10

I have a number of openSUSE VMs (mostly 13.1). One of the VMs is configured to sync its time with the outside world, the other ones sync with this one. This has never caused problems (that I am aware of).

Now I noticed that ntpd on the outside-connected VM causes about 9% CPU load (permanently!) and makes connections to 15+ hosts causing outbound traffic of about 100K/s and inbound traffic at a little lower level (all from/to my UDP port 123) – which even continues (now for several minutes) after I have stopped ntpd and there is no such outbound traffic any more.

I had configured ntpd to the pool address de.pool.ntp.org but that does not make a difference.

I made a distro upgrade (booting from DVD) and afterwards even reinstalled ntp without any change.

Edit: problem "solved"

After I have blocked incoming UDP 123 completely ntpd acts normally. I still don't understand what may have caused this. It should not be possible to connect to this VM port from the outside. There is no port forwarding in the VDSL router.

But: A few minutes ago I sent a UDP packet to port 123 from the Internet and (whyever) the VDSL router passed it to the VM. If I repeat that now then the packet does not reach the VM any more. Maybe that was a strange NAT side effect of the many UDP 123 connections.

I am going to block this traffic except for the intended servers.

Rui F Ribeiro
  • 55,929
  • 26
  • 146
  • 227
Hauke Laging
  • 88,146
  • 18
  • 125
  • 174
  • What are the hosts in question? – Faheem Mitha Apr 19 '14 at 16:42
  • 2
    This was in the news recently: http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack. The largest attack ever recorded was achieved using NTPD as an amplification attack. – slm Apr 19 '14 at 18:25
  • 1
    It's possible that external access was allowed via UPnP rather than an explicit port forward. Unlikely, though. – Bob Apr 20 '14 at 04:23

1 Answers1

14

If you have NTP Reflection enabled your NTP servers might be used as a part of DDoS. To make sure NTP reflection is disabled, add this to your ntp.conf:

disable monitor

Then restart all ntp services.

More info on NTP based DDoS: http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks

ek9
  • 2,875
  • 3
  • 18
  • 27
  • See the edit to my question. I am a bit confused because this system should not have been reachable on this port from the outside. – Hauke Laging Apr 19 '14 at 17:11