commit 33676dff726b351a4dd4583fdc7a262ca15fdf07
Author: Stephen Wadeley <swadeley(a)redhat.com>
Date: Wed Jul 30 23:14:42 2014 +0200
Putting a space between RFC and the number {for consistency}
en-US/Configuring_NTP_Using_ntpd.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
---
diff --git a/en-US/Configuring_NTP_Using_ntpd.xml b/en-US/Configuring_NTP_Using_ntpd.xml
index 13a7266..8b36ccd 100644
--- a/en-US/Configuring_NTP_Using_ntpd.xml
+++ b/en-US/Configuring_NTP_Using_ntpd.xml
@@ -161,7 +161,7 @@
<section id="s1-Authentication_Options_for_NTP">
<title>Authentication Options for NTP</title>
<para>
- <systemitem class="protocol">NTPv4</systemitem> added support
for the Autokey Security Architecture, which is based on public asymmetric cryptography
while retaining support for symmetric key cryptography. The Autokey Security Architecture
is described in <ulink
url="http://www.rfc-editor.org/info/rfc5906"><citetitle
pubwork="webpage">RFC5906 Network Time Protocol Version 4: Autokey
Specification</citetitle></ulink>. The man page
<filename>ntp_auth(5)</filename> describes the authentication options and
commands for <systemitem class="daemon">ntpd</systemitem>.
+ <systemitem class="protocol">NTPv4</systemitem> added support
for the Autokey Security Architecture, which is based on public asymmetric cryptography
while retaining support for symmetric key cryptography. The Autokey Security Architecture
is described in <ulink
url="http://www.rfc-editor.org/info/rfc5906"><citetitle
pubwork="webpage">RFC 5906 Network Time Protocol Version 4: Autokey
Specification</citetitle></ulink>. The man page
<filename>ntp_auth(5)</filename> describes the authentication options and
commands for <systemitem class="daemon">ntpd</systemitem>.
</para>
<para>
An attacker on the network can attempt to disrupt a service by sending <systemitem
class="protocol">NTP</systemitem> packets with incorrect time
information. On systems using the public pool of <systemitem
class="protocol">NTP</systemitem> servers, this risk is mitigated by
having more than three <systemitem class="protocol">NTP</systemitem>
servers in the list of public <systemitem
class="protocol">NTP</systemitem> servers in
<filename>/etc/ntp.conf</filename>. If only one time source is compromised or
spoofed, <systemitem class="daemon">ntpd</systemitem> will ignore
that source. You should conduct a risk assessment and consider the impact of incorrect
time on your applications and organization. If you have internal time sources you should
consider steps to protect the network over which the <systemitem
class="protocol">NTP</systemitem> packets are distributed. If you
conduct a risk assessment and conclude that the risk is acceptable, and the impact to your
applications
minimal, then you can choose not to use authentication.