NTP encryption guidance

Shawn Wells shawn at redhat.com
Wed Jul 18 02:15:20 UTC 2012


On 7/16/12 3:30 PM, ctrueman at redhat.com wrote:
>
>  From 5b6c32eb632f7451bc2d14584ac9ac41217d8144 Mon Sep 17 00:00:00 2001
> From: Clifford Trueman<ctrueman at ctrueman.csb>
> Date: Mon, 16 Jul 2012 15:26:14 -0400
> Subject: [PATCH 4/4] added guidance for ntp encryption
>
>
> Signed-off-by: Clifford Trueman<ctrueman at redhat.com>
> ---
>   RHEL6/input/services/ntp.xml |   11 ++++++++++-
>   1 files changed, 10 insertions(+), 1 deletions(-)
>
> diff --git a/RHEL6/input/services/ntp.xml b/RHEL6/input/services/ntp.xml
> index c1acd4a..f3ea935 100644
> --- a/RHEL6/input/services/ntp.xml
> +++ b/RHEL6/input/services/ntp.xml
> @@ -1,6 +1,6 @@
>   <Group id="ntp">
>   <title>Network Time Protocol</title>
> -<description>The Network Time Protocol is used to manage the system
> +<description>check123 The Network Time Protocol is used to manage the system
>   clock over a network. Computer clocks are not very accurate, so
>   time will drift unpredictably on unmanaged systems. Central time
>   protocols can be used both to ensure that time is consistent among
> @@ -29,6 +29,9 @@ network to have a small number of machines operating as NTP
>   servers, and the remainder obtaining time information from those
>   internal servers.</description>

-check123


> +
> +
> +
>   <Group id="configuring_ntpd">
>   <title>Configure an NTP Server</title>
>   <description>The site's NTP server contacts a central NTP server,
> @@ -66,6 +69,12 @@ providing time data from the local clock. However, it is a good idea to
>   periodically synchronize the clock to some source of accurate time, even if it
>   is not appropriate to do so automatically.</description>
>   
> +<Group id="ntpd_encryption">
> +<title>NTP Encyrption</title>
> +<description>Basically NTP uses encryption only for integrity checking and authentication (which effectively is integrity checking): symmetric keys (shared secrets) are used to prove authenticity of data received over the network key pairs are used where establishing shared secrets is difficult. The autokey mechanism uses key pairs.
> +</description>
> +</Group>

The language should be a bit more formal, no "Basically..." sentences.

> +
>   <Rule id="ntpd_specify_remote_server">
>   <title>Specify a Remote NTP Server for Time Data</title>
>   <description>A remote NTP Server for time synchronization should be specified.
> -- 1.7.1


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://fedorahosted.org/pipermail/scap-security-guide/attachments/20120717/21e5e703/attachment.html>


More information about the scap-security-guide mailing list