. Authenticate the servers with symmetric keys, so a device only accepts time from a
source that proves it knows the key. Restrict who may sync or query with ntp access-group and
infrastructure ACLs on UDP 123. And use several sources, so one bad clock gets outvoted. An IOS client
needs four pieces: the key, ntp authenticate, the key marked trusted, and the server tied to the key.
Go deeper
Client configuration
ntp authentication-key 1 md5 N7p-Octet-Key
ntp authenticate
ntp trusted-key 1
ntp server 10.0.0.123 key 1
ntp server 10.0.0.124 key 1
ntp source Loopback0The running config shows the key string encrypted with type 7. show ntp associations detail shows
the word authenticated for each server that passes.
ntp authenticate means "only sync to authenticated sources". Any server configured without a working
key keeps answering but is never selected.
Who may talk to you
access-list 10 permit 10.0.0.123
access-list 10 permit 10.0.0.124
access-list 20 permit 10.0.0.0 0.255.255.255
ntp access-group peer 10
ntp access-group serve-only 20peer sources may sync this device, serve-only clients may only ask for time, query-only allows
control queries only. Once any access group is set, everything not permitted is refused.
Junos
set system ntp authentication-key 1 type md5 value "N7p-Octet-Key"
set system ntp trusted-key 1
set system ntp server 10.0.0.123 key 1Beyond MD5 keys
Symmetric MD5 keys are old but interoperate everywhere. Network Time Security (NTS, RFC 8915) uses TLS to agree keys and then authenticates every NTP packet. chrony and NTPsec support it; network devices mostly do not yet.
They will ask next
You enabled ntp authenticate and the router lost sync with its upstream servers. Why?
The upstream servers do not use keys, for example public pool servers. With
ntp authenticateon, unauthenticated sources are no longer eligible. Sync that box to keyed internal servers instead.Why was NTP a DDoS problem?
Old ntpd answered the
monlistquery with a list of up to 600 recent clients: a tiny spoofed request produced a huge reply. Current software drops it; still restrict queries to your own networks.Does NTP authentication encrypt the time?
No. It adds a keyed digest that proves where the packet came from and that it was not changed. The time itself is not secret.
Traps
- Defining the key and the server but forgetting
ntp trusted-key. The client never syncs. - Turning on
ntp authenticateon a box whose upstream servers have no keys.