After a year of development, the release of the NTPsec 1.2.3 time synchronization system has been published. This version is a fork of the reference implementation of the NTPv4 protocol (NTP Classic 4.3.34), focusing on codebase revisions aimed at enhancing security (outdated code has been cleaned up, attack prevention methods employed, and secure functions for memory and string handling introduced). The project is developed under the leadership of Eric S. Raymond, with contributions from some of the original NTP Classic developers, engineers from Hewlett Packard and Akamai Technologies, as well as projects GPSD and RTEMS. The source texts of NTPsec are distributed under BSD, MIT, and NTP licenses.
Among the changes in the new version:
- The alignment of Mode 6 control protocol packets has been changed, which may lead to compatibility issues with classic NTP. The Mode 6 protocol is used for transmitting status information. server and changing server behavior on the fly.
- The ntpq now utilizes the AES encryption algorithm by default.
- The Seccomp mechanism is employed to block incorrect system call names.
- An hourly reset of some statistics has been enabled. Log files have been added that record hourly statistics for NTS and NTS-KE. Error logging and ms-sntp statistics have also been added.
- The debug symbol build is enabled by default.
- Support has been added for specifying a list of permitted ECDH elliptic curves (tlsecdhcurves setting) supported in OpenSSL.
- An 'update' option has been added in buildprep.
- In the JSON output for ntpdig, latency data is displayed.
Source: opennet.ru
