From shawn at redhat.com Thu Aug 20 11:31:39 2015 Content-Type: multipart/mixed; boundary="===============0821014535978755179==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: NTP encryption guidance Date: Tue, 17 Jul 2012 22:15:20 -0400 Message-ID: <50061C38.7000307@redhat.com> In-Reply-To: 50046BD1.9000205@redhat.com --===============0821014535978755179== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 7/16/12 3:30 PM, ctrueman(a)redhat.com wrote: > > From 5b6c32eb632f7451bc2d14584ac9ac41217d8144 Mon Sep 17 00:00:00 2001 > From: Clifford Trueman > Date: Mon, 16 Jul 2012 15:26:14 -0400 > Subject: [PATCH 4/4] added guidance for ntp encryption > > > Signed-off-by: Clifford Trueman > --- > RHEL6/input/services/ntp.xml | 11 ++++++++++- > 1 files changed, 10 insertions(+), 1 deletions(-) > > diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml > index c1acd4a..f3ea935 100644 > --- a/RHEL6/input/services/ntp.xml > +++ b/RHEL6/input/services/ntp.xml > @@ -1,6 +1,6 @@ > > Network Time Protocol > -The Network Time Protocol is used to manage the system > +check123 The Network Time Protocol is used to manage the sy= stem > clock over a network. Computer clocks are not very accurate, so > time will drift unpredictably on unmanaged systems. Central time > protocols can be used both to ensure that time is consistent among > @@ -29,6 +29,9 @@ network to have a small number of machines operating as= NTP > servers, and the remainder obtaining time information from those > internal servers. -check123 > + > + > + > > Configure an NTP Server > The site's NTP server contacts a central NTP server, > @@ -66,6 +69,12 @@ providing time data from the local clock. However, it = is a good idea to > periodically synchronize the clock to some source of accurate time, eve= n if it > is not appropriate to do so automatically. > = > + > +NTP Encyrption > +Basically NTP uses encryption only for integrity checking a= nd authentication (which effectively is integrity checking): symmetric keys= (shared secrets) are used to prove authenticity of data received over the = network key pairs are used where establishing shared secrets is difficult. = The autokey mechanism uses key pairs. > + > + The language should be a bit more formal, no "Basically..." sentences. > + > > Specify a Remote NTP Server for Time Data > A remote NTP Server for time synchronization should be spe= cified. > -- 1.7.1 --===============0821014535978755179== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiA3LzE2LzEyIDM6MzAgUE0sIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQi IGhyZWY9Im1haWx0bzpjdHJ1ZW1hbkByZWRoYXQuY29tIj5jdHJ1ZW1hbkByZWRoYXQuY29tPC9h PgogICAgICB3cm90ZTo8YnI+CiAgICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1 MDA0NkJEMS45MDAwMjA1QHJlZGhhdC5jb20iIHR5cGU9ImNpdGUiPjxicj4KICAgICAgPGRpdiBj bGFzcz0ibW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBoaWNhbC1xdW90ZT0idHJ1ZSIK ICAgICAgICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTogMTJweDsi CiAgICAgICAgbGFuZz0ieC13ZXN0ZXJuIj4KICAgICAgICA8cHJlIHdyYXA9IiI+RnJvbSA1YjZj MzJlYjYzMmY3NDUxYmMyZDE0NTg0YWM5YWM0MTIxN2Q4MTQ0IE1vbiBTZXAgMTcgMDA6MDA6MDAg MjAwMQpGcm9tOiBDbGlmZm9yZCBUcnVlbWFuIDxhIG1vei1kby1ub3Qtc2VuZD0idHJ1ZSIgY2xh c3M9Im1vei10eHQtbGluay1yZmMyMzk2RSIgaHJlZj0ibWFpbHRvOmN0cnVlbWFuQGN0cnVlbWFu LmNzYiI+Jmx0O2N0cnVlbWFuQGN0cnVlbWFuLmNzYiZndDs8L2E+CkRhdGU6IE1vbiwgMTYgSnVs IDIwMTIgMTU6MjY6MTQgLTA0MDAKU3ViamVjdDogW1BBVENIIDQvNF0gYWRkZWQgZ3VpZGFuY2Ug Zm9yIG50cCBlbmNyeXB0aW9uCgoKU2lnbmVkLW9mZi1ieTogQ2xpZmZvcmQgVHJ1ZW1hbiA8YSBt b3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9 Im1haWx0bzpjdHJ1ZW1hbkByZWRoYXQuY29tIj4mbHQ7Y3RydWVtYW5AcmVkaGF0LmNvbSZndDs8 L2E+Ci0tLQogUkhFTDYvaW5wdXQvc2VydmljZXMvbnRwLnhtbCB8ICAgMTEgKysrKysrKysrKy0K IDEgZmlsZXMgY2hhbmdlZCwgMTAgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbnMoLSkKCmRpZmYg LS1naXQgYS9SSEVMNi9pbnB1dC9zZXJ2aWNlcy9udHAueG1sIGIvUkhFTDYvaW5wdXQvc2Vydmlj ZXMvbnRwLnhtbAppbmRleCBjMWFjZDRhLi5mM2VhOTM1IDEwMDY0NAotLS0gYS9SSEVMNi9pbnB1 dC9zZXJ2aWNlcy9udHAueG1sCisrKyBiL1JIRUw2L2lucHV0L3NlcnZpY2VzL250cC54bWwKQEAg LTEsNiArMSw2IEBACiAmbHQ7R3JvdXAgaWQ9Im50cCImZ3Q7CiAmbHQ7dGl0bGUmZ3Q7TmV0d29y ayBUaW1lIFByb3RvY29sJmx0Oy90aXRsZSZndDsKLSZsdDtkZXNjcmlwdGlvbiZndDtUaGUgTmV0 d29yayBUaW1lIFByb3RvY29sIGlzIHVzZWQgdG8gbWFuYWdlIHRoZSBzeXN0ZW0KKyZsdDtkZXNj cmlwdGlvbiZndDtjaGVjazEyMyBUaGUgTmV0d29yayBUaW1lIFByb3RvY29sIGlzIHVzZWQgdG8g bWFuYWdlIHRoZSBzeXN0ZW0KIGNsb2NrIG92ZXIgYSBuZXR3b3JrLiBDb21wdXRlciBjbG9ja3Mg YXJlIG5vdCB2ZXJ5IGFjY3VyYXRlLCBzbwogdGltZSB3aWxsIGRyaWZ0IHVucHJlZGljdGFibHkg b24gdW5tYW5hZ2VkIHN5c3RlbXMuIENlbnRyYWwgdGltZQogcHJvdG9jb2xzIGNhbiBiZSB1c2Vk IGJvdGggdG8gZW5zdXJlIHRoYXQgdGltZSBpcyBjb25zaXN0ZW50IGFtb25nCkBAIC0yOSw2ICsy OSw5IEBAIG5ldHdvcmsgdG8gaGF2ZSBhIHNtYWxsIG51bWJlciBvZiBtYWNoaW5lcyBvcGVyYXRp bmcgYXMgTlRQCiBzZXJ2ZXJzLCBhbmQgdGhlIHJlbWFpbmRlciBvYnRhaW5pbmcgdGltZSBpbmZv cm1hdGlvbiBmcm9tIHRob3NlCiBpbnRlcm5hbCBzZXJ2ZXJzLiZsdDsvZGVzY3JpcHRpb24mZ3Q7 PC9wcmU+CiAgICAgIDwvZGl2PgogICAgPC9ibG9ja3F1b3RlPgogICAgPGJyPgogICAgLWNoZWNr MTIzPGJyPgogICAgPGJyPgogICAgPGJyPgogICAgPGJsb2NrcXVvdGUgY2l0ZT0ibWlkOjUwMDQ2 QkQxLjkwMDAyMDVAcmVkaGF0LmNvbSIgdHlwZT0iY2l0ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1v ei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGljYWwtcXVvdGU9InRydWUiCiAgICAgICAg c3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBmb250LXNpemU6IDEycHg7IgogICAgICAg IGxhbmc9Ingtd2VzdGVybiI+CiAgICAgICAgPHByZSB3cmFwPSIiPisKKworCiAmbHQ7R3JvdXAg aWQ9ImNvbmZpZ3VyaW5nX250cGQiJmd0OwogJmx0O3RpdGxlJmd0O0NvbmZpZ3VyZSBhbiBOVFAg U2VydmVyJmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlvbiZndDtUaGUgc2l0ZSdzIE5UUCBz ZXJ2ZXIgY29udGFjdHMgYSBjZW50cmFsIE5UUCBzZXJ2ZXIsCkBAIC02Niw2ICs2OSwxMiBAQCBw cm92aWRpbmcgdGltZSBkYXRhIGZyb20gdGhlIGxvY2FsIGNsb2NrLiBIb3dldmVyLCBpdCBpcyBh IGdvb2QgaWRlYSB0bwogcGVyaW9kaWNhbGx5IHN5bmNocm9uaXplIHRoZSBjbG9jayB0byBzb21l IHNvdXJjZSBvZiBhY2N1cmF0ZSB0aW1lLCBldmVuIGlmIGl0CiBpcyBub3QgYXBwcm9wcmlhdGUg dG8gZG8gc28gYXV0b21hdGljYWxseS4mbHQ7L2Rlc2NyaXB0aW9uJmd0OwogCismbHQ7R3JvdXAg aWQ9Im50cGRfZW5jcnlwdGlvbiImZ3Q7CismbHQ7dGl0bGUmZ3Q7TlRQIEVuY3lycHRpb24mbHQ7 L3RpdGxlJmd0OworJmx0O2Rlc2NyaXB0aW9uJmd0O0Jhc2ljYWxseSBOVFAgdXNlcyBlbmNyeXB0 aW9uIG9ubHkgZm9yIGludGVncml0eSBjaGVja2luZyBhbmQgYXV0aGVudGljYXRpb24gKHdoaWNo IGVmZmVjdGl2ZWx5IGlzIGludGVncml0eSBjaGVja2luZyk6IHN5bW1ldHJpYyBrZXlzIChzaGFy ZWQgc2VjcmV0cykgYXJlIHVzZWQgdG8gcHJvdmUgYXV0aGVudGljaXR5IG9mIGRhdGEgcmVjZWl2 ZWQgb3ZlciB0aGUgbmV0d29yayBrZXkgcGFpcnMgYXJlIHVzZWQgd2hlcmUgZXN0YWJsaXNoaW5n IHNoYXJlZCBzZWNyZXRzIGlzIGRpZmZpY3VsdC4gVGhlIGF1dG9rZXkgbWVjaGFuaXNtIHVzZXMg a2V5IHBhaXJzLiAKKyZsdDsvZGVzY3JpcHRpb24mZ3Q7CismbHQ7L0dyb3VwJmd0OzwvcHJlPgog ICAgICA8L2Rpdj4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIFRoZSBsYW5ndWFnZSBz aG91bGQgYmUgYSBiaXQgbW9yZSBmb3JtYWwsIG5vICJCYXNpY2FsbHkuLi4iCiAgICBzZW50ZW5j ZXMuIDxicj4KICAgIDxicj4KICAgIDxibG9ja3F1b3RlIGNpdGU9Im1pZDo1MDA0NkJEMS45MDAw MjA1QHJlZGhhdC5jb20iIHR5cGU9ImNpdGUiPgogICAgICA8ZGl2IGNsYXNzPSJtb3otdGV4dC1w bGFpbiIgd3JhcD0idHJ1ZSIgZ3JhcGhpY2FsLXF1b3RlPSJ0cnVlIgogICAgICAgIHN0eWxlPSJm b250LWZhbWlseTogLW1vei1maXhlZDsgZm9udC1zaXplOiAxMnB4OyIKICAgICAgICBsYW5nPSJ4 LXdlc3Rlcm4iPgogICAgICAgIDxwcmUgd3JhcD0iIj4rCiAmbHQ7UnVsZSBpZD0ibnRwZF9zcGVj aWZ5X3JlbW90ZV9zZXJ2ZXIiJmd0OwogJmx0O3RpdGxlJmd0O1NwZWNpZnkgYSBSZW1vdGUgTlRQ IFNlcnZlciBmb3IgVGltZSBEYXRhJmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlvbiZndDtB IHJlbW90ZSBOVFAgU2VydmVyIGZvciB0aW1lIHN5bmNocm9uaXphdGlvbiBzaG91bGQgYmUgc3Bl Y2lmaWVkLgo8ZGl2IGNsYXNzPSJtb3otdHh0LXNpZyI+LS0gCjEuNy4xCgo8L2Rpdj48L3ByZT4K ICAgICAgPC9kaXY+CiAgICA8L2Jsb2NrcXVvdGU+CiAgICA8YnI+CiAgICA8YnI+CiAgPC9ib2R5 Pgo8L2h0bWw+Cg== --===============0821014535978755179==--